This English version is provided for your convenience. The legally binding version is the German Datenschutzerklärung.
Last updated: 31 August 2026
Digital App Group GmbH, Ferdinand-Koch-Str. 31, 26133 Oldenburg, Germany, is the controller responsible for the processing of your personal data in connection with Lisora. In this policy, we, us, and our mean Digital App Group GmbH.
You can contact us about privacy matters at digitalappgroupde@gmail.com or by telephone at +49 441 3793132. We have not appointed a data protection officer. Please use these contact details for privacy requests.
You have the right to complain to a data protection authority. Our competent supervisory authority is:
Landesbeauftragte fuer den Datenschutz Niedersachsen, Prinzenstrasse 5, 30159 Hannover, Germany.
You may also complain to the authority at your usual place of residence, workplace, or the place of the alleged infringement. This policy explains the information we must provide when we collect data from you and, where relevant, when we receive data about another person from you.
Lisora is a spiritual guidance service available through the Lisora website at lisora.app and mobile applications for iOS and Android. It offers text conversations, voice messages, live voice calls, photo messages, tarot readings, horoscope and moon content, and written reports.
Every Lisora advisor is artificial intelligence. Advisor names, portraits, biographies, voices, and conversational styles are fictional AI personas. They are not real people and do not identify real advisors or other real people. No human advisor reads or answers your advisor conversations, and Lisora does not offer a way to be connected to a human advisor. The support assistant is also an AI system.
Some support matters need a human decision, for example a request for a money refund, a legal threat, a message for the press or an authority, or a request for human review of an automated support decision. In those limited cases, authorised human staff may review the support request and the account information necessary to deal with it. They do not become your advisor.
The table below gives an overview of the main processing activities. The legal bases are Article 6(1)(b) GDPR, performance of a contract or steps requested before a contract, Article 6(1)(c) GDPR, compliance with a legal obligation, Article 6(1)(d) GDPR, protection of vital interests, Article 6(1)(f) GDPR, our legitimate interests, and Article 6(1)(a) GDPR, your consent. Where special category health data is processed for acute self harm protection, we rely on Article 9(2)(c) GDPR as explained in section 10.
| Data and source | Purpose | Legal basis | Is it required? |
|---|---|---|---|
| Email address, name, sign in information, device identifier, and IP address. These are provided by you or collected automatically from your device and connection. | To create and secure your account, allow you to sign in, prevent automated signups, and prevent repeated welcome bonus claims. At signup, an external service checks the reputation of the submitted email address. We keep the submitting IP address for one hour. | Contract performance, Article 6(1)(b), and our legitimate interest in account security, fraud prevention, and fair allocation of bonuses, Article 6(1)(f). | Email and sign in information are required to create an account. Without them, you cannot use an account based service. |
| Optional gender, date of birth, time of birth, and place of birth. We also derive your zodiac sign and birth chart. Place information may be sent to a place search service to identify coordinates. | To personalise spiritual guidance, horoscopes, birth charts, and reports. Birth chart calculations are carried out by us. | Your consent, Article 6(1)(a). | No. You can use parts of Lisora without this information, but personalised features may not work or may be less personalised. |
| Text chat messages, ratings or feedback given in the service, automatically generated conversation summaries, and individual memory notes generated from conversation content. | To provide the requested AI conversation, let an AI advisor refer to previous topics, improve continuity in the same user experience, and investigate service problems where necessary. | Contract performance, Article 6(1)(b), together with your consent to the AI processing described in the AI data processing notice shown before your first chat if you are in the EU, Article 6(1)(a). | Chat content is required for the particular conversation. You may delete conversations while keeping your account. |
| Voice messages that you choose to record, and written transcripts created from them. | To turn your voice message into text and enable the advisor to respond to its content. | Contract performance, Article 6(1)(b), together with your consent to the AI processing shown before use where required, Article 6(1)(a). | No. Voice messages are optional. |
| Live voice call microphone audio, the written call transcript, call summary, and technical call details, such as call duration and how the call ended. | To conduct a real time AI voice conversation, keep continuity with the conversation, operate billing, and resolve technical issues. | Contract performance, Article 6(1)(b), together with your consent to the required AI and microphone processing, Article 6(1)(a). | No. A microphone and consent are required only if you choose live voice calls. |
