Legal

Privacy Policy

Last updated: June 2026 · Governed by the laws of Ontario, Canada

1. Accountability and Privacy Officer

Satya Jyoti is responsible for all personal information under its custody or control, including personal information that has been transferred to a third-party service provider for processing. We have formally designated a Privacy Officer who holds the highest level of accountability for privacy governance within our organization, as required under PIPEDA Principle 1 (Accountability) and section 3.1 of Quebec's Act respecting the protection of personal information in the private sector (the "Quebec Act"), as amended by Law 25. The Privacy Officer is responsible for: overseeing compliance with all applicable Canadian privacy legislation; reviewing and updating this Privacy Policy; managing privacy impact assessments; handling access, correction, portability, de-indexing, and erasure requests; managing privacy incident response; and serving as the designated point of contact for regulatory authorities, including the Office of the Privacy Commissioner of Canada (OPC) and the Commission d'accès à l'information du Québec (CAI). Privacy Officer Contact: Satya Jyoti — Privacy Officer Email: support@satyajyoti.com We maintain a written internal privacy governance framework, including a privacy incident log, as required by applicable law.

2. What Personal Information We Collect

We collect only the personal information that is strictly necessary to provide our Services, in accordance with the principle of data minimization under PIPEDA and sections 5 and 8 of the Quebec Act. This includes: (a) Identity and contact information: your full name and email address; (b) Astrological data: your date of birth, time of birth, and place of birth. We treat this information as sensitive personal information, as it is closely connected to your personal identity and, in the context of spiritual consultation, warrants a heightened degree of protection under section 12 of the Quebec Act and equivalent PIPEDA principles. Accordingly, we obtain your express (not implied) consent prior to collecting this information, and we use it exclusively for the purpose of preparing your Vedic birth chart and associated reading; (c) Consultation content: any information you voluntarily provide in booking forms or during an optional live consultation call; (d) Payment transaction records: limited transactional data (booking reference, amount, and date of transaction) retained solely for accounting and legal compliance purposes. We do not collect or store full payment card details — all payment processing is handled by Stripe, Inc.; (e) Technical and usage data: IP address, browser type, operating system, and access timestamps collected automatically through standard web server logs for security and operational purposes only. This data is not used to identify you personally. We do not knowingly collect personal information from individuals under the age of eighteen (18). Where our Services are accessed by a resident of Quebec who is under the age of fourteen (14), we require verifiable consent from a parent or legal guardian prior to any collection, consistent with section 4.1 of the Quebec Act. Individuals aged fourteen (14) through seventeen (17) who are Quebec residents may provide their own consent, in accordance with section 4.1 of the Quebec Act. If we become aware that we have collected information from a minor without the required consent, we will delete such information without delay.

3. Purposes of Collection, Use, and Disclosure

We collect and use your personal information solely for the following specific, explicit, and legitimate purposes, as required under PIPEDA and section 4 of the Quebec Act. Consent is sought separately for each purpose and is not bundled with consent for other purposes: (a) To prepare and deliver your Vedic chart reading and any associated consultation materials — this is the primary and essential purpose for which birth data and identity information are collected; (b) To communicate with you about your booking, your reading status, scheduling, and any follow-up directly related to the Services; (c) To process payment transactions and maintain accounting records as required by applicable federal and provincial law; (d) To improve the quality of our Services on an anonymized and aggregated basis, where the resulting information can no longer be used to identify any individual, in accordance with the anonymization standard under section 23 of the Quebec Act; (e) To comply with applicable legal obligations, including responding to lawful demands from courts of competent jurisdiction or regulatory authorities; (f) To protect the rights, property, and safety of the Company, our clients, and the public. We will not use your personal information for any purpose beyond those listed above without obtaining your prior, express, and informed consent, secured separately for each new purpose. We will not use your information for targeted advertising, online behavioural profiling, automated decision-making, or sale to third parties under any circumstances.

