Numera — Privacy & Data

Draft. Last updated: 2026-06-11. This document is the engineering copy of Numera's privacy policy. Final wording must be reviewed by qualified legal counsel before it is published in-app or linked in the app stores. Items in [SQUARE BRACKETS] are placeholders that must be completed (legal entity details, public policy URL, hosting region, supervisory authority, DPO) before publication.

This policy explains what data Numera stores, why we store it, who we share it with, and how to exercise your rights under the EU/UK General Data Protection Regulation (GDPR) and the Israeli Privacy Protection Law. It also covers the disclosures required by the Apple App Store and Google Play (Section 12).

1. Who we are (data controller)

Numera is operated by EVALIX ("Numera", "we", "us"), registered at [REGISTERED ADDRESS — pending company registration], company number [COMPANY / REGISTRATION NUMBER — pending company registration].

For all data-protection matters we are the data controller of the information described in this policy.

• Contact for privacy matters: [email protected]
• Data Protection Officer: We have not appointed a Data Protection Officer. Numera does not carry out large-scale monitoring or large-scale processing of special-category data, so a DPO is not mandatory under GDPR Art. 37. Privacy enquiries are handled at [email protected].
• EU/UK representative (GDPR Art. 27): Not applicable — Numera is not offered to users in the EU/EEA at this time. If EU/EEA availability is enabled in a future release, an EU representative must be appointed and this section updated first.

2. Who this policy applies to and minimum age

This policy applies to everyone who uses the Numera app on iOS or Android.

Numera is not directed at children. You must be at least 18 years old to create an account. We do not knowingly collect data from anyone below this age. If you believe a minor has provided us data, contact us and we will delete it.

This policy also governs data you enter about other people (for example, a partner you add for a compatibility reading). See Section 9.

3. What data we store

When you create a Numera account, we store the following under your user ID:

When you use the Couple Compatibility and Relationship Insights features, we additionally store:

Running the service also produces the following. Most of it is about the account rather than about you, and it is listed because a subject access request returns all of it:

We do not sell your data, and we do not share it with third parties for advertising or marketing.

4. Legal bases for processing

We rely on the following lawful bases under GDPR Article 6 (and the equivalent grounds under Israeli law):

• Performance of a contract (Art. 6(1)(b)) — to create your account, generate and save your charts, run compatibility analyses and insights, and provide the subscription you paid for.
• Consent (Art. 6(1)(a)) — where you choose to provide optional data (e.g. a Hebrew name, birth time, birth place) or enter data about another person. You can withdraw consent at any time (Section 11).
• Explicit consent for special-category data (Art. 9(2)(a)) — where your free-text Insights questions reveal sensitive information (see Section 7).
• Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent abuse, enforce usage quotas, and maintain a short audit trail of deletion/export requests. We balance these interests against your rights and only process what is necessary.
• Legal obligation (Art. 6(1)(c)) — to retain limited billing/tax records and to evidence that a data request was honoured.

5. How we use your data

We use your data only to:

1. Generate your numerology charts (computed on your device — basic chart data does not leave your phone unless you save it or request an AI analysis).
2. Produce AI deep-dives, compatibility readings, and relationship insights when you request them.
3. Manage your account, subscription, and usage quotas.
4. Route crisis-flagged questions to appropriate support resources (Section 7).
5. Keep the service secure and prevent misuse.
6. Send you service messages about your own account — for example a billing problem, or a usage limit reached.
7. Send a short sequence of messages about getting started, if you sign up and do not continue. These are marketing, they are finite, they say so, and every one carries an unsubscribe link. Unsubscribing stops them and does not stop service messages about your own account, because withholding "your payment failed" from someone who once clicked unsubscribe would harm them.
8. Comply with our legal obligations and respond to your data-rights requests.

We do not use your data to train AI models, and we do not profile you for advertising.

6. Third parties and international transfers

To run Numera we share the minimum necessary data with the following processors. Your account and app data is stored inside the European Union. Some processors operate outside the European Economic Area (EEA) (notably in the United States); where that is the case, the transfer is protected by appropriate safeguards — Standard Contractual Clauses, and, where the processor is certified, the EU–US Data Privacy Framework.

Anthropic processes the data to produce the response and, per their terms, does not retain it to train their models. We send only what is needed for the feature you requested.

7. Sensitive content and wellbeing

Some of what Numera processes is unusually personal, and we want to be explicit about it.