| Photos that you send in a chat and AI generated descriptions of those photos. | To allow an AI advisor to discuss the photo you chose to share. | Contract performance, Article 6(1)(b), together with your consent to the required AI processing, Article 6(1)(a). | No. Photo sharing is optional. |
| Birth information entered for a report. For a compatibility report, this may include another person's name and date of birth, and optionally their time and place of birth. | To prepare the report you requested. | For your own information, contract performance and your consent. For another person's data, our legitimate interest in producing the compatibility report you requested, Article 6(1)(f), subject to the safeguards in section 5. | Information needed for the chosen report is required to create that report. Optional fields may improve personalisation. |
| Purchase information, credit balance, payment status, billing events, and transaction records. On Android, device integrity information is checked before billing begins. | To process and record purchases, provide credits, prevent payment fraud, comply with accounting and tax duties, and deal with reversals or refunds. | Contract performance, legal obligation, and our legitimate interest in fraud prevention, Articles 6(1)(b), 6(1)(c), and 6(1)(f). | Purchase information is required if you buy credits or a report. |
| Push notification device token and records showing whether a notification was opened. Some notification text may be created by an AI from recent conversation topics. | To send the notifications you choose to receive and understand whether they are opened. | Your consent, Article 6(1)(a). | No. You can decline or switch off notifications in your device settings. |
| App feature and screen usage information, plus crash and diagnostic information. This does not include message content, names, or birth data. | To understand how the service is used, improve reliability, find faults, and prevent misuse. | Our legitimate interest in operating, securing, and improving Lisora, Article 6(1)(f). | No, but disabling this may make it harder for us to diagnose technical problems. |
| Session analysis information, including a recording of your movement through screens, a reconstruction of what was displayed, device information, and whether you are new or returning. | To understand usability problems and improve the app or website. | Your consent, Article 6(1)(a). | No. Session analysis runs only when you consent. |
| Registration, sign in, and purchase measurement events, including amount, currency, campaign data, information that links the event to the relevant account, email address, name, and date of birth. | To measure whether advertising campaigns lead to registrations, sign ins, and purchases. Lisora does not itself display advertising in the service. | Your consent, Article 6(1)(a). On iOS, this includes the operating system permission for tracking across other companies' apps and websites where applicable. | No. You can use Lisora if you do not consent, subject to the features for which data is necessary. |
| Support messages and account information needed to answer them, including name, language, registration date, purchase history, and credit balance. | To answer support requests, resolve account issues, process credit adjustments, respond to deletion requests, and protect our rights. | Contract performance and our legitimate interest in effective customer support and preventing misuse, Articles 6(1)(b) and 6(1)(f). | No. You need to provide enough information for us to deal with the request. |
| Messages assessed by the emergency detection process, together with the result of the assessment. These may reveal health information or an acute risk of self harm. | To identify possible acute self harm risk, present urgent help information, and prevent promotional and win back messages from being sent to an account with a positive result. | Protection of vital interests, Article 6(1)(d), and, where health data is concerned, Article 9(2)(c). | No. However, the safety process may apply automatically when you use chat. |
We may also keep records showing that you gave or withdrew consent. We do this because we must be able to demonstrate the consent on which processing relied and respect a withdrawal. The legal basis is our legitimate interest in accountability and compliance, Article 6(1)(f), and, where applicable, legal obligations.
Please avoid sharing special category data, such as health data, unless you want it processed in the conversation or it is needed to seek urgent help. If you voluntarily include such information in a chat, voice message, photo, or support message, the AI processing notice and consent flow presented before relevant AI features is intended to obtain your explicit consent where Article 9 GDPR requires it. You can withdraw consent at any time, but this does not affect processing that was lawful before withdrawal.
