English is provided for reference only. If there is any discrepancy, the Traditional Chinese version prevails.
Qenilo Privacy Policy
Version: v0.3 Effective date: November 2, 2026 Data controller: [Name / entity, individual member status, pending completion] Contact email: [Domain pending]
This Policy explains what information this website collects, why it is collected, who processes it, how long it is retained, and what rights you have. As required by Article 8 of the Personal Data Protection Act, we inform you before collecting your personal information.
1. What information we collect
| Category | Items | Source | Why we need it |
|---|---|---|---|
| Account identifiers | LINE userId, LINE display name | LINE sign-in | Create and identify your account; watermark; LINE notifications |
| Contact information | Email address (provided through LINE authorization or entered by you) | LINE / you | Send unlock notices, PDFs, consultation, and customer-support emails |
| Birth data | Date of birth, time of birth (or “Unknown”), birthplace (county/city / Hong Kong or Macao / other + time zone), gender | Provided by you | Calculate your chart and generate a report (core service) |
| Charts and reports | Generated Zi Wei Dou Shu, BaZi, and Western Zodiac Signs charts; annual reports and scores | Generated by this website | Provide reports, caching, and PDFs |
| Compatibility subject data (Phase C) | The other person’s date of birth and gender (time of birth and 16 personality type are optional) | Provided by you | Generate a compatibility reading. We do not collect the other person’s name or contact information. |
| 16 personality type result (Phase B) | Test result or type entered directly by you | You | Include in cross-analysis of personality traits |
| Order and payment records | Order number, product, amount, payment status and time, refund record, consent record at purchase | This website / ECPay | Fulfillment, refunds, accounting, and tax. This website does not access or store your credit card number. |
| Consent records | Version and time of documents you consented to | This website | Show that you consented to the Terms and Privacy Policy |
| Consultation requests | Topic, one-sentence description, available times, contact information, whether you understand the fee | Provided by you | Screening, scheduling, and service |
| Notification records | Type and time of LINE / email messages sent | This website | Enforce marketing-message limits and respond to support inquiries |
| Usage records | Sign-ins, report views, clicks on locked sections, unlocks, PDF requests, and other events; IP address, device, and browser information | Collected automatically | Security, debugging, and product improvement |
Please note:
- Do not enter sensitive personal information such as medical records, diagnoses, criminal records, or sexual-life information in free-text fields such as the consultation form. If you enter it anyway, you are treated as consenting to this website using it to process that request; this website will not use it for other purposes.
- If you provide information about another person (for example, a compatibility subject), please confirm that you have their consent or another lawful basis to provide it.
2. Purposes of collection and legal bases
| Purpose | Specific purpose code [attorney review requested] | Legal basis |
|---|---|---|
| Provide core services such as charts, reports, and PDFs; fulfill orders; issue refunds | 069 Contractual, quasi-contractual, or other legal relationship matters; 090 Consumer and customer management and services | Article 19, Paragraph 1, Subparagraph 2 of the Personal Data Protection Act (contractual relationship with the data subject); your consent |
| Account sign-in, security, abuse prevention, and prevention of duplicate registrations and duplicate claims | 136 Telecommunications and database management | Contractual relationship; this website’s legitimate interests (provided they do not infringe your rights); your consent |
| Accounting, tax, and legally required retention | 063 Collection, processing, and use of personal data by a non-government agency to fulfill legal obligations | Article 19, Paragraph 1, Subparagraph 2 of the Personal Data Protection Act (legal obligation; wording to be confirmed by counsel) |
| Marketing messages (see Section 8) | 040 Marketing | Only if you separately check the consent box |
| Product improvement and statistics | 181 Other business activities consistent with registered business items or articles of incorporation | Your consent; de-identified data is preferred |
Categories of personal information collected: C001 Identifiers; C002 Financial identifiers (order and payment status only); C011 Personal descriptions (gender, date of birth, and birthplace); and other information you voluntarily provide. [Please have counsel verify the codes.]
Effect of not providing information: Birth data is required to calculate a chart; without it, this website cannot generate a report. Without an email address, you cannot receive PDFs or email notifications. Declining marketing consent does not affect any service.