4. Consent — Requirements and Withdrawal

Under PIPEDA, the Company obtains consent that is appropriate to the sensitivity of the personal information collected. Under the Quebec Act, as amended by Law 25 (in force September 22, 2023), all consent must be manifest, free, enlightened, and given for specific purposes (section 9 of the Quebec Act). Consent cannot be validly bundled with the acceptance of general terms and conditions. For ordinary personal information (name, email): consent is obtained through your affirmative act of submitting a booking form, which clearly discloses the purposes of collection at the point of submission. For sensitive personal information (birth date, time, and place): we obtain your express consent through a separate, clear, and unambiguous affirmative action prior to or at the time of collection. We do not rely on implied consent for the collection of sensitive personal information. You may withdraw your consent to the collection, use, or disclosure of your personal information for non-essential or secondary purposes at any time by submitting a written request to support@satyajyoti.com. We will acknowledge your request within five (5) business days and give effect to your withdrawal within a reasonable time thereafter. Please note that withdrawal of consent with respect to essential purposes may result in our inability to continue delivering the Services for which you have contracted. Withdrawal of consent does not affect the lawfulness of collection, use, or disclosure that occurred prior to withdrawal, nor does it affect our right to retain information for legal compliance purposes. For Quebec residents: your right to withdraw consent is expressly recognized under section 9 of the Quebec Act. Withdrawal shall not result in any penalty, reprisal, or refusal of a benefit, other than consequences directly and necessarily arising from the inability to deliver a Service that requires the personal information in question.

5. Privacy by Design and Data Minimization

Consistent with section 3.2 of the Quebec Act (in force September 22, 2022), Satya Jyoti adopts a privacy-by-design approach to all projects, systems, and processes that involve personal information. This means that privacy protections are embedded into the design of our services and information practices from inception, rather than applied as an afterthought. We collect personal information by fair and lawful means and limit collection strictly to what is necessary to fulfil the purposes identified in Section 3 above. We do not collect personal information indiscriminately, speculatively, or beyond what is directly required to fulfil our stated service obligations. When personal information is no longer required for the purpose for which it was collected, and when no legal obligation requires its further retention, we permanently and securely destroy or anonymize it. Anonymization is carried out in accordance with the standard established under section 23 of the Quebec Act, which requires that information be anonymized using generally accepted best practices such that the identity of an individual cannot reasonably be inferred from the resulting data, directly or indirectly, alone or in combination with other available information.

6. Privacy Impact Assessments (PIA / EFVP)

Pursuant to section 3.3 of the Quebec Act (in force September 22, 2022), Satya Jyoti conducts Privacy Impact Assessments (PIAs — or Évaluations des facteurs relatifs à la vie privée, EFVPs, for Quebec purposes) before acquiring, developing, overhauling, or using any information system, electronic service delivery system, or technology product that involves the collection, use, or communication of personal information. PIAs have been conducted with respect to, among other things: (a) Our booking and client management platform; (b) Our engagement with Stripe, Inc. as a third-party payment processor; and (c) Our use of web server infrastructure and session storage technology. PIA documentation is maintained internally and is available for review by the Commission d'accès à l'information du Québec (CAI) upon request. The results of our PIAs inform our security safeguards and the contractual protections we require from third-party service providers.

7. How We Store and Protect Your Information

We implement reasonable and appropriate physical, organizational, and technical security safeguards calibrated to the sensitivity of the personal information held, consistent with PIPEDA Principle 7 (Safeguards) and section 10 of the Quebec Act. These safeguards include, without limitation: strict access controls limiting data access to the practitioner directly responsible for your reading; encrypted data transmission using industry-standard TLS/SSL protocols; and secure hosting infrastructure with access logging. Astrological data, consultation notes, and all associated personal information are retained for a maximum period of two (2) years from the date of last service delivery. Upon expiry of this retention period, such information is permanently and securely destroyed or anonymized using generally accepted best practices in accordance with section 23 of the Quebec Act. Transactional records may be retained for a longer period where required by applicable federal or provincial tax and accounting legislation. We do not use your personal information for any secondary purpose following the conclusion of the Services for which it was collected. Notwithstanding the above safeguards, no method of electronic storage or transmission is completely secure. While we make every commercially reasonable effort to protect your personal information, we cannot guarantee absolute security and, to the extent permitted by applicable law, disclaim liability for unauthorized access to or use of personal information resulting from circumstances beyond our reasonable control.

