Octulpit

Privacy Policy

Updated 5 November 2026

English is the primary version. Thai and Traditional Chinese translations are provided for convenience. Applicable mandatory rights are unaffected.

1. Who controls your information

Data controller: [operator / legal entity name]

Contact address: [registered address]

Privacy enquiries: contact@octulpit.com

The service operates from Thailand and is subject to Thailand's Personal Data Protection Act (PDPA). GDPR protections also apply where applicable to users in the European Union or United Kingdom.

2. Information we collect

We collect information needed to operate the service. We do not purchase additional information about you or track you across websites.

Birth date, birth time and birthplace for you and people whose profiles you create.

Profile names you choose, such as a nickname, a family relationship or a real name.

Questions submitted to AI, generated answers and the chat rooms containing those conversations.

Tarot cards drawn and calculated charts.

Email address and a password hash, or a Google account identifier when you sign in with Google.

Credit balance, debit/refund history, your plan and order history. We do not store full payment card numbers.

Necessary technical information: IP addresses are used for rate limiting with temporary counters lasting about two minutes. Authentication sessions may also contain IP addresses and user-agent information.

Administrative actions affecting your account, such as plan or credit adjustments, for auditing.

3. Sensitive information

Questions may reveal health, religious beliefs or intimate matters. Some of this information receives additional legal protection.

We do not request sensitive information, and it is not required to calculate a chart.

Our existing sensitive-information workflow concerns information voluntarily included in a question and processing needed to answer it; applicable explicit-consent requirements still apply.

You may contact us to withdraw consent or request removal of the relevant information; deleting a chat room removes the conversation from that room.

Avoid entering diagnoses, other people's names, national identity numbers or financial details. They do not make a reading more accurate.

4. Legal bases for processing

The applicable bases include PDPA section 24 and GDPR Article 6, depending on the processing activity.

Contract: operating your account, calculating charts, generating readings, managing credits and providing history.

Consent where required: sensitive information and non-transactional emails, if offered.

Legitimate interests: preventing abuse, rate limiting and protecting the service.

Legal obligations: retaining accounting and tax records required under applicable Thai law.

5. Information sent to AI providers

When you request an AI explanation, we send the question and the relevant chart information, such as planetary positions, houses or tarot cards.

We apply filters intended to remove profile names, email addresses, telephone numbers and long numbers resembling identity or payment card numbers before transmission. Do not include unnecessary identifying information in a question.

The primary processor is OpenRouter in the United States, which routes requests to model providers including OpenAI.

OpenAI in the United States is also used as a fallback when OpenRouter is unavailable.

Requests are sent by our server rather than directly by your browser; AI providers receive the server request rather than your browser's direct connection.

We do not use your information to train or fine-tune our own models. Provider handling is subject to the applicable API terms and settings.

AI readings provide entertainment and perspectives for reflection. They are not medical, legal, investment or mental-health advice, and we do not use them to make automated decisions with legal effects on you.

6. External service providers

Cloudflare: website hosting, databases and security services, including Turnstile where enabled.

Google: when you choose Google sign-in.

Font delivery follows the resources loaded by the website; third-party requests, if enabled, disclose connection information to their providers.

When configured and enabled, Google Workspace through the Gmail API delivers transactional account emails, including verification and password-reset codes, from our Workspace mailbox. Google processes recipient addresses and message content to deliver these emails.

Payment providers: process payments through the payment service enabled for the transaction. We retain transaction references, amounts and statuses rather than full card numbers. Payment integration and provider availability depend on the deployed environment.

When you search for a place, the browser sends the search text to the Open-Meteo Geocoding API to find coordinates. When you open a map, the browser requests map tiles from OpenStreetMap. These providers receive connection information and the search text or map area needed for the request.

7. International transfers

AI, email and infrastructure providers may process information outside Thailand and the European Union, including in the United States.

Transfers must use the safeguards required by applicable law, including appropriate contractual safeguards where required under GDPR Article 46 and PDPA section 28.

Production connections use TLS. Encryption is a security measure, not by itself a legal basis for an international transfer.

Contact us for information about the safeguards applicable to your information.

8. Retention

Chat rooms for accounts that have never paid are subject to automatic cleanup after more than seven days of inactivity.

