Privacy Policy
For the Astrala website and web application · Updated and effective as of October 2026
This Privacy Policy explains how SIA BC Development, a company registered under number [registration number] with its registered address at Ķekavas nov., Baldones pag., Sūnupes, Pavasara iela 7, LV-2125, Latvia ("we", "us", "our") collects, uses, stores and discloses personal data when you use the website at https://astrala.app, its subdomains and the web application (the "Service"). We have kept it as short as it can honestly be.
BY USING THE SERVICE YOU CONFIRM THAT YOU HAVE READ THIS PRIVACY POLICY AND THAT YOU ARE AT LEAST 18 YEARS OLD.
Questions and requests: support@astrala.app.
1. What we collect and why
| Category | What it includes | Why | Legal basis |
|---|---|---|---|
| Birth details | Date, time and place of birth; name at birth (optional) | To calculate your chart and every reading built on it | Contract |
| Questionnaire answers | Gender, relationship status, what you are looking for, answers to reflective questions, answers about a city you ask about | To decide which parts of your chart the reading focuses on | Contract |
| People you add | Name and birth details of the people you choose to compare with | To calculate compatibility | Contract; you confirm you may share them |
| Contact data | Email address | Account, sign-in links, purchase and legally required billing emails | Contract; legal obligation |
| Purchase data | What you bought, amounts, dates, subscription status, refunds. No card numbers — Stripe handles payment details | To provide access, handle cancellations and refunds | Contract; legal obligation |
| Consent records | The version of the terms you saw, the amounts and date shown, time, IP address and browser | To prove what was disclosed when you started a subscription | Legal obligation; legitimate interest |
| Device and usage data | IP address, country derived from it, device type, operating system, browser, pages and quiz steps viewed, events such as starting checkout | To run, secure and improve the Service and measure which steps people leave | Legitimate interest |
| Advertising data | Parameters in the link you arrived from (utm tags, campaign ids, Meta click id fbclid), Meta cookies _fbp/_fbc, hashed email for purchase events | To know which ads bring customers and to tell Meta about trials and purchases (conversion measurement) | Legitimate interest; consent where required. You can opt out |
| Support messages | Emails you send us | To answer you | Contract; legitimate interest |
We do not collect your precise location, contacts, photos, health data or biometric data. We do not sell your personal data for money. We do not use your birth details or questionnaire answers to target advertising.
2. Cookies and similar technologies
We use a small number of cookies:
| Type | Examples | Purpose |
|---|---|---|
| Essential | Sign-in session, questionnaire session, security | Needed for the Service to work; cannot be switched off |
| Preferences | Motion setting, your time zone, your privacy choice | Remember your settings |
| Attribution | Campaign parameters from the link you arrived from | Know which ad or link brought you |
| Analytics | Microsoft Clarity | Heatmaps and anonymised session recordings to find usability problems. Text you type is masked |
| Advertising | Meta Pixel (_fbp, _fbc) | Measure ad performance and optimise ads |
You can decline analytics and advertising cookies in the banner shown on your first visit, or at any time via "Your Privacy Choices" in the footer. We also honour the Global Privacy Control (GPC) signal from your browser as an opt-out. You can delete cookies in your browser settings; see www.allaboutcookies.org.
3. Who processes your data
We share personal data only with the service providers below, each for its stated purpose, and with authorities when the law requires it.
| Provider | Purpose | Data |
|---|---|---|
| Namecheap, Inc. | Server hosting, domain | All Service data is stored on our server hosted by Namecheap |
| Stripe (Stripe Payments Europe, Ltd.; Stripe, Inc.) | Payment processing: card and wallet payments, fraud prevention, refunds | Email, country, purchase details; card details are held by Stripe, not by us |
| Resend, Inc. | Sending emails | Email address, email content |
| Meta Platforms (Meta Pixel, Conversions API) | Advertising measurement | Advertising data listed in section 1; hashed email with purchase events |
| Microsoft Corporation (Clarity) | Usability analytics | Device and usage data, masked session recordings |
We calculate everything else ourselves: charts, readings and reports are computed on our own server. Country is derived from your IP address using a database stored on our server — your IP is not sent to a third party for that. Each provider’s own privacy policy is available on its website.
4. Where your data is stored and for how long
Your data is stored in the United States. If you access the Service from another country, your data is transferred to and processed in the United States.
We keep your account data for as long as you have an account. When you delete your account in Profile, we delete your account, birth details, people you added, reports and sign-in sessions immediately; backups containing them are overwritten within 14 days. We keep purchase and consent records for as long as tax and consumer law requires (typically up to 7 years), and we keep them separately from your readings. Questionnaire answers from people who never created an account are kept only as long as needed to measure and improve the questionnaire, and you can ask us to delete them at any time.
We protect data with encryption in transit (HTTPS), access restricted to our team, a database that is not reachable from the internet, and regular security updates. No system is completely secure, but we work to keep the risk low.
5. Your rights
Depending on where you live, you have the right to:
- know what personal data we hold about you and get a copy of it;
- correct inaccurate data — birth details can be edited in Profile at any time;
- delete your data — use "Delete account" in Profile, or email us;
- opt out of advertising measurement and analytics — via "Your Privacy Choices" or GPC;
- withdraw any consent you gave, without affecting processing before withdrawal;
- object to or restrict processing based on legitimate interest;
- receive your data in a portable format;
- complain to your data protection authority.
To make a request, email support@astrala.app from the address linked to your account. We answer within 30 days (45 days where a US state law allows). We will not treat you differently for exercising your rights.
6. Age limitation
The Service is for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18, and in line with the Children’s Online Privacy Protection Act (COPPA) we never knowingly collect data from children under 13. If you believe a minor has given us data, email support@astrala.app with "Minor" in the subject and we will delete it.
7. California and other US state privacy rights
If you live in California or another US state with a consumer privacy law, you have the rights described in section 5. In the last 12 months we collected the categories of personal information described in section 1: identifiers (email, IP address, online identifiers), commercial information (purchases), internet activity (interaction with the Service and ads), and inferences (the readings generated from your chart). We did not collect sensitive personal information as defined by California law.
We do not sell personal information for money. Using the Meta Pixel and Conversions API may count as "sharing" for cross-context behavioural advertising under California law. You can opt out at any time using "Your Privacy Choices" in the footer or by enabling Global Privacy Control in your browser. We do not knowingly sell or share personal information of consumers under 16.
Authorised agents may submit requests on your behalf with your signed permission. We will verify requests by confirming control of the email linked to the account. California residents may also request, once a year, information about disclosures for direct marketing ("Shine the Light") at support@astrala.app.
8. Changes to this policy
We may update this Privacy Policy. If a change is material, we will tell you by email or in the Service before it takes effect. The date at the top shows when it was last updated.
9. Contact
Data controller: SIA BC Development, registration number [registration number], Ķekavas nov., Baldones pag., Sūnupes, Pavasara iela 7, LV-2125, Latvia. Email: support@astrala.app.