Introduction

We respect your privacy and are committed to protecting your personal data. This Privacy Policy ('Policy') describes how we collect, process, and protect your information and personal data, the security measures we have implemented, and your rights concerning your data.

This Policy applies to the Xpastro app, website, and social media platforms owned by Xpastro (collectively referred to as 'Xpastro,' 'Services,' or 'App').

Your access to and use of Xpastro are governed by this Privacy Policy and our Terms of Use ('Terms'). The Terms apply to definitions used in this Policy and to provisions not explicitly covered herein. We recommend that you review the Terms of Use to understand the definitions, functions, and features of Xpastro.

By accessing or using Xpastro, you agree to the collection and use of your information and personal data in accordance with this Policy. You also confirm that you have reviewed and understood how your information and personal data are processed, including your legal rights. If you do not agree with the Terms or this Privacy Policy, please do not use the Website and/or Services offered by Xpastro.

Collection of Information and Processing Purposes

We may collect the following information and personal data when you access Xpastro or otherwise use the Website and/or Services:

1. Personal and Contact Information

• Google Account or Apple ID (depending on your download method), Gender, Date of Birth, Place of Birth.

This information is used to create your Xpastro profile, determine your horoscope, provide personalized fortune-telling services, and communicate with you regarding updates or your requests. Processing is necessary for the performance of our contract and the delivery of Xpastro services.

2. Technical Data

• IP address, logs, device type and name, operating system, type and date of subscription.

These data are processed to ensure app functionality, detect crashes and errors, conduct technical analysis, comply with legal obligations, and maintain technical data security.

3. Customer Transaction Data

• Subscription plan, billing cycle.

This data is processed to manage your subscription plan, provide and improve our services and membership plans. Please note that we do not collect credit card information.

4. Photos & Images

If you choose to use features related to visual fortune-telling or numerology, you may upload a photo or image. The app will request your permission before accessing your device's camera or photo gallery. Any images provided are processed in real-time and are not stored on our servers. They remain solely on your device and are used exclusively to enable the relevant app functionalities.

5. Marketing & Analytics Data

• Analytics data (e.g., session duration, feature interaction), user preferences (e.g., language, theme), identifiers, in-app interactions, and interactions with marketing emails or ads.

These data are processed to deliver and personalize in-app content, run promotional campaigns, measure marketing performance, and gather insights to improve our products and features. Subject to your permission, we may send push notifications for marketing purposes and use identifiers (such as IDFA on iOS, GAID on Android, Firebase, and Appsflyer) for advertising and analytics. You may withdraw your consent at any time.

6. Information Voluntarily Disclosed by Users

In accordance with the data minimization principle under the GDPR, Xpastro strives not to process any data beyond what is necessary for the application. Any data not collected via the app but shared through contact or other means is deemed voluntarily disclosed by users. Such data is also protected under relevant legislation and adequate data protection measures.

Age Restriction and Parental/Guardian Notice

Xpastro is not intended for users under the age of 13. If you are under 13, please do not use or access the App or Website at any time or in any manner. By using the App and Website, you affirm that you are over 13. Parents and guardians are strongly encouraged to notify us if they become aware that a child under 13 is using the app. As stated in this Privacy Policy and our Terms, we do not knowingly collect information from children under 13 in compliance with the Children's Online Privacy Protection Act ('COPPA').

Sharing of Information

We will not sell, trade, or otherwise transfer your personal data to third parties for commercial purposes. Your data may be shared for the following reasons:

• Mobile App Stores: We use Google and Apple services (depending on your download platform) for app distribution, login, and updates. Transfers to these providers comply with GDPR data transfer rules and measures.

• IT, Hosting, and Analytics Service Providers: We may share your personal information with trusted third-party service providers who assist us in delivering and improving our Services, including providers of cloud infrastructure, analytics, and app performance tools (e.g., Google Cloud, Firebase for storage and backend support; Appsflyer for analytics). These providers process data on our behalf under applicable data protection laws and contractual safeguards.

• Legal, Tax, and Financial Consultants: We may share your data with professional advisors for legal, tax, or financial consulting related to our operations, conducted in compliance with the GDPR and limited to what is necessary.

