Privacy Policy
Effective Date: July 14, 2026
Last Updated: July 18, 2026
1. Data We Collect
When you generate a free chart or purchase a Dossier, we process:
- Email address (required — for report delivery)
- Birth data (name / date / time / location, provided by you)
- Payment and consent metadata (transaction ID, amount, timestamp, age-of-majority confirmation, and accepted policy versions — processed with Creem payment data; we do not store card details)
- Server logs (IP, request path, timestamps — for security and rate-limit purposes; automatically purged after 30 days)
- Aggregate usage events (page path and anonymous funnel events such as chart completion or checkout start — no email or birth data)
2. How We Use Your Data
Your data is used exclusively to generate, deliver, and support your personalized Dossier. Specifically:
- Birth data → AI analysis engine → PDF Dossier generation
- Email → transactional delivery of a private download link
- Payment metadata → order fulfillment, refund handling, chargebacks
We do not use your data for marketing, advertising, profiling, or resale.
3. Third-Party Processors
To operate the service, we share necessary data with the following service providers only for the purposes described below. Their security and privacy commitments are governed by their respective terms, data-processing terms, and published compliance documentation:
| Processor | Purpose | Data |
|---|---|---|
| Creem | Payment processing | Email, name, card (via Creem, PCI-DSS) |
| Supabase | Order database (Postgres) | Email, order status, delivery metadata |
| Upstash Redis | Task queue | Email, birth data (transient, TTL 1h) |
| Open-Meteo | Birthplace geocoding and timezone resolution | City / region and country query only |
| DeepSeek | AI analysis engine | Birth data (input), AI output (returned to us) |
| Resend | Transactional email delivery | Email address, time-limited AstroZen download link |
| Vercel | Web hosting, serverless functions, cookieless analytics | Server logs and aggregate usage events; no email or birth data |
| Cloudflare | DNS, CDN, DDoS protection | Request IP and standard network-security metadata |
We do not share data with advertisers or data brokers. We do not use Google Analytics, Meta Pixel, cross-site advertising trackers, or behavioral profiles. Vercel Web Analytics is cookieless, and AstroZen sends it no email address or birth data.
4. Data Retention
- Generated PDF: stored in a private Supabase Storage bucket for up to 7 days so you can download it from the success page or the secure link sent by email, then permanently deleted.
- Generated Markdown source: deleted from the Worker immediately after the PDF has been securely uploaded.
- Order records (email, transaction ID, delivery status, and checkout consent record): retained up to 24 months for tax, accounting, refund, dispute, and compliance purposes, then anonymized.
- Birth data: stored server-side while checkout is pending and while the Dossier is being generated, for no longer than the 7-day secure access window. It is removed from the order and task queue immediately after the PDF has been successfully uploaded, or when an abandoned checkout expires. DeepSeek receives the data required to generate the report according to its API data-processing terms.
- Download tokens: stored only as keyed hashes. Both success-page and email-download access expire after 7 days and are immediately revoked after a confirmed refund or payment restriction.
- Server logs: 30 days rolling.
5. Your Rights (GDPR / CCPA)
You have the right to:
- Request a copy of your data (Right to Access)
- Correct inaccurate data (Right to Rectification)
- Delete your data (Right to Erasure)
- Withdraw consent (Right to Restrict Processing)
- Object to processing or request data portability
To exercise any right, email support@astrozen.co from the address associated with your order. We respond within 30 days.
6. Security
Data in transit is encrypted using HTTPS/TLS. At rest, order records are stored on Supabase Postgres with Row Level Security policies limiting access to authenticated internal roles. Payment card data is handled entirely by Creem (PCI-DSS Level 1) and never touches our infrastructure.
7. Cookies & Tracking
AstroZen uses essential first-party browser storage to preserve secure order access between page navigations. We also use cookieless Vercel Web Analytics for aggregate page and funnel measurement. We do not use advertising cookies, cross-site tracking, or analytics events containing your email address or birth data.
8. Children
AstroZen is not intended for children under 18. We do not knowingly collect data from minors. If you believe we have inadvertently collected such data, contact us for immediate deletion.
9. Changes to This Policy
We may update this policy from time to time. Material changes will be reflected in the “Last Updated” date above. Continued use of AstroZen after changes constitutes acceptance.
10. Contact
Privacy Contact: support@astrozen.co