8. Disclosure and Third-Party Sharing

We do not sell, rent, trade, license, or otherwise transfer your personal information to any third party for commercial purposes, under any circumstances. Your personal information may be disclosed to third parties only in the following strictly limited circumstances: (a) Payment processing: to Stripe, Inc. (a corporation headquartered in the United States of America), solely to the extent necessary to process your payment transaction. Prior to engaging Stripe, we conducted a Privacy Impact Assessment pursuant to section 3.3 of the Quebec Act and have entered into a data processing agreement with Stripe that contains contractual provisions ensuring a level of protection for your personal information equivalent to that required under the Quebec Act, as required by section 17 of the Quebec Act. Quebec residents are hereby expressly notified that personal information transmitted to Stripe is communicated outside the province of Quebec and outside Canada; (b) Legal compliance: where required by applicable Canadian or provincial law, pursuant to a lawful order of a court of competent jurisdiction, or pursuant to a lawful demand from a regulatory authority with jurisdiction over us, including the CAI or the OPC; (c) Business protection: where strictly necessary to investigate, prevent, detect, or address fraud, security breaches, or violations of our Terms of Service, to the extent permitted by applicable law; (d) Professional advisors: to our legal counsel, accountants, auditors, or other professional advisors who are bound by professional or contractual obligations of confidentiality, and only to the extent necessary for the operation of our business and for legal compliance; (e) Website analytics: to Google LLC (a corporation headquartered in the United States of America), solely where you have consented to the use of Google Analytics cookies as described in Section 10, and solely to the extent necessary to provide us with aggregate website usage analytics. Quebec residents are hereby expressly notified that this information is communicated outside the province of Quebec and outside Canada. We do not transfer personal information to any jurisdiction outside of Canada, other than to Stripe as disclosed in paragraph (a) above, without first conducting a Privacy Impact Assessment and ensuring that the receiving jurisdiction or receiving party provides a level of protection for personal information equivalent to that required under applicable Canadian privacy law, as required by section 17 of the Quebec Act and equivalent PIPEDA requirements.