• Public Authorities: We may disclose your personal data to legally authorized public institutions and government authorities when required by applicable laws, regulations, or administrative or judicial orders.

Anonymized Data

We may use anonymized data for analytical purposes. Anonymized data is processed so that it can no longer be attributed to an identifiable individual, ensuring your privacy is maintained. Please see the 'Data Destruction and Anonymization' section for details on this process.

Storage of Information

We are committed to storing your personal data securely and in compliance with applicable laws and regulations.

Retention Period

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Policy, in accordance with legal retention periods. Once the retention period expires, we will securely dispose of or anonymize your data.

Access Control

Access to your personal data is restricted to authorized personnel who require it to perform their job duties. We implement strict access controls and security measures to prevent unauthorized access, use, or disclosure.

Data Destruction and Anonymization

When personal data is no longer necessary or the retention period expires, we will securely delete/destroy it or render it anonymous. Anonymization involves processing data so it can no longer be attributed to you, allowing its use for analysis or research without compromising privacy. Once anonymized, the data is irreversibly altered and cannot be traced back to any individual.

Security Measures

We take the security of your personal data seriously and implement measures aligned with the General Data Protection Regulation (GDPR). Our key principles include:

• Safety Measures: Personal data is processed internally only by authorized personnel in a non-public manner. We implement verification and confidentiality measures, particularly for special categories of data, where applicable.

• Access Controls: Strict controls limit data access to authorized personnel on a need-to-know basis.

• Regular Security Audits: We conduct regular audits to identify and address potential vulnerabilities.

• Data Minimization: We collect and retain only the personal data necessary for specified purposes.

• Incident Response Plan: We maintain a plan to promptly address potential data breaches or security incidents.

While we strive to maintain a secure digital environment, no system can be fully secure. We encourage users to take precautions, such as using antivirus software, secure firewalls, safe Wi-Fi connections, and keeping their devices secure and updated.

If you suspect a data breach or security incident, please inform HubX immediately. We will investigate and take necessary measures to mitigate risks. Your security and privacy are our top priorities, and we are committed to maintaining high standards of data protection as required by law.

Corporate Affiliates and Sale of Business

We reserve the right to transfer information to a third party in the event of a sale, merger, or other transfer of all or substantially all of the assets of Xpastro or any of its Corporate Affiliates. 'Corporate Affiliate' means any entity that directly or indirectly controls, is controlled by, or is under common control with Xpastro, by ownership or otherwise. Any information shared with our Corporate Affiliates will be handled in accordance with this Privacy Policy.

Rights Under GDPR

The General Data Protection Regulation (GDPR) establishes a framework for personal data protection within the European Union and European Economic Area. As a data subject, you have the following rights regarding your personal data:

• Right to Access: To obtain confirmation and a copy of your personal data being processed.

• Right to Rectification: To request correction of inaccurate or incomplete data.

• Right to Erasure: To request deletion of your personal data under certain conditions.

• Right to Restrict Processing: To request limitation of how your data is processed in specific situations.

• Right to Data Portability: To receive your data in a structured, machine-readable format and transmit it to another controller.

• Right to Object: To object to the processing of your personal data, particularly for direct marketing.

• Rights Related to Automated Decision-Making: Not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects, unless exceptions apply.

To exercise these rights, please send a clear email or petition specifying the right you wish to exercise, along with your name and accurate contact details. We will respond within the legally required timeframe.

Updates to Privacy Policy

We reserve the right to update this Privacy Policy at any time to reflect changes in our practices, legal obligations, or operational needs. We encourage you to review this policy periodically. The revision date is stated at the beginning of the policy. Updates take effect immediately upon posting. If you disagree with any amendments, you should discontinue using the app. Continued use after updates constitutes acceptance of the revised policy.

Contact

This Privacy Policy constitutes the entire understanding between you and us regarding the collection, use, and protection of your personal data. If you have any questions or concerns about this policy or our data practices, please contact us at:

HubX Yazılım Hizmetleri Anonim Şirketi

Çınarlı Mahallesi, Ankara Asfaltı Caddesi, No:15 Kat:41 D:411 Konak / İzmir

legal@hubx.co

Last Update: May 2025