3. Use, sharing, and cross-border processing of information
Retention / use period: From registration until you delete your account or the statutory retention period expires (see Section 5). Locations of use: Taiwan and the locations of the third-party services listed below, including the United States and Japan. Recipients: This website and the third parties listed below that process information on its behalf to provide services. Methods of use: Electronic storage, transmission, computation, and notifications.
This website does not sell your personal information and will not use your birth data for purposes unrelated to this service.
List of third-party processors
| Service | Main location | Purpose | Information it may access |
|---|---|---|---|
| LINE (LY Corporation / LINE Taiwan) | Japan / Taiwan | Sign-in and LINE push notifications | LINE userId, display name, email (if authorized), push notification content |
| ECPay | Taiwan | Collect payments, refunds, and (Phase C) recurring charges | Order number, amount, payment information (ECPay handles card numbers; this website does not receive them), your contact information |
| Supabase | [Database region pending confirmation, for example Singapore / Tokyo / United States] | Database and PDF file storage | All account data, birth data (encrypted at the application layer), reports, and order data on this website |
| Vercel | United States (global points of presence) | Website and server hosting, scheduled tasks, and traffic analytics | Website request logs (IP address and browser information) and information processed by the server |
| Resend | United States | Send email | Your email address and message content ([whether PDFs are sent as attachments or links is pending confirmation]) |
Notes:
- Each listed service has its own privacy policy and security measures. This website selects providers with reasonable safeguards and provides only the minimum information needed to perform each task.
- This website may disclose information when required by law (for example, in response to a lawful request from a judicial authority) and will notify you in advance where practicable.
- If this business is transferred or merged, your information may be transferred with the business. This website will notify you in that case.
4. Is this sensitive personal information?
Date of birth, time of birth, and gender are not, by themselves, “special categories of personal data” listed in Article 6 of the Personal Data Protection Act (medical records, medical treatment, genetic data, sexual life, health examinations, or criminal records). Reports from this website are also not medical services. However, because birth data can be used to infer personal characteristics, this website applies stricter safeguards than it does to ordinary information (see Section 7). If you voluntarily enter special categories of personal data in a free-text field, see the reminder in Section 1.
5. Retention periods
| Information | Retention period |
|---|---|
| Account, birth data, charts, and reports | Until you delete your account; deleted from the database within 24 hours after deletion (backup copies are removed through rotation within [up to 30 days]) |
| Compatibility subject data (Phase C) | 1 year from creation, then automatically deleted; also deleted if you delete your account |
| Order and payment records and purchase-time consent records | Retained for [5 years, subject to confirmation by counsel and an accountant] for accounting and tax purposes; after you delete your account, order records are anonymized (direct identifiers such as display name, email, and LINE userId are removed), leaving only the amount, time, and status |
| Consultation requests and correspondence | [3 years after closure, pending confirmation], then deleted or anonymized |
| Notification records | Until account deletion |
| Usage events and traffic data | De-identified and retained for [13 months, pending confirmation]; when you delete your account, the link to your identity is removed |
| Watermark data | Retained with the report; after a PDF is sent to you, this website cannot retrieve your copy |
If a longer retention period is required by law, or there is a dispute or investigation, the information will be retained until the matter is resolved.
6. Your rights and how to exercise them
Under Article 3 of the Personal Data Protection Act, you may:
- inquire about or request access to your personal information;
- request a copy;
- request supplementation or correction;
- request that collection, processing, or use be stopped; and
- request deletion.
How to exercise your rights:
- Delete your account: Sign in and do it yourself at
/me(a second confirmation is required). - Correct birth data: Submit a request at
/me, once per account (birth data is locked after the first chart calculation and cannot be changed by you directly). - Other rights: Email [privacy@domain pending] with the subject “Exercise of personal data rights” and describe your request. To prevent impersonation, this website may ask you to verify your identity by signing in to your account or answering a verification question.
- Response times: This website will respond to requests for inquiry, access, or a copy within 15 days. It will respond to requests for supplementation, correction, stopping use, or deletion within 30 days. When necessary, either period may be extended by up to 15 or 30 days, respectively, and you will be told the reason. [Please have counsel confirm this under Article 13 of the Personal Data Protection Act.]
- Fees: No fee is charged in principle. If requests are frequent or require substantial work, this website may charge legally permitted necessary costs after notifying you in advance.
