Privacy Policy

1. Data Controller & Contact

The data controller is KDMT, LLC. For any privacy-related inquiry, including exercise of your rights, write to privacy@astrocodex.ai.

2. Personal Data We Collect

• Account data: email address, hashed password, Google OAuth identifier, Telegram login identifier, profile display name, language preference.
• Astrological input: date, time and place of birth, gender (optional), subjective questions you submit to the AI.
• Derived data: computed natal chart (planetary positions, houses, aspects), AI-generated interpretations, archetype/rating results.
• Chat history: conversations with the AI assistant and Telegram Bot, including timestamps and token usage.
• Payment metadata: plan, amount, currency, transaction identifier, status. We do not receive or store full card numbers — these are handled by the payment processor.
• Technical data: IP address, user-agent, device type, approximate geolocation derived from IP, referrer, session identifiers, error logs.
• Cookies & analytics identifiers: as described in our Cookie Policy.

3. Purposes & Legal Bases

• Provide the Service (account creation, natal chart calculation, AI interpretation) — performance of a contract (GDPR Art. 6(1)(b)).
• Process payments, issue fiscal receipts, prevent fraud — contract performance and legal obligation (GDPR Art. 6(1)(b)(c)).
• Service security, abuse prevention, system integrity — legitimate interest (GDPR Art. 6(1)(f)).
• Analytics, product improvement — consent where required (GDPR Art. 6(1)(a)), otherwise legitimate interest.
• Marketing communications — only with your explicit opt-in (GDPR Art. 6(1)(a)), withdrawable at any time.
• Compliance with legal requests — legal obligation (GDPR Art. 6(1)(c)).

4. Payment Processors

We do not store payment card data ourselves. Transactions are processed by the following processors acting as independent controllers for fraud-prevention and fiscal purposes:

• Stripe, Inc. — card and wallet payments (USA).
• Paddle.com Market Ltd — Merchant of Record for historical international purchases.
• Telegram Stars (Telegram FZ-LLC) — in-Telegram purchases.

5. AI Sub-processors

To produce astrological interpretations and chat responses we transmit prompts (including your birth data and questions) to the following AI providers acting as sub-processors under data-processing agreements:

• OpenAI