Last updated: 23 September 2026

This Privacy Policy explains how Trifrons AG processes personal data when you use Trifrons and Qybala services. These include trifrons.com, qybala.com, the Qybala iOS app, products, private readings, the newsletter, and deck-code redemption.

Controller

The controller is Trifrons AG, Schindlerstrasse 5, 8006 Zürich, Switzerland (UID CHE-410.259.493). For privacy requests, contact privacy@trifrons.com.

Websites and consent management

Delivery and security

When you visit our websites, our hosting infrastructure processes technical information such as your IP address, browser and device information, pages requested, and the date and time. This is necessary to deliver, secure, and troubleshoot the websites. The legal basis is our legitimate interest in providing a secure and reliable service.

Cookiebot

Qybala uses Cookiebot by Usercentrics to display and store your consent choices. Cookiebot is loaded as a necessary service before you make a choice. It may process technical request data and store a necessary consent cookie. We rely on our legal obligations and legitimate interest in recording and respecting your choices.

Google Analytics

Qybala uses Google Analytics 4 only if you allow statistics cookies. Before that consent, the Google Analytics tag is not loaded and no analytics data is sent to Google. After consent, Google may process pages viewed, interactions, referrer information, approximate location, and browser and device information. The legal basis is your consent, which you can withdraw at any time through Cookie settings.

YouTube, MailerLite, and Shopify

  • YouTube content loads only after you allow marketing cookies. Until then, Qybala displays a local placeholder.
  • The MailerLite signup form loads only when you expressly choose to load it in the newsletter dialog. We process your email address for the newsletter until you withdraw your subscription consent.
  • Shopify loads only after you initiate a purchase action. Shopify processes information required for product selection, checkout, payment, delivery, and tax. The legal basis is taking steps at your request before a contract and performing the purchase contract.

Fonts used by Qybala are served by Qybala itself. Loading them does not connect your browser to Google Fonts.

Other information we process

Enquiries and deck-code redemption

If you contact us, we process the information you provide to respond. If you redeem a deck code, the code and email address are sent to a Trifrons-operated server to verify and administer redemption. The legal bases are steps before a contract, contract performance, and our legitimate interest in preventing misuse.

Orders, readings, and the app

For orders, Shopify gives us the information required for fulfilment and support, but not your full payment-card details. For private readings, we process contact, scheduling, payment, and session information. We use Google Calendar and Google Meet for scheduling and calls. Where included in the booked reading, AI-assisted transcription, a recording, notes, or photographs of a spread may be created.

The Qybala app does not require a Qybala account. Apple processes App Store payments and RevenueCat manages purchase entitlements. New Relic and UXCam are used for app diagnostics and experience analysis and may process device, usage, crash, and interaction information.

Service providers and international transfers

Depending on the service you use, our providers include:

  • Firebase/Google Cloud for hosting and deck-code redemption;
  • Usercentrics/Cookiebot for consent management;
  • Google Analytics and YouTube after the relevant consent;
  • Shopify for checkout and order administration;
  • MailerLite for newsletter signup and delivery;
  • Google Calendar and Google Meet for readings;
  • Apple and RevenueCat for app purchases; and
  • New Relic and UXCam for app diagnostics and experience analysis.

Some providers process data outside Switzerland or the EEA. Where required, we rely on an adequacy decision, a recognised data privacy framework, standard contractual clauses, or other safeguards permitted by applicable law. You may request information about the safeguard used in a particular case from privacy@trifrons.com.

Retention

  • Consent records are retained as needed to demonstrate consent and for applicable limitation periods.
  • Newsletter data is processed until you unsubscribe; minimal suppression-list data may then be retained to honour that choice.
  • Order and accounting records are kept for statutory periods, generally up to ten years.
  • Website logs are kept only for the short operational period needed, unless a security incident requires longer retention.
  • Other data is deleted or anonymised when its purpose and applicable legal or contractual retention periods end.

Current cookie and similar-technology durations are listed in the Cookie declaration.

Your choices and rights

You can change or withdraw Qybala consent at any time through Cookie settings. Depending on applicable law, you may request access, correction, deletion, restriction, or a copy of your personal data, or object to certain processing. Contact privacy@trifrons.com. You may also complain to the competent data-protection authority.

Changes

We update this policy when our services or applicable law change. The current version and update date will be published here.