Limitations:
- Anonymized order information retained as required by law will not be deleted.
- If you ask this website to stop using your birth data, it will no longer be able to provide reports.
- This website cannot delete a PDF that has already been sent and is in your possession.
You may also withdraw marketing consent at any time (see Section 8). Withdrawal does not affect the lawfulness of services already provided.
7. Data security
- Birth data fields are encrypted at the application layer before being written to the database. Data is transmitted over HTTPS (TLS).
- Row-level security (RLS) is enabled in the database. Only the account holder and necessary administrators of this website can access the data; administrator permissions are minimized.
- Signatures on all payment notifications (webhooks) are verified to prevent forgery.
- This website does not store credit card numbers.
- This website does not use AI or any other language model to generate report content and does not provide your data to AI services.
- If personal information is breached, this website will notify affected people as required by law and explain the measures taken.
No online service can guarantee absolute security. Please also protect your LINE account and avoid staying signed in on public devices.
8. Marketing messages
- “Service notifications” sent by LINE or email (unlock confirmations, orders, PDFs, consultation progress, and system notices) are necessary to provide the service and do not require separate consent.
- Marketing messages (for example, up to 2 reminders about report highlights for people who have not unlocked a report, and promotional offers in later phases) are sent only if you separately check the consent box when you sign in.
- Every marketing message includes an unsubscribe method. You can also turn it off in
/meor block the official LINE account. After you unsubscribe, this website stops immediately; this does not affect other services. - This website will not send marketing messages after you unsubscribe.
9. Cookies, website usage tracking, and personal analytics
- Necessary cookies are used for sign-in, security, and website preferences.
- When you submit personal information, this website clearly explains website usage tracking and provides an analytics consent option. Agreeing to the Terms or providing birth data does not mean you consent to advertising or marketing.
- If you consent to analytics, this website records page categories, visible section categories, active time in seconds, copy / PDF download preparation / print dialog interactions, and event times. For signed-in members, these records are linked to the website account so necessary administrators can analyze service use and improve the website. Background tabs and long periods of inactivity do not count as active time. These estimates do not prove that you read, understood, or agreed to the content.
- Google Analytics 4 is used to analyze website traffic, events, and time on site. It may use cookies and browser information, and Google may process data outside Taiwan. This website does not send your name, email, LINE ID, birth data, charts, report text, scores, website account ID, or private report URL to Google; it sends only general page and section categories.
- Analytics is off by default, and declining it does not affect report services. You may consent or withdraw consent in “Analytics and Marketing Settings.” For members, consent version and time are recorded; a visitor’s choice is stored only in that browser. After withdrawal, further tracking stops.
- This website retains personal time-on-page events for no more than 13 months and deletes them when you delete your account. GA4 data retention is set by the website operator in GA4; the live configuration for this version uses the shortest period necessary as a principle.
- LINE and email marketing each require separate consent. Potential recipients are identified only from general interest in services viewed (such as annual reports, personality tests, calendars, or compatibility readings), not from health, relationship, or financial conclusions in reports or from birth data. After you unsubscribe or block LINE, you are no longer included as a marketing recipient for that channel.
- This version does not enable Google Ads personalization, Google Signals, or advertising data consent. If advertising purposes are added later, this website must give separate, clear notice and obtain the corresponding consent.
10. Minors
This website is intended for people aged 18 or older. A person under 18 needs consent from a legal representative (parent or guardian) to register and purchase. If a legal representative discovers that a child provided information without consent, please contact this website. We will help with access and deletion requests.
11. Changes to this Policy
This website may revise this Policy. For changes that materially affect your rights, it will notify you before they take effect by a notice on this website, LINE, or email, and will ask you to confirm again the next time you sign in. Previous versions are retained and available for review.
12. Contact us
Personal data contact: [Name / title, pending completion] Email: [privacy@domain pending] Address: [Pending completion] If you believe this website has mishandled your personal information, you may also contact the competent authority or a consumer service center (1950).
Appendix (for attorney review): Articles 3, 6, 8, 9, 11, 12, 13, 19, 20, and 21 of the Personal Data Protection Act; specific purpose and personal information category codes; and current restrictions on cross-border transfers under Article 21.