Privacy policy (GDPR)

1. Data controller

The data controller is astro.day, who can be reached at contact@astro.day for any questions relating to your personal data.

2. Data collected

• Account data: title, first name, last name, email address, password (hashed, never stored in plain text), optional profile photo, language and preferences.
• Birth data: date, time and place of birth (geographic coordinates), for you and for the profiles of relatives that you voluntarily add.
• Solar revolution data: residence location or manually entered location for annual calculation.
• Usage data: personalized dates, questions asked to the coach, reports generated, display parameters.
• Billing data: subscription and purchase history. Banking data is processed exclusively by Stripe and never passes through our servers.
• Technical data: connection logs and information strictly necessary for the security and proper functioning of the service.
• Audience measurement data, with your consent: pages viewed, navigation events, browser and device information, and approximate location derived from the IP address.

Birth data may reveal personal information: it is only used for the astrological calculations you request, never for advertising profiling purposes.

3. Purposes of processing

• Provide the service: calculation of the birth chart, timeline, solar revolution, relationship analyses, ebooks.
• Generate personalized interpretations, including via artificial intelligence models.
• Manage your account, subscriptions and billing.
• Send you, with your consent, the newsletter and summaries by e-mail.
• Ensure the security of the service and comply with our legal obligations.
• Measure traffic and pages viewed, with your consent, in order to improve the service.

4. Legal bases

• Execution of the contract: provision of service functionalities and account management.
• Consent: newsletter, email summaries, adding profiles of loved ones and Google Analytics audience measurement. It can be withdrawn at any time.
• Legal obligation: retention of invoices and accounting data.
• Legitimate interest: security of the service, prevention of fraud and improvement of functionalities.

5. Recipients and subcontractors

Your data is neither sold nor rented. It is only shared with providers necessary to operate the service or, with your consent, to measure its audience:

• Host: data hosting within the European Union.
• Stripe: secure payment processing.
• Suppliers of AI models: the astrological elements necessary for generating analyzes are transmitted to them in a minimized manner; they are not allowed to use them to train their models.
• Email sending service provider: transactional emails (confirmation, password reset) and newsletter if you have consented to this.
• Google Maps: place search, map display and time-zone determination required for the requested calculations.
• Google Ireland Limited, only with your consent through Google Analytics 4: measurement of traffic and pages viewed.

When a service provider is located outside the European Union, the transfer is governed by appropriate guarantees (standard contractual clauses of the European Commission).

6. Shelf life

• Account and birth data: for the entire life of the account, then deletion within a maximum period of 30 days after deletion of the account.
• Generated reports and ebooks: as long as the account is active, to allow you to redownload them.
• Billing data: 10 years, in accordance with legal accounting obligations.
• Technical logs: 12 months maximum.
• Audience measurement choice: 6 months, after which the choice is requested again. Detailed Google Analytics data: 14 months maximum.

7. Cookies and third-party services

The service uses storage strictly necessary for authentication, language preference and remembering your privacy choice. No advertising cookies or advertising profiling trackers are used.

Google Maps is necessary for the service: searching for a place provides the geographic coordinates and time zone without which the requested astrological calculations cannot be performed. When this feature is used, the browser contacts Google directly, which receives the IP address, technical browser and device information, entered search terms, selected coordinates and the date used to determine the time zone. No account data such as a name or email address is sent to Google by astro.day in this context. This processing is based on performance of the requested service and cannot be disabled separately.

With your consent, astro.day uses Google Analytics 4 to measure traffic and improve the service. Google processes pages viewed, navigation events, browser and device information, and approximate location derived from the IP address. Advertising settings and Google Signals are disabled. Addresses containing parameters or fragments are not sent. You can refuse or withdraw your consent at any time using the Privacy preferences link in the footer.

8. Security

We implement appropriate technical and organizational measures: encryption of exchanges (HTTPS), hashed passwords with salt, partitioning of access, regular backups and access logging. In the event of a data breach that may result in a high risk to your rights, you will be informed in accordance with Article 34 of the GDPR.

9. Your rights

In accordance with articles 15 to 22 of the GDPR, you have the following rights:

• Right of access: obtain a copy of your data, upon simple request addressed to contact@astro.day. Your request is processed within one month.
• Right of rectification: correct your data from your account or on request.
• Right to erasure: delete your account and your data from My account → My data.
• Right to portability: receive your data in a structured and machine-readable format, upon request addressed to contact@astro.day.
• Right to limitation and right to object, under the conditions provided for by the GDPR.
• Right to withdraw your consent at any time (newsletter, summaries) from your preferences.

To exercise these rights, write to contact@astro.day. We respond within one month. If you believe that your rights are not respected, you can lodge a complaint with the CNIL (cnil.fr).

10. Third party data (relative profiles)

When you add the profile of a loved one, you guarantee that you have their consent (or that of their legal representatives if they are a minor). Anyone whose data appears in a profile can request its deletion at contact@astro.day.