Privacy Policy

AstroProcessor (astroprocessor.app) is the data controller for the personal data described here. The controller is Alisa Vasilenko, operating as autónomo (sole trader) under the trade name AstroProcessor, with Spanish tax number (NIF) Y9774585J and intra-community VAT number (NIF-IVA) ESY9774585J, at Calle del Concilio de Trento 78, 08018 Barcelona, Spain. For any privacy question or to exercise your rights, contact [email protected].

We are not legally required to appoint a Data Protection Officer and have not done so; you can raise any data-protection matter with us at the contact above.

• Account data — your name, email address, and, if you sign in with Google, the basic profile information Google shares (name, email, avatar). If you register with email/password, we store a securely hashed password, never the password itself.
• Birth and chart data — the birth date, time, and place (and the resulting coordinates and timezone) you enter for yourself or for charts you create, plus any notes you add. This is the data that personalizes your charts, forecasts, and readings.
• Onboarding choices — how you describe your practice (e.g. professional, beginner, curious) and your consent selections.
• Payment data — handled by Stripe. We receive limited billing details (such as plan, status, and the last digits / brand of your card) but never your full card number.
• Usage and device data — basic technical information (such as IP address, browser type, and interactions) needed to operate, secure, and improve the Service. We also keep the approximate country your IP address resolves to and your device’s time zone (for example, Europe/Madrid), which together decide whether the free daily chat credits apply to your account.

Birth date, time, and place are personal data we treat with care, but they are not “special categories” of data under the GDPR and we do not treat them as such. We ask you not to include special-category data — for example, health, beliefs, or sexuality — in notes or AI prompts. If you nonetheless choose to include such information, we treat it as voluntarily provided to deliver the interpretation you have requested, we do not use it for any other purpose, and you can delete it at any time. We do not solicit or invite the entry of special-category data.

• to provide the Service — computing charts, generating AI-assisted interpretations, saving your notes and reports;
• to personalize your experience (your daily sky, sample readings, and chart defaults) based on the birth details you provide;
• to process payments, manage subscriptions, and prevent fraud;
• to communicate with you about your account and, only if you opt in, to send occasional product tips and updates;
• to secure the Service and comply with legal obligations.

• Performance of a contract — to provide the Service you signed up for, including computing your charts from the birth details you enter, generating interpretations and reports, and processing payments. The birth details are necessary to perform this contract, so we do not rely on consent for that core processing.
• Consent — for optional processing only: sending you marketing emails and setting non-essential (analytics or preference) cookies. You can withdraw consent at any time without affecting prior processing.
• Legitimate interests — to keep the Service secure, prevent abuse, and improve the Service using technical and usage data, balanced against your rights.
• Legal obligation — to meet tax, accounting, and other legal requirements.

Some of the data described above is necessary to provide the Service. In particular, the birth date, time, and place are required to compute a chart — without them, the chart, forecast, and reading features cannot function. Account data (such as your email address) is required to create and secure your account. You are not obliged to provide this data, but if you do not, the related features will be unavailable to you. You are responsible for the accuracy of the data you provide; charts and interpretations depend on it, and inaccurate birth details will produce inaccurate results.

You can create charts for people other than yourself — family members, friends, or, if you are a practitioner, your clients. Whenever you enter another person’s birth or other personal data into the Service, you act as the controller of that data under GDPR and we act as your processor. We process it only on your instructions and solely to provide the chart features to you. We never use it for any independent purpose of our own — including improving our Service or training any AI model.

Our Data Processing Terms apply automatically to this processing and form part of your contract with us, regardless of whether your use is professional or personal. They set out the security measures we apply, our sub-processors, how we assist you with data subject rights requests, and the return or deletion of data on termination.

Because you are the controller, you are responsible for:

• having a lawful basis under Article 6 GDPR to enter the data — usually the other person’s consent or permission;
• providing the data subject with the information required by Article 14 GDPR (who is processing their data, why, and what rights they have);
• handling any rights request the data subject makes. If a data subject contacts us directly about data you entered, we will refer them to you and assist you in responding, as required by Article 28(3)(e) GDPR.

Household exemption. Article 2(2)(c) and Recital 18 GDPR exempt processing carried out by a natural person in the course of a purely personal or household activity. That exemption may apply to what you do privately with another person’s chart — for instance, discussing it with them face-to-face. It does not change our role on the platform: when you enter the data into the Service we act as your processor under the terms above. This keeps the responsibilities clear and protects the data subject.

When you request an AI-assisted interpretation or report, relevant chart data is sent to third-party AI model providers to generate the draft text. We send what is needed to produce the output (for example, planetary positions and the question or chart context) and work with providers under contracts that prohibit them from using your data to train their models. AI output is a draft for you to review and edit — see the limits described in our Terms of Service.