9. Your Rights Under Canadian and Quebec Privacy Law

Subject to applicable law and any overriding legal obligations, you have the following rights with respect to the personal information we hold about you. Quebec residents hold all rights enumerated below as statutory rights under the Quebec Act; residents of other provinces hold corresponding rights under PIPEDA and applicable provincial legislation. (a) Right of access (PIPEDA Principle 9; Quebec Act s. 27): to request access to the personal information we hold about you, information about the purposes for which it has been used, and information about any third parties to whom it has been disclosed; (b) Right to correction (PIPEDA Principle 9; Quebec Act s. 28): to request that we correct any inaccuracy in your personal information; (c) Right to withdraw consent (PIPEDA Principle 3; Quebec Act s. 9): to withdraw consent to collection, use, or disclosure for non-essential or secondary purposes, subject to legal and contractual restrictions as described in Section 4; (d) Right to erasure / destruction (Quebec Act s. 28; PIPEDA equivalent): to request that we destroy or anonymize your personal information where: (i) the purpose for which it was collected has been accomplished; (ii) you have withdrawn consent and no legal basis for continued retention exists; or (iii) the information was collected from you when you were a minor (for Quebec residents). We will comply with a valid erasure request within a reasonable time and will confirm completion in writing; (e) Right to de-indexing (Quebec Act s. 28.1, in force September 22, 2023 — Quebec residents only): where personal information about you has been disseminated by technological means that make it accessible to the public, you have the right to request the de-indexing of any hyperlink attached to your name that gives access to information: (i) if its dissemination causes serious injury to you; or (ii) if it was collected when you were a minor. You also have the right to request the re-indexing of information that was de-indexed as a result of an error or misrepresentation. We do not currently operate any publicly accessible index of client personal information, and accordingly this right is unlikely to be exercisable in respect of our Services. However, we will process any de-indexing request in good faith; (f) Right to data portability (Quebec Act s. 28, in force September 22, 2023 — Quebec residents only): to receive a copy of the personal information you have provided to us in a structured, commonly used, and machine-readable technological format, and to request that we communicate this information directly to any person or body authorized by law to collect such information, where it is technically feasible to do so. This right applies to personal information collected by automated means; (g) Right regarding automated decisions (Quebec Act s. 12.1 — Quebec residents only): to be informed when a decision based exclusively on automated processing of your personal information is used to produce effects of consequence to you, including being informed of the personal information used and the parameters used in reaching such a decision, and to request that a human being review the decision. We wish to confirm expressly that Satya Jyoti does not employ automated decision-making systems in the delivery of our Services. All readings and consultations are produced exclusively by human practitioners; (h) Right to complain: to lodge a complaint with the applicable regulatory authority if you believe that your privacy rights have been violated. For federal matters and residents of provinces other than Quebec: Office of the Privacy Commissioner of Canada (OPC), 1-800-282-1376, www.priv.gc.ca. For Quebec residents: Commission d'accès à l'information du Québec (CAI), 1-888-528-7741, www.cai.gouv.qc.ca. To exercise any of the above rights, please submit a written request to support@satyajyoti.com. We will acknowledge your request within five (5) business days. Under PIPEDA, we will respond substantively within thirty (30) days of receipt of the request, with a potential extension of thirty (30) additional days with prior written notice in cases of exceptional complexity. Under the Quebec Act, we will respond within thirty (30) days of receipt, with a potential extension of ten (10) days in certain circumstances, with prior written notice.

10. Cookies, Session Storage, and Tracking Technologies

Our website uses browser session storage to preserve your booking journey progress across pages during your session. This data is stored locally on your device and is not transmitted to our servers, is not accessible to us, and is automatically cleared when you close your browser session. With your consent, we use Google Analytics (GA4), a web analytics service provided by Google LLC, to understand how visitors use our website (for example, which pages are viewed and how visitors navigate the site). Google Analytics sets first-party cookies on your device to distinguish unique visitors and sessions. We do not use advertising pixels, fingerprinting technologies, cross-site tracking technologies, or online behavioural advertising, and Google Analytics data is not used to identify you personally. On your first visit, we present a cookie consent banner allowing you to accept or decline the use of Google Analytics cookies. Google Analytics is not loaded, and no analytics cookies are set, until you affirmatively accept. Your choice is recorded in your browser's local storage on your device. You may withdraw consent at any time by clearing your browser's local storage and cookies for this site, which will cause the consent banner to reappear on your next visit. Standard web server logs may record your IP address, browser type, referring URL, and access timestamps for security monitoring and operational purposes only. These logs are retained for no longer than ninety (90) days and are not used to identify you personally. Under section 9 of the Quebec Act, IP addresses are treated as personal information when they can be used to identify an individual, and are handled accordingly. Should we introduce any additional cookies or tracking technologies in the future, we will update this Policy and, where required by applicable law, obtain your consent prior to deployment.