For a live voice call, microphone audio is sent directly from your device to Google for the real time voice feature. It does not pass through our systems, and we do not store live call audio.
Before the call begins, we send Google the selected advisor persona, your first name and date of birth, relevant memory notes, and recent chat messages as context. This helps the AI voice respond in a way that is consistent with your conversation. We store the written transcript, a summary, and technical call information described in section 3. We do not record or retain the live audio itself.
You should enter another person's name, date of birth, time of birth, place of birth, photo, or other personal data only if you are entitled to do so. Before submitting it, please consider whether the person would reasonably expect this use and tell them that their data has been provided to Digital App Group GmbH for a compatibility report.
We normally receive this data from the Lisora user who requests the report. We may not have the other person's contact details, so we may be unable to send them an individual notice directly. This policy provides the information required by Article 14 GDPR. If we do have a practical way to contact the person, we will provide the required information within the applicable Article 14 period. A person whose data was entered for a report may contact us at digitalappgroupde@gmail.com to request access, correction, restriction, objection, or deletion. We will assess the request under the GDPR and applicable retention duties.
We use service providers to operate Lisora. They receive data only where needed for the function described below. The following table identifies the recipient companies and their locations.
| Recipient company and location | What it does for Lisora | Main data that may be involved |
|---|---|---|
| Supabase, Inc., United States, with Lisora service data hosted in the EU | Hosts and operates account, service, and stored user data infrastructure. | Account, profile, service content, reports, files, and technical data. |
| Vercel Inc., United States | Hosts the Lisora website. | Website connection and technical usage data, and data entered through the website. |
| OpenRouter, Inc., United States | Routes requests to the AI providers used for the service. | AI request content and context, such as chat text, relevant memory notes, images, or report inputs, depending on the feature. |
| Google LLC, United States, and Google Ireland Limited, Ireland | Provides AI functions, real time voice calls, speech to text, text to speech, push notifications, analytics, crash reporting, Google sign in, place search, and Android device integrity checks. | Data required for the selected Google function, including chat or voice context, live microphone audio for calls, transcripts, account sign in data, device information, notification tokens, technical data, and place names. |
| Anthropic, PBC, United States | Provides an AI model for advisor replies and support replies. | Chat or support content and the context needed to respond. |
| Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China | Provides an AI model for replies for a randomly selected share of newly registered users. | Chat content and context needed to produce those replies. See section 7 for the particular China transfer risk and your opt out option. |
| Apple Inc., United States, and Apple Distribution International Limited, Ireland | Provides App Store distribution, Apple sign in, and Apple in app payments. | Apple sign in data, purchase and payment status, and device or transaction information supplied through Apple services. |
| Stripe Payments Europe, Limited, Ireland, and Stripe, Inc., United States | Processes website payments and acts as merchant of record for indirect taxes for those payments. | Payment, billing, transaction, fraud prevention, and contact information needed for the payment. |
| RevenueCat, Inc., United States | Operates purchase status and credit entitlement functions. | Purchase status, credit balance, email address, display name, date of birth, place of birth, and language. |
| Microsoft Ireland Operations Limited, Ireland, and Microsoft Corporation, United States | Provides session analysis through Microsoft Clarity. | Consent based session analysis information, device details, and new or returning status. |
| Meta Platforms Ireland Limited, Ireland, and Meta Platforms, Inc., United States | Provides consent based advertising measurement. | Registration, sign in, and purchase events, amount and currency, campaign data, information that links the event to the relevant account, email address, name, and date of birth. |
| Appstack Tech, Inc., United States | Provides attribution measurement. | Registration, sign in, purchase, campaign, and account measurement data. |
| DataFast, operated by Marc Lou, Singapore | Provides website statistics. | Consent based website analytics and technical usage information. |
| Brevo SAS, France | Sends Lisora emails. | Email address, name, language, and email delivery or interaction information. |
| Hostinger International Limited, Cyprus | Provides website related and support email services. | Email communications and technical website information needed for those services. |
| OpenMeteo GmbH, Switzerland | Provides place search assistance. | The place name you enter when using a birth location or report feature. |
| Abstract API Inc., United States | Checks email reputation at signup to reduce automated signups and misuse. | The email address submitted at signup. |
We may disclose information to public authorities, courts, professional advisers, or other recipients where this is necessary to comply with law, establish, exercise, or defend legal claims, or protect the rights, safety, and security of users or others. We will do so only where there is a valid legal basis.