You can connect your AstroProcessor account to an AI app you use, such as ChatGPT, Claude, Cursor or Gemini, through our connector at mcp.astroprocessor.app. You choose which app to connect and what it may access when you approve the connection, and you can disconnect it at any time in the app or in Settings → Account → MCP access.

What the app receives. When the app uses one of the connector’s tools, we send it that tool’s result: your chart and the calculations made from it (forecasts, relocations, lunar returns, a synastry with a person you name), sky data such as Moon phases, eclipses and sunrise times, and, when it asks, your plan and credit balance. If you allowed chart access, results include your birth data. The app’s provider processes what it receives under its own terms and privacy policy, as a controller of its own: it is not our processor.

What we receive. The app sends us only what a tool needs, such as a date, a city name, or another person’s birth date, time and place for a synastry. We use it to compute the answer and do not store it, with one exception: if your profile has no birth data and you give your own to the app, the connector saves it to your profile and dashboard. Another person’s birth data sent this way is never saved; while we process it, section 06 applies. We never receive your conversation with the app.

What we keep to run the connection. The app’s registration (its name and the address it returns to), sign-in codes and tokens stored only as cryptographic hashes, and a record of each connector message (which app, when, and the credits it spent), which is part of your credit history.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. The Service personalizes charts and generates interpretations from the data you provide, but this output is informational content for you to review — it is not an automated decision about you within the meaning of Article 22 GDPR.

We do not sell your personal data. We share it with providers who help us run the Service, under appropriate contracts. Most act as our processors, handling data only on our instructions; Stripe acts as an independent controller for the payment and fraud-prevention data it processes, under its own privacy policy and the card-network rules.

• Stripe — payment processing and billing (independent controller).
• Google — optional sign-in, if you choose it.
• AI model providers — to generate interpretations and reports.
• AI apps you connect — the results of the connector’s tools, sent to the app you chose, on your instruction (section 08).
• Hosting and infrastructure providers — to run the application and database, and the ephemeris calculation API.

We may also disclose data where required by law, or to protect our rights, users, or the public.

Some of our providers process data outside the European Economic Area — in particular certain AI model providers and infrastructure providers located in the United States. Where we transfer personal data outside the EEA, we rely on an appropriate safeguard: either the provider’s certification under the EU–US Data Privacy Framework, or the European Commission’s Standard Contractual Clauses together with additional measures where needed. You can ask us for a copy of the safeguards that apply to a particular transfer by emailing [email protected].

We keep different types of data for different periods, set by the purpose for which we hold them:

• Account data (name, email, hashed password) — while your account is active; deleted within 30 days of an account-deletion request.
• Birth and chart data — while your account is active; deleted within 30 days of an account-deletion request, or sooner if you delete individual charts.
• AI prompts and generated outputs — deleted with the chart they belong to, or sooner if you delete the item individually.
• AI app connections — sign-in tokens, stored as hashes, until they expire (one hour for an access token, 30 days for a refresh token, each use of which replaces it) or until you disconnect, which deletes them at once. The hash of a used token is kept until that token would have expired, to detect a stolen one. Connector message records are kept with your credit history.
• Security and usage logs — typically up to 90 days for operational and security purposes.
• Billing, invoicing, and tax records — up to 6 years from the end of the relevant tax year, under the Código de Comercio (Art. 30) and Spanish tax law. After an account-deletion request, these records are held under bloqueo (restricted access, used only for legal compliance and the defence of claims, per Article 32 LOPDGDD) until the retention period ends, and are then deleted.
• Backups — rotated on a regular schedule; data deleted from the live database persists in backups only until the next rotation.
• Inactive accounts — may be deleted after 24 months of inactivity, with prior notice.

Because we process your personal data as a Spanish-established controller, GDPR applies and you have the right to access, correct, delete, or export your data, to restrict or object to certain processing, and to withdraw consent. To exercise any of these, email [email protected]. We will respond to your request within one month, as required by Article 12 GDPR; for complex or numerous requests we may extend this by up to two further months and will let you know if we do. You also have the right to lodge a complaint with your local data protection authority (in Spain, the AEPD).

We use cookies and similar technologies. Strictly necessary cookies keep you signed in and operate the Service securely, and do not require consent. Any analytics or preference cookies are set only after you give consent through our cookie banner, and you can change or withdraw your choice at any time. For the full list of cookies we use, their purpose and duration, see our Cookie Policy.

The Service is not directed to children under 18, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

We use technical and organizational measures — including encryption in transit, hashed passwords, and access controls — to protect your data. No system is perfectly secure, but we work to protect your information and to respond promptly to any incident. If a personal-data breach is likely to result in a risk to your rights, we will notify the AEPD and, where the risk is high, you, in line with Articles 33–34 GDPR.

We may update this policy as the Service evolves. When changes are material, we will take reasonable steps to notify you before they take effect. The “last updated” date above always reflects the current version.

For any privacy question or request, email [email protected].