Your Insights questions. When you ask a relationship question, the text you write is stored in relationship_insights and sent to Anthropic to generate a response. These questions can be emotionally significant. They are visible only to you (enforced at the database level) and are deleted when you delete the analysis, the partner, or your account.

Special-category data. Your free-text questions, your spiritual/Kabbalistic inputs, or details about your relationships may incidentally reveal information that GDPR treats as special-category — for example data concerning health, religious or philosophical beliefs, or your sex life. Where this happens, our legal basis is your explicit consent, given by choosing to use the feature. You are never required to share such information, and you can delete it at any time.

Crisis and wellbeing handling. Before generating an insight, your question passes through an automated wellbeing classifier. If it detects crisis-level content (such as references to self-harm or abuse), the app prioritises showing you localised support resources (e.g. ERAN 1201 in Israel, 988 in the US, Samaritans 116 123 in the UK) ahead of any chart content. This classification is automated; flagged questions are not reviewed by staff as a matter of course, and the classifier result is stored alongside your question solely to deliver the correct response. The classifier is a safety feature, not a substitute for professional help, and does not contact any third party or authority on your behalf.

8. How long we keep your data

• Account and app data (charts, analyses, insights, quotas) is kept for as long as your account is active, and is deleted when you delete it or close your account (Section 11).
• Billing records required by law are retained for the period mandated by applicable tax/accounting rules.
• The deletion/export audit log is kept for 30 days and then automatically purged (Section 14).
• Cached AI analyses do not expire. They are kept for as long as your account is, and are deleted with it. *(This previously said they expired after 30 days. That expiry was removed in September 2026 because regenerating a chapter produces different prose — so an expiry could never restore what you had, only replace it. Nothing was ever deleted by it.)*
• Email records (email_send_log, lifecycle_email_log) are kept as a record of what we sent. When you delete your account your email address is removed from them and the rows are unlinked from you; the remaining row says only that a message of a certain kind was sent on a certain day.
• Error diagnostics, if enabled, are deleted 90 days after they are resolved. Anything still unresolved is kept, because an unfixed fault is the one worth keeping.
• Your unsubscribe, if you make one, is kept indefinitely. It must outlive the account, or the same address signing up again would start receiving messages it had already refused.

9. Data about other people (partner profiles)

The Couple Compatibility feature lets you add another person as a "partner profile." That person is a separate data subject with their own privacy rights, even though they don't have a Numera account.

By adding someone, you confirm you have a legitimate reason to enter their birth information and that you will honour their wishes if they ask you to remove it. Numera stores this data only to provide the reading you requested, never contacts the person, and never makes their profile visible to anyone but you.

You can delete a partner and everything tied to them at any time, from the partner detail screen — see Section 13. If a person whose data you entered contacts us directly and asks for removal, we may need to coordinate with you to identify and erase the relevant records, and we will act on a valid request.

10. How we protect your data

• All app data is stored with row-level security: every database query is automatically scoped to the requesting user, so one user cannot read another user's data even in the event of a bug.
• The Anthropic API key and all AI prompt logic live server-side, never on your device.
• Data is transmitted over encrypted connections (HTTPS/TLS) and stored by our hosting provider with encryption at rest.
• No security measure is perfect; we cannot guarantee absolute security, but we work to protect your data using industry-standard practices.

11. Your rights

Under GDPR and Israeli privacy law you have the following rights. To exercise any of them, use the in-app controls below where available, or contact [email protected].

• Access — get a copy of the data we hold about you.
• Rectification — correct inaccurate or incomplete data. Most fields can be edited directly in the app.
• Erasure — delete your data ("right to be forgotten").
• Portability — receive your data in a machine-readable format.
• Restriction — ask us to limit how we process your data while a query is resolved.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — where processing relies on consent, withdraw it at any time (this does not affect processing already carried out).
• Lodge a complaint — you may complain to a supervisory authority. In Israel this is the Privacy Protection Authority (PPA) — https://www.gov.il/en/departments/the_privacy_protection_authority ; in the UK it is the Information Commissioner's Office (ICO) — https://ico.org.uk ; in the EU it is your local data-protection authority (the full list is published by the European Data Protection Board — https://edpb.europa.eu/about-edpb/about-edpb/members_en ).

We respond to rights requests within 30 days (GDPR Article 12).

Right to access (download your data)

Settings → Privacy & Data → Download my data.

Produces a JSON file containing every record listed in Section 3 — including the notes and assessment our team may have recorded about your account, because a subject access request covers opinions held about you as well as facts.