11. Privacy Incident Response and Breach Notification

We maintain a written privacy incident log, as required by section 3.5 of the Quebec Act (in force September 22, 2022) and the Breach of Security Safeguards Regulations (SOR/2018-64) under PIPEDA. The incident log records all privacy incidents, whether or not they present a risk of harm to individuals, and is maintained for a minimum period of five (5) years. In the event of a privacy incident (unauthorized access, use, disclosure, copying, modification, or loss of personal information): (a) Under PIPEDA: if the incident poses a "real risk of significant harm" to affected individuals (as assessed using the factors set out in SOR/2018-64), we will notify the Office of the Privacy Commissioner of Canada (OPC) and all affected individuals as soon as feasible; (b) Under the Quebec Act (s. 3.6 and 3.7, in force September 22, 2022): if the incident presents a risk of serious injury to one or more affected individuals, we will notify the Commission d'accès à l'information du Québec (CAI) and all affected individuals without delay. We will provide the CAI with a completed Confidentiality Incident Notice in the prescribed form. We will also notify any third party that communicated the personal information to us, if applicable. Notification to affected individuals will be provided after notification to the CAI unless the CAI directs otherwise. Notifications will include, at minimum: a description of the incident; the date or approximate period of the incident; a description of the personal information concerned; reasonable measures we have taken or intend to take to reduce the risk of harm; and the contact information of the Privacy Officer. All notifications will be made in plain language.

12. Cross-Border and Inter-Provincial Transfers

Where personal information is communicated outside the province of Quebec or outside Canada, the requirements of section 17 of the Quebec Act (in force September 22, 2023) apply to Quebec residents' personal information. Specifically, before communicating personal information outside Quebec, we: (a) Conduct a Privacy Impact Assessment (EFVP) to assess the adequacy of the privacy protections in the receiving jurisdiction or provided by the receiving organization; (b) Ensure that a written agreement is in place with the recipient that requires the recipient to provide a level of protection for the personal information equivalent to that required under the Quebec Act; and (c) Take the legal framework of the receiving jurisdiction into account in our assessment. The only cross-border communication of personal information that currently occurs in connection with our Services is the transmission of limited transactional data to Stripe, Inc. in the United States for payment processing purposes, as described in Section 8 above. We have completed the required EFVP and have entered into a written data processing agreement with Stripe. We will not communicate your personal information to any additional foreign third parties without first satisfying all applicable requirements of section 17 of the Quebec Act.

13. Links to Third-Party Websites

Our website may contain links to third-party websites. This Privacy Policy applies only to the Satya Jyoti website and Services. We are not responsible for the privacy practices, security, or content of any third-party website and encourage you to review the privacy policies of any external website you visit. The inclusion of a link to a third-party website does not constitute an endorsement or recommendation by the Company.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable legal requirements, or service offerings. Any changes will be posted on this page with an updated effective date at the top of the Policy. Where required by applicable law — including where a change involves a new purpose for the use of personal information or the introduction of a new category of collection — we will provide prior notice and, where required, obtain fresh consent before the change takes effect. For Quebec residents: material changes to this Policy will be communicated in advance in a clear and simple manner, as required by section 3.8 of the Quebec Act. Your continued use of the Services following the posting of a non-material change constitutes your acceptance of the updated Policy. For material changes requiring fresh consent, continued use of the Services following consent will constitute acceptance.

15. Contact and Regulatory Authorities

For all privacy-related inquiries, requests to exercise your rights, complaints, or concerns regarding this Policy or our privacy practices, please contact our Privacy Officer: Satya Jyoti — Privacy Officer Email: support@satyajyoti.com We are committed to addressing all privacy concerns promptly, fairly, and in accordance with applicable law. We will acknowledge all written requests within five (5) business days. If you are not satisfied with our response, or if you wish to report a privacy concern directly to a regulatory authority, you may contact: Office of the Privacy Commissioner of Canada (OPC): 30 Victoria Street, Gatineau, Québec K1A 1H3 Toll-free: 1-800-282-1376 | www.priv.gc.ca Commission d'accès à l'information du Québec (CAI) — for Quebec residents: 525, boul. René-Lévesque Est, Bureau 2.36, Québec (Québec) G1R 5Y4 Toll-free: 1-888-528-7741 | www.cai.gouv.qc.ca