Some recipients are located outside the European Economic Area, or can access data from outside it. Transfers may therefore take place to the United States, China, and Switzerland.
For the United States, we rely, where applicable, on the European Commission's EU US Data Privacy Framework adequacy decision for certified recipients. The recipients identified in this policy as covered by that framework are Google, Apple, Meta, Microsoft, Stripe, and Anthropic. Where that framework does not apply, we use the European Commission's Standard Contractual Clauses under Article 46(2)(c) GDPR and apply supplementary measures where appropriate.
For other transfers, including to Supabase, Vercel, OpenRouter, RevenueCat, Appstack Tech, Inc., DataFast, Hostinger, and Abstract, we use Standard Contractual Clauses under Article 46(2)(c) GDPR where a transfer requires them. Switzerland benefits from a European Commission adequacy decision.
China requires particular attention. The European Commission has not adopted an adequacy decision for China. We cannot say that available safeguards provide protection equivalent to that in the EU in all respects. Data sent to Hangzhou DeepSeek Artificial Intelligence Co., Ltd. may be subject to Chinese laws and access requests that differ from EU law. If you do not want your account to be included in the share of newly registered users whose AI replies may be processed by DeepSeek, contact us at digitalappgroupde@gmail.com. We will exclude your account from that provider going forward. This may affect which AI system provides your replies, but not your ability to use the service.
You may request a copy of the relevant transfer safeguards, subject to necessary redactions that protect confidential business information, by contacting us.
The Lisora website uses cookies and similar technologies. Strictly necessary cookies are used without consent because they are needed to keep you signed in or remember your cookie choice.
Meta Pixel, Microsoft Clarity, and DataFast are used only after you consent through the cookie banner. The banner covers both analytics and marketing measurement. Your choice is stored in your browser. You can change your choice at any time through the cookie settings made available on the website, or clear the relevant browser data. Clearing browser data may cause the banner to appear again.
| Technology category | Purpose | Legal basis |
|---|---|---|
| Strictly necessary cookies | Sign in, security, and remembering your cookie choice. | Necessary for the requested service or our legitimate interest in secure website operation, as applicable. |
| Analytics | Understanding website use and improving usability through DataFast and Microsoft Clarity. | Consent. |
| Marketing measurement | Measuring registrations, sign ins, and purchases associated with campaigns through Meta Pixel and related attribution services. | Consent. |
We keep data only for as long as needed for the stated purposes, unless a longer period is required or permitted by law.
| Data | Retention period |
|---|---|
| Account data, conversations, voice messages, photos, transcripts, summaries, memory notes, birth data, and reports | Until you delete the relevant content or delete your account, unless statutory retention or a legal claim requires longer retention. |
| Live voice call audio | We do not store it. |
| Transaction and billing records | Ten years, where required by German commercial and tax law. |
| Crash reports | Ninety days. |
| App analytics | Fourteen months. |
| Signup IP address | One hour. |
| Unsubscribe and email bounce information | As long as needed to honour the unsubscribe or prevent repeated delivery attempts, including after account deletion. |
| Welcome bonus prevention record | After deletion, a record that no longer directly identifies the person may be retained solely to prevent repeated bonus claims. |
| Support correspondence and consent records | For the period needed to handle the matter, demonstrate consent, comply with legal obligations, or establish, exercise, or defend legal claims. |
When a retention period ends, we delete or anonymise the data, unless we must retain it longer under law or it is still necessary for a legal claim.