The download is a one-shot operation; we don't store the export.

Right to erasure (delete everything)

Settings → Privacy & Data → Delete all my data.

Requires you to re-enter your password (a defence against an unattended device wiping your account). After confirmation:

1. Anything that identifies you in records we keep for other reasons is removed first: your email address is erased from the email logs, and the cost and diagnostic rows are unlinked from you. What remains says only that a message of a certain kind was sent, or that an AI call of a certain size was made, on a certain day — with nothing tying it to a person.
2. Your uploaded logo, if you have one, is deleted from file storage.
3. Your account record is deleted, which automatically cascades to every table listed in Section 3.
4. You are signed out and returned to the welcome screen.
5. An audit row is written recording that the deletion took place (your user ID, your email at the time, the timestamp, and the per-table row counts that were removed).

If step 1 fails, the deletion stops and your account is left intact rather than half-removed. A partly deleted account is worse than one that is still there, because it looks finished.

Two things deliberately survive, and only two:

• The audit row in step 5. It is the only evidence your request was honoured, and it is purged on its own 30-day schedule (Section 14).
• Your unsubscribe, if you made one. Deleting it would mean the same address signing up again started receiving messages it had already refused.

Deletion is otherwise permanent and irreversible. We cannot recover deleted accounts.

Right to data portability

The downloaded JSON is machine-readable and structured per-table, so you can import the relevant pieces into any other system you choose.

12. Platform privacy disclosures (Apple App Store & Google Play)

Numera is distributed through the Apple App Store and Google Play, and we comply with their privacy requirements in addition to the law.

Where to find this policy. This policy is available inside the app (Settings → Legal → Privacy Policy) and at a public URL: https://numera-privacy.evalix.io/privacy. Both stores require a publicly reachable privacy-policy link in the store listing.

Account and data deletion. Both Apple and Google require that any app offering account creation also lets you delete your account and data.

• *In-app:* Settings → Privacy & Data → Delete all my data (Section 11).
• *Without the app (required by Google Play):* you can request deletion at any time by emailing [email protected] with subject [GDPR], or via the web page at https://numera-privacy.evalix.io/delete. We honour external requests the same way as in-app deletion.

Tracking (Apple App Tracking Transparency). Numera does not track you across other companies' apps or websites. We do not use the advertising identifier (IDFA), and we do not show the App Tracking Transparency prompt because there is nothing to track. We do not use third-party advertising SDKs.

Apple "App Privacy" / Google "Data safety" summary. To help you read the store labels (these must match exactly what we declare in App Store Connect and the Play Console Data safety form — all three are kept in sync):

• Data we collect and link to you: contact info (email), your charts and birth data, your relationship questions and insights, purchase history, and limited usage data (the deep-dive call logs and quota counters in Section 3). No third-party analytics or crash-reporting SDK is integrated in the app, so we do not collect diagnostic or device-telemetry data through one. *(Verified 2026-06-11 by dependency audit — see PRIVACY_COMPLIANCE_AUDIT.md. Re-confirm if such an SDK is ever added.)*
• Error reporting (first-party, no SDK). We record our own faults so they can be fixed. There are two sources, both ours, both linked to your account, and both declared as Diagnostics → Crash Data, linked to you:
• *From the app:* the error message, the stack trace, the app version and the platform. Switched on 1 October 2026, with this policy and the store labels updated first, as promised in the previous version of this section.
• *From our servers:* when generating a report fails, which step failed and why, and which report it belongs to. No device or app data is in these — there is no device involved.

Neither records normal refusals. A wrong password, an expired session or a usage limit reached are the app working as designed, and are filtered out before anything is written. Email addresses and access tokens are stripped from what is sent. These rows are kept for 90 days after a fault is resolved (Section 7), and are unlinked from you if you ask us to delete your data (Section 11).

• Data used to track you across other apps/sites: none.
• Data shared for advertising: none.
• Data is encrypted in transit, and you can request its deletion.

Sign-in providers. You currently sign in with an email address and password. (Sign in with Apple and Google Sign-In are planned for a future release; when they launch, this policy will be updated to cover them — including Apple's private-relay email option — and their use will also be governed by Apple's and Google's own privacy policies.)

Purchases. Subscriptions are processed by Apple and Google (via RevenueCat). Payment and receipt data is handled under Apple's and Google's privacy policies; we receive only a subscription identifier and entitlement status, never your full payment-card details.

