Legal

What we collect, and what we don’t.

Last updated: 28 September 2026

DefinedSelf is a free chart tool operated by Auto Alpha Advisory. This policy explains what personal information we handle under the Protection of Personal Information Act, 2013 (“POPIA”) — and, more to the point, how little of it we keep. There is no account, no login, and no user profile: your birth details travel inside your chart’s own link rather than into a database we can look you up in. §4 describes the one place copies of those links were kept, what changed on 4 August 2026, and how those older copies were removed on 16 August 2026.

1. Who is responsible

The responsible party (in POPIA terms) is Auto Alpha Advisory, which operates DefinedSelf. The head of Auto Alpha Advisory acts as its Information Officer for the purposes of POPIA ss55–56. For any privacy question or request, email privacy@autoalphaadvisory.co.za.

2. Your birth details

The date, time and place of birth (and the optional name) you enter are used to draw your chart. They are encoded into your chart’s shareable link — the long code in the /chart address — so that anyone you send the link to sees the same chart.

When a chart page is opened, that link is sent to our host to render the page, and may appear briefly in ordinary server request logs. We do not save your birth details to an account or a profile, and we do not use them for anything other than drawing the chart you asked for and writing the readings that come with it (§6). There is one exception: until 4 August 2026 our own analytics recorded the full page address, and on this site the address is where your details live. Those older records have since been purged of your details. §4 sets out what that meant and what we changed.

Apart from that, and the written readings in §6, which expire on their own within 90 days, the only lasting copy of your details is the one inside the link you hold — so treat that link as you would any personal note, and only share it with people you’re happy to show your chart.

3. Searching for your place of birth

As you type a town or city, that text is sent to Open-Meteo’s public geocoding service to suggest matching places and to find the correct timezone and coordinates. Open-Meteo is an independent service based in the European Union; only the place text you type is sent, never your name, date or time of birth.

4. Analytics

We use Umami, a privacy-friendly, cookie-free analytics tool that we self-host on our own server. It records visit counts — which page was viewed, a rough country, device type, and the referring page — with no cookies and no cross-site tracking. Because it is self-hosted, this data is never shared with a third-party analytics company. We rely on it under our legitimate interest (POPIA §11(1)(f)) in keeping the tool working and understanding, in aggregate, how it’s used.

What that recorded, and what we changed. The page address is part of what any analytics tool records, and on this site your birth details are encoded into the address of your chart and blueprint pages. So until 4 August 2026 our analytics kept a copy of those encoded details — the name, date, time and place you entered — for visits to those pages, and to pages reached from them. The name also appeared in the page title, in ordinary text rather than encoded. Nobody chose that: it followed from recording addresses on a site whose addresses carry the data, and we found it while auditing our own database rather than being told. Since 4 August 2026 the tracker removes those parameters in your browser, before anything is sent, so new records carry the page but not your details. Records made before that change did contain them. On 16 August 2026 we removed those details from our analytics database entirely — the encoded birth details and the names in page titles were deleted from every affected record, and nothing identifying you remains in our analytics. You can still ask us about anything we hold (§11).

5. Cookies

DefinedSelf sets no cookies of its own, and uses no advertising or tracking cookies. There is no cookie banner because there are no cookies to consent to.

6. Your email, your blueprint and your readings

You do not need to give us your email to draw your chart. If you ask for your written blueprint, you provide an email address — entirely optional and opt-in — and we use it to send you your blueprint link, plus at most one short follow-up, usually a few days later, asking how it landed. Nothing else is sent. That address is stored as a contact with our email provider, Resend (§7), as the record that a blueprint was requested. It is never sold, and never used for unrelated marketing without your separate consent (POPIA §69). To have it deleted, email privacy@autoalphaadvisory.co.za. To stop the form being abused, we also count requests for a short time: by network (IP) address for one hour, and by email address, stored only as a one-way hash, for 24 hours.

How the readings are written. The short reading on your chart page, and the full blueprint if you ask for it, are written by an AI model, Anthropic’s Claude (§7). For the short reading we send it your chart (your type, authority, profile and one of your channels) and the name you entered, if any. For the full blueprint we send your whole chart, the name, your date of birth, the day of the week, the place name and, if you gave a birth time, the part of the day (morning, afternoon, evening or night). We never send your exact birth time, your coordinates or your email address.

So that a reading opens instantly when you revisit your link, its text is kept in a cache (Upstash, §7): the short reading for up to 30 days, the full blueprint for up to 90. Because it is written for you, that text can include the name, birth date and place you entered. It is filed under a code computed from your birth details and name (a one-way hash), not under your email or any account. That code is pseudonymous, not anonymous: from your chart link, the same code can be computed again. The text expires on its own. The link itself is your copy: it contains your birth details in the same encoded form as your chart link, so treat it with the same care.

Your blueprint as a PDF. If you download it, the PDF is made on our host at that moment from the cached text above, sent to you, and not kept. It carries the name, birth date and place you entered, so treat it like the link. To stop downloads being abused, we count them for a short time: by network (IP) address for an hour, and by the same one-way code as the cached text for a day.

