Log in

Legal

Privacy Policy

This policy explains what Nanyu Digital Creative Limited (“Guanxiang”, “we”) collects when you use https://www.guanxiang.co, why we use it, who receives it, and the choices you have. It covers the account, the shop, credits, membership, Cast, Echo, written reports, Live sessions, and AI readings.

Effective 11 October 2026. English controls. Contact [email protected].

1. Who is responsible

Nanyu Digital Creative Limited, Hong Kong, is the business responsible for personal data on Guanxiang. For people in the EEA or the United Kingdom, you may also have rights under local law as described below. We do not sell personal information.

2. What we collect

Account

Name, email, a password hash when you set a password, membership tier (Scholar, Adept, or Master), timezone, and the record of which welcome-credit grants this account has already received. If you sign in with Google, we receive the email address and name Google confirms, and a Google account identifier. We do not receive your Google password.

Purchases, credits, and refunds

Orders, the credit balance, credit-ledger entries, holds for an open booking, membership charges, shipping name and address for a physical good, delivery status, and the Stripe customer and payment references. We do not store the full card number, expiry, or security code. Refund requests, the reason you give, and whether credits or a card amount were returned, are kept with the order.

Readings and sessions

Questions you type, the six lines of a cast, Echo notes, follow-ups, saved readings, and the content of a Live thread or a written-report brief that an advisor needs. You can refrain from saving a reading.

Echo’s birthday hexagram asks for a birth date, a birth time, a timezone, and an optional gender. We use those only to draw that pattern. A friend’s hexagram asks for the same fields about another person. Enter them only if you are allowed to. We do not contact that person, and we do not use the fields for advertising.

What you choose to show

A share link copies a private address for one Echo. Publishing to the Field makes a public card: the notice, the short excerpt, the image on that card, and the date. The card does not add your account name. If your own words include a name or another fact, that text is public. You can leave an Echo unpublished.

Technical data

A guest key, the sign-in token, and a shop cart kept in your browser, device identifiers used to enforce daily limits, and standard server logs such as IP address, time, and the page requested. If you allow browser notifications, we store the push subscription so we can send a booking or account notice. We do not use third-party advertising cookies. We do not run a separate advertising network on the site.

3. Why we use it

We use this information to:

  • create and secure your account;
  • provide Cast, Echo, AI readings, written reports, Live sessions, Master Road, and the shop;
  • take payment, keep the credit ledger and the cash book, ship a physical good, and issue a refund or a credit return;
  • prevent fraud, handle a chargeback, and meet tax and accounting duties;
  • send service messages, including booking reminders when email sending is enabled;
  • enforce daily Cast and Echo AI allowances, and the follow-up allowance on each reading, and investigate abuse.

Where GDPR or UK GDPR applies, the legal bases are contract, legitimate interests in running and protecting the service, and legal obligation for accounting and tax. We do not use readings to advertise third-party products to you.

4. AI readings

When you open a Cast AI reading, an Echo AI reading, or send a follow-up, we send the cast, your question if you wrote one, and the follow-up text to a language-model provider so it can write the answer. The current provider is DeepSeek. We do not send your card number. We do not use your readings to train a Guanxiang model. We do not control how long that provider keeps a request under its own terms. A person does not read each AI answer before you see it.

What the model is told to do, and what an AI reading is not, is in the AI Use Statement. A written report and a Live session are prepared by an advisor. Those are not sent to the model as the product you bought.

5. Who else receives it

  • Stripe, to process a card payment, a renewal, a refund to the card, and tax calculated at checkout.
  • The language-model provider named above, for a Cast AI reading, an Echo AI reading, or a follow-up only.
  • An advisor assigned to your written report or Live session, who receives the question and the brief for that order. An advisor does not receive your card number or a friend’s birth fields.
  • The carrier, who receives the shipping address for a physical good.
  • Google, when you choose Google sign-in, confirms the email address and name for that sign-in.
  • Hosting and email providers, who process data on our instructions.

We do not give your reading to advertisers.

6. How long we keep it

Account, order, credit-ledger, and cash-book records are kept while the account is open and afterwards for as long as tax, accounting, or dispute rules require. A refund record stays with the order for that same period. On a Scholar account, Cast and Echo results older than one month are removed. Adept and Master keep those results without that time limit. You may ask us to delete a saved reading sooner. We may retain a minimized order record after deletion where the law requires a book entry. Server logs are kept for security and then deleted or reduced on a routine cycle.

7. Your choices

You may ask us to:

  • confirm whether we hold personal data about you, and for a copy;
  • correct data that is wrong;
  • delete a saved reading, or delete the account where we are not required to keep a book entry;
  • restrict or object to a use based on legitimate interests;
  • receive a portable copy of data you provided, where the law gives that right.

Write to [email protected]. We may need to confirm that the request comes from you. Refund rules for a purchase are in the Terms and Payments and Credits. Asking about your data does not by itself refund an order.

8. United States, EEA, UK, Japan, and Spain

California. If you are a California resident, you may ask us to disclose or delete personal information we hold. We will not discriminate against you for asking. We do not sell or share personal information as those terms are used in the California Consumer Privacy Act. We do not respond to browser “Do Not Track” signals with a separate advertising opt-out, because we do not use third-party advertising cookies.

EEA and the United Kingdom. You may lodge a complaint with the supervisory authority in your country or with the UK Information Commissioner’s Office. You may also contact us first at [email protected]. Withdrawal from a purchase, where that right exists, is a contract right described in the Terms. It is separate from these privacy rights.

Japan. We do not collect data in order to predict a fixed outcome or to change luck. If you live in Japan, you may ask us to disclose, correct, or delete personal data we hold, under the Act on the Protection of Personal Information, by writing to [email protected].

Spain. Mandatory privacy and consumer rules in your place of residence apply where they cannot be waived.

9. International transfers

We operate from Hong Kong. Data may be processed where our hosting, Stripe, and the language-model provider operate. Where a transfer out of the EEA or the UK needs a safeguard, we use a lawful mechanism such as standard contractual clauses.

10. Children

Guanxiang is not for anyone under 18. We do not knowingly collect children’s data. If you believe a child has given us personal data, write to [email protected] and we will delete it.