Device permissions. Numera requests no special device permissions.

• Photo library — only if you add a practice logo. Practitioners can put a logo on their reports, and choosing one opens your photo library. Nothing is read until you pick a file, and nothing else in your library is accessed. The file you pick is uploaded to our storage and its address is saved against your account, because the cover and footer of every PDF you generate have to be able to load it. That storage location is publicly readable — anyone who has the address can open the image — so do not use a logo you would not be willing to publish. You can remove it at any time, and deleting your data deletes it (Section 11).
• We do not request device location, contacts, camera, microphone, or health data. Birth place is typed in by you as a city name, not read from your device.
• *Notifications:* the current version does not request the notification permission. If optional monthly-forecast reminders are added in a future release, we will request that permission then and update this policy.

13. Per-partner data deletion

When the Couple Compatibility feature is enabled, you can add another person as a "partner profile" for a compatibility reading. That partner is a separate data subject. From the partner detail screen you can "Delete this person and all related data" — which removes their profile and every compatibility analysis or insight you generated about them, without touching anything else on your account.

This is for situations where:

• You broke up and want to remove their data
• They asked you to remove it
• You added them by mistake

14. Audit log retention

We keep one row per delete-or-export request for 30 days, after which the audit row itself is automatically purged. The audit row records the action (delete / export), timestamp, your user ID at the time, your email, and a per-table row-count summary — never the content of the data that was deleted.

Why we keep it: if a user disputes that a deletion took place ("you said you deleted my data, did you really?"), the audit row is the evidence. After 30 days the dispute window closes and we no longer need it.

15. Changes to this policy

We may update this policy as Numera evolves (for example when a new feature changes what data we process). When we make a material change, we will update the "last updated" date and notify you in-app before the change takes effect. Continued use of Numera after an update means you accept the revised policy.

16. Contact

For data-related questions or to invoke a right you can't access in-app:

• Email: [email protected]
• Subject line: [GDPR] or [ISR-PRIVACY] so it's routed correctly

We respond within 30 days, per GDPR Article 12.

Provenance of this document

This draft is mirrored in the Numera codebase at PRIVACY.md and surfaced in-app at Settings → Legal → Privacy Policy, and at the public URL in Section 12. The in-app version is the user-facing source of truth; this file is the engineering copy used to keep them in sync.

Last technical change: GDPR + app-store policy expansion (2026-06-11) — added data-controller identity, legal bases, sub-processor and international-transfer disclosures, special-category/wellbeing handling, the full set of data-subject rights, retention, security, children, and change-notification sections; added Section 12 covering Apple App Store and Google Play requirements (public policy URL, in-app and external deletion routes, App Tracking Transparency, App Privacy / Data safety summary, sign-in providers, purchases, device permissions); aligned the data table with the relationship features; corrected the contact email to [email protected].

Last technical change: 27 September 2026 — audited against everything built that day and corrected. Added the email records, the AI cost ledger, the work queues, the operator notes and the fault reporter to Section 3; disclosed the email delivery provider as a processor in Section 6, which had been missing since email began; described the getting-started sequence and its unsubscribe in Section 5; rewrote the erasure steps in Section 11 to say what is anonymised rather than deleted, and what deliberately survives; declared the first-party fault reporter in Section 12 as switched off pending this disclosure.

Last technical change: 1 October 2026 — the first-party fault reporter was switched on, which is what the 27 September entry said this disclosure had to precede. Section 12 now declares it as live rather than pending, and Section 3's data table describes what it actually stores.

A second source was disclosed at the same time: our own servers now record when generating a report fails — which step failed, why, and which report it belongs to, linked to the account it was generated for. This existed as nothing but a console line until 1 October; before that a failed chapter left no durable record anywhere, which is why a report could stop part-way with nothing to show for it. It contains no device or app data, because no device is involved.

Both are first-party and go to our own servers. No analytics or crash-reporting SDK has been added, so the statement that we integrate none remains true.

Two statements were corrected rather than extended, because they had stopped being true:

• *"Cached AI analyses expire automatically after 30 days."* The expiry was

removed on 24 September 2026 — regenerating a chapter produces different prose, so an expiry could only ever replace what you had, never restore it. Nothing was ever deleted by it, so no behaviour changed; only this sentence was wrong.

• *"Your account record is deleted, which automatically cascades to every

table."* Four tables added in September had no such link, and two of them held the email address. They are now cleared before the account is removed, and a test fails if a future table is added without deciding what happens to it.