Changing or cancelling a paid plan does not itself delete previously paid-for conversations; other retention rules still apply.

Chat rooms may be removed after more than twelve months of account inactivity when no active plan remains.

Profiles, charts and readings follow the service's retention lifecycle. Closing an account does not erase all this information.

Account closure revokes all sessions, removes passwords and Google links, and removes email, display name and Google identifiers from the application identity. Historical content and financial records remain and are not fully anonymised.

Guest information is stored in the browser unless it is imported or synchronised after sign-in. Clearing browser data removes the browser copy.

Sales and accounting records remain for the legally applicable retention period, including after account closure.

Administrative audit records are retained for accountability and are not removed automatically on account closure.

9. Your rights and how to exercise them

Applicable rights under the PDPA and GDPR may include:

Accessing and obtaining a copy of your information.

Correcting inaccurate information.

Requesting erasure of personal information and account closure.

Restricting processing.

Receiving information in a machine-readable form where portability rights apply.

Objecting to processing based on legitimate interests.

Withdrawing consent for consent-based processing.

You can remove profiles, readings and individual chat rooms from your profile. The Delete account action in Manage account requires your email, CLOSE and current-password verification or a recent sign-in. Cancel recurring subscriptions first. Closure ends access to existing credits, entitlements and content; a new signup does not automatically inherit them. Browser copies on the device performing closure are cleared. Closure is not a refund request. For copies or erasure of retained personal information, email contact@octulpit.com. We verify identity and assess applicable rights and exceptions, including accounting, payments and disputes, and communicate the outcome and reasons.

10. Cookies and browser storage

Session cookies with the octulpit. prefix maintain sign-in. Sessions are configured for 90 days and may be renewed.

localStorage and sessionStorage hold chart copies, preferences and entitlement caches. Some information is imported or synchronised with your account after sign-in.

We have not installed advertising cookies, cross-site tracking or third-party analytics in the application code. See the separate Cookies Policy for details.

11. Security

Passwords are stored as PBKDF2 hashes, not readable passwords.

Production connections use TLS; local development may use HTTP.

Access to account information is scoped to the authenticated user.

Administrative access is restricted by allowlists and recorded for auditing.

If a personal-data breach occurs, we assess and carry out applicable regulator and individual notification duties, including the 72-hour regulator deadline where it applies.

12. Children and young people

The service's stated audience is adults aged 20 or over, or users aged 16 or over in the European Union, subject to applicable legal capacity and consent requirements.

Minors must obtain the necessary permission from a parent or legal guardian before using the service.

If we learn that a minor's information was collected without the required permission, we will address and remove it as appropriate.

13. Changes to this policy

This language edition was updated on 5 November 2026.

We will provide appropriate notice before material changes, such as adding a new category of processor, take effect.

14. Contact and complaints

Privacy enquiries: contact@octulpit.com.

EU representative, if required under GDPR Article 27: [representative details to be provided where applicable].

You may complain to Thailand's Personal Data Protection Committee if you are dissatisfied with our handling of your information.

Where applicable, EU users may also complain to the data-protection authority in their country of residence.

ตั้งค่าคุกกี้

จัดการคุกกี้และดูว่าข้อมูลประเภทใดถูกใช้ในเว็บไซต์นี้

คุกกี้ที่จำเป็น

ใช้รักษาการเข้าสู่ระบบและความปลอดภัยของบัญชี จำเป็นต่อการทำงานของบริการ

เปิดตลอด

วิเคราะห์การใช้งาน

ขณะนี้ Octulpit ไม่ได้ติดตั้งคุกกี้วิเคราะห์การใช้งาน

ไม่ได้ใช้งาน

โฆษณาและการตลาด

ขณะนี้ Octulpit ไม่ได้ติดตั้งคุกกี้โฆษณาหรือการตลาด

ไม่ได้ใช้งาน

เว็บไซต์ยังใช้ localStorage หรือ sessionStorage สำหรับการตั้งค่าและข้อมูลที่บันทึกในเบราว์เซอร์บางอย่าง ซึ่งไม่ใช่คุกกี้ ดูรายละเอียดได้ในนโยบายคุกกี้

อ่านนโยบายคุกกี้