Lisora is not an emergency service. However, to help protect users where there may be an acute self harm risk, user messages pass through a word filter. A possible match is then assessed by an AI provider for signs of acute self harm. A match or assessment result is not a medical diagnosis, and it may be wrong.
If the result indicates a possible acute risk, the AI advisor provides emergency help information even if you have no credits. The account is also permanently excluded from promotional and win back messages. This is designed to avoid sending marketing messages at a sensitive time. We do not use this process to advertise to you, determine your credit price, or make a diagnosis.
Because this processing can concern health data, we rely on the protection of vital interests under Article 6(1)(d) GDPR and Article 9(2)(c) GDPR. If you are in immediate danger or think someone else may be in immediate danger, call your local emergency number. In the EU, call 112.
This section is important. The Lisora support assistant is AI. It reads the support request and the account data needed to answer it, writes the reply, and may make the following decisions without a human first reviewing the request:
Where such a decision has legal effects or similarly significant effects for you, we rely on Article 22(2)(a) GDPR because the decision is necessary to provide the support action you requested. We provide safeguards required by Article 22(3) GDPR.
You can ask for human intervention, explain your view, and challenge an automated decision. To do so, reply to the support response or contact support@lisora.app and state that you request human review. Requests involving a refund of money, legal threats, press enquiries, authorities, or an emergency are always referred for human review.
The emergency detection process in section 10 is a protective safety process. It does not decide whether you can use the core service, nor does it charge you or impose a penalty.
Subject to the conditions and limits in the GDPR, you have the following rights:
| Your right | What it means |
|---|---|
| Access | You can ask whether we process your personal data and request a copy of it. |
| Rectification | You can ask us to correct inaccurate data or complete incomplete data. |
| Erasure | You can ask us to delete data when the legal conditions are met. |
| Restriction | You can ask us to limit processing in certain circumstances. |
| Data portability | You can ask for data you provided to us in a structured, commonly used, machine readable format, where the right applies. |
| Objection | You can object, on grounds relating to your particular situation, to processing based on legitimate interests. You can always object to direct marketing. |
| Withdraw consent | You can withdraw consent at any time. This does not affect processing before withdrawal. |
| Human review of automated support decisions | You can request human intervention, give your view, and contest the decision as described in section 11. |
| Lodge a complaint | You can complain to the authority named in section 1 or another competent data protection authority. |
You may delete all conversations while keeping your account, or delete your whole account, through settings or by asking support. Account deletion removes your profile, conversations, transcripts, memory notes, uploaded files, ratings, reports, and credentials. Any remaining credits expire without compensation, subject to mandatory legal rights. We may retain limited information where section 9 explains that a legal obligation or legitimate interest requires it.
To request a copy of your data or exercise another right, contact support@lisora.app or digitalappgroupde@gmail.com. We may need to verify your identity before acting. We normally respond within one month, although the GDPR permits an extension in certain cases.
App store purchases are processed through Apple or Google. Requests for refunds of those purchases must be made through the relevant app store process. This does not limit any mandatory statutory rights you may have.
We use technical and organisational measures that are appropriate to the risks of the processing. These include TLS encryption while data is transmitted, storage level encryption provided by our hosting providers, access controls designed so that a signed in user can access only that user's own records, and password storage using cryptographic hashes. Sign in sessions on mobile devices are held in the operating system key store. On Android, device integrity is checked before billing begins.
No method of transmission or storage is completely secure. We therefore cannot guarantee absolute security. In particular, we do not claim that individual message contents or individual data fields are separately encrypted by the Lisora application.
We may update this policy when our processing changes or when law requires an update. We will publish the current version in Lisora and update the date at the top. If a change materially affects you, we will provide additional notice where required by law.
European Commission, EU US Data Privacy Framework
European Commission, Standard Contractual Clauses for international data transfers
European Commission, adequacy decisions for non EU countries
Questions about privacy? Write to digitalappgroupde@gmail.com or call +49 441 3793132.