If you answer our question about your blueprint. The follow-up email links to a short page of optional questions about how the blueprint landed. If you answer, we keep your answers for up to 12 months in our cache (Upstash, §7), filed under a one-way code computed from your chart link, or under the random code in the link we emailed you, together with your chart’s type, authority and profile where the link gives us them. Your email address and birth details are not stored with them. A copy of your answers is also emailed to us through Resend (§7) so that we can read them, and that copy stays in our mailbox until we delete it. Ignoring the follow-up changes nothing.

If you reply to one of our emails. Your reply reaches us through our mail-forwarding provider, ImprovMX (§7), and stays in our mailbox until we delete it. We read replies and may answer them. A reply is not added to your blueprint, to your answers or to anything else we keep.

7. Who processes data for us

We rely on six service providers, each receiving only the minimum needed:

Vercel Inc. — hosts the site, with infrastructure in the EU and the USA. (Our analytics is self-hosted — see §4 — so no third party receives it.)
Open-Meteo — provides place search, timezone and coordinate lookups (EU-based). Receives only the place text you type.
Resend Inc. — delivers the blueprint email and stores the contact address you gave for it (USA-based). Receives only that address and the email’s contents, which include your blueprint link and the name, birth date and place you entered, and delivers to us a copy of any answers you give to our follow-up question.
ImprovMX Inc. — forwards any reply you send to one of our emails to our mailbox (USA and EU). It keeps the message only while forwarding it, and a delivery log (the date, the sender and recipient addresses and the subject line) for 7 days.
Anthropic, PBC — writes the readings, using its Claude AI model (USA-based). Receives your chart, the name you entered and, for the full blueprint, the birth details listed in §6; never your email address. Under its commercial terms it may not train its models on this data, and it deletes it within 30 days unless it must keep it longer to enforce its usage policy or to comply with the law.
Upstash — a hosted database we use as a short-lived cache, on servers in the USA. Holds the written readings (30 and 90 days), the request counts that protect the blueprint and feedback forms (one hour and 24 hours), and any answers to our follow-up question (12 months), as set out in §6.

We do not sell your personal information, and we do not share it with advertisers or data brokers.

8. Cross-border transfers (POPIA §72)

Because most of the providers above operate outside South Africa (mainly in the EU and the USA), the limited data described here may be processed abroad. This is permitted under POPIA §72: each provider is bound by its own published terms affording comparable protection, and the data involved is limited — a place name, a chart URL, your chart and the details used to write your readings (§6), (if you request a blueprint) your email address, (if you answer our follow-up question) your answers, and (if you reply to one of our emails) your reply — with no stored personal profile.

9. How long we keep it

Because we keep no account and no user profile, there is very little about you for us to retain. An email address given for a blueprint is kept as a contact with Resend until you ask for it to be deleted (§6). Cached reading text expires by itself: the short reading within 30 days, the full blueprint within 90. The request counts that protect the blueprint form expire within an hour (network address) and a day (hashed email), and those that protect the feedback form within an hour. Answers to our follow-up question are kept in the cache for up to 12 months. A reply to one of our emails stays in our mailbox until we delete it; ImprovMX deletes its delivery log of it after 7 days. Anthropic deletes what it receives within 30 days under its standard terms (§7). Analytics records are held on our own self-hosted server: records made from 4 August 2026 carry no birth details, and the earlier records that did were stripped of them on 16 August 2026 (§4). What is left is visit counts with nothing identifying you in them. Ordinary host request logs (which may contain a chart URL) are short-lived and managed by our host.

10. Security

All traffic is served over HTTPS/TLS. The personal information that exists at all — a blueprint contact address at Resend, the self-expiring reading text and request counts at Upstash, and what Anthropic holds for up to 30 days — sits either on infrastructure we control or with the providers listed in §7. If a reportable breach ever occurs, we will notify the Information Regulator and any affected people as POPIA §22 requires.

11. Your rights under POPIA

You have the right to:

Access (§23) — ask what personal information we hold about you. In practice this is very little: your birth details live in your own chart link, our analytics no longer hold any copy of them (§4), and the only record tied to your email is a blueprint contact address, if you gave one (§6). Cached reading text is filed under a code computed from your chart details, not under your email or an account (§6).
Correction (§24) — request that inaccurate information be corrected.
Deletion (§24) — for your birth details, deleting the chart link you hold removes your copy: simply discard it and don’t reshare it. The analytics records that once held a copy were purged of it on 16 August 2026 (§4), so there is nothing left there to delete. Cached reading text expires on its own within 90 days (§6). If you gave an email for a blueprint, ask and we’ll remove the contact (§6).
Objection (§11(3)) — object to processing based on legitimate interest.
Complaint — complain to the Information Regulator at inforegulator.org.za.

To exercise any of these, email privacy@autoalphaadvisory.co.za with the subject “POPIA Request”.

12. Children

DefinedSelf is not directed at children under 18.

13. Changes

We may update this policy if the tool changes. The “Last updated” date above always reflects the current version; material changes to how data is handled will be reflected here before they take effect.

14. Contact

Auto Alpha Advisory
Privacy & POPIA requests: privacy@autoalphaadvisory.co.za
General: hello@autoalphaadvisory.co.za

DefinedSelf is a self-reflection guide, not a diagnosis or a prediction. See our Terms of Use.