Privacy Policy

Effective Date: July 14, 2026

Last Updated: August 23, 2026

1. Data We Collect

When you generate a free chart or purchase a Dossier, we process:

• Email address (required for paid report delivery)
• Birth data (name / date / time / location, provided by you and processed to calculate the chart)
• Computed chart evidence and precision limits (for a purchased Dossier)
• Payment and consent metadata (transaction ID, amount, timestamp, age-of-majority confirmation, immediate-delivery request, and accepted policy versions; we do not store card details)
• Standard hosting and network metadata (such as IP, request path, and timestamp, handled by our hosting/CDN providers for security, delivery, and rate limiting)
• Aggregate usage counts (page path, safe campaign tags, and funnel events such as chart completion or checkout start — no email, birth data, user ID, or session ID)

2. How We Use Your Data

Personal data is used to calculate, generate, deliver, and support your personalized Dossier. Aggregate usage counts are used to understand whether core product steps work as intended. Specifically:

• Birth details → deterministic calculation engines → computed chart evidence
• Data-minimized computed evidence and precision limits → AI-assisted interpretation → PDF Dossier
• Email → transactional delivery of a private download link
• Payment metadata → order fulfillment, refunds, accounting, and chargebacks
• Aggregate funnel counts without user or session identifiers → product reliability and conversion analysis

We do not use your data for marketing, advertising, profiling, or resale.

AI interpretation notice. Your chart is calculated by deterministic engines before the interpretation step. The AI provider receives data-minimized computed chart evidence and precision limits, not your name, email, or raw birth date, time, or birthplace. These derived inputs and the generated output may still be personal data in context. DeepSeek states that data it directly collects may be processed and stored in the People's Republic of China.

3. Third-Party Providers & Data Roles

To operate the service, necessary data is handled by the following providers for the purposes described below. Waffo Pancake acts as Merchant of Record and contractual reseller for a purchase. Other providers may act as independent or joint controllers, or as processors, depending on the activity and their applicable terms:

We do not share data with advertisers or data brokers. We do not use Google Analytics, Meta Pixel, cross-site advertising trackers, or behavioral profiles. Vercel Web Analytics is cookieless, and AstroZen sends no email address or birth data in analytics events.

4. Data Retention

• Generated PDF: stored in a private Supabase Storage bucket for up to 7 days so you can download it from the success page or the secure link sent by email, then permanently deleted.
• Generated Markdown source: deleted from the Worker immediately after the PDF has been securely uploaded.
• Free chart inputs: processed per calculation request and not deliberately persisted in AstroZen's order database.
• Order records (email, transaction ID, delivery status, and checkout consent record): retained up to 24 months for tax, accounting, refund, dispute, and compliance purposes, then anonymized.
• Computed Dossier context: the order stores data-minimized chart evidence rather than raw birth inputs. This context is removed after the PDF has been successfully uploaded, or when an abandoned checkout expires. DeepSeek receives that data-minimized evidence and the calculation's precision limits, not your name, email, or raw birth date, time, or birthplace.
• Download tokens: stored only as keyed hashes. Both success-page and email-download access expire after 7 days and are immediately revoked after a confirmed refund or payment restriction.
• Hosting/CDN logs: retained by the relevant provider according to its configured settings and published terms. AstroZen does not maintain a separate persistent application log of raw birth inputs.
• Aggregate funnel event counts: retained for up to 24 months for week-over-week product analysis. These counters do not contain user or session identifiers.

5. Your Rights (GDPR / CCPA)

You have the right to:

• Request a copy of your data (Right to Access)
• Correct inaccurate data (Right to Rectification)
• Delete your data (Right to Erasure)
• Withdraw consent (Right to Restrict Processing)
• Object to processing or request data portability

To exercise any right, email support@astrozen.co from the address associated with your order. We respond within 30 days.

6. Security

Data in transit is encrypted using HTTPS/TLS. At rest, order records are stored on Supabase Postgres with Row Level Security policies limiting access to authenticated internal roles. Payment card data is handled by Waffo Pancake and never touches our infrastructure.

7. Cookies & Tracking

AstroZen uses essential first-party browser storage to preserve secure order access between page navigations. We also use cookieless Vercel Web Analytics and first-party daily aggregate counters for page and funnel measurement. The first-party counters do not store a user or session identifier. We do not use advertising cookies, cross-site tracking, or analytics events containing your email address or birth data.

8. Children

AstroZen is intended only for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected such data, contact us for immediate deletion.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected in the “Last Updated” date above. Where required, we will provide additional notice before a material change takes effect. Changes do not retroactively alter the purposes for which previously collected personal data was processed.

10. Contact

Privacy Contact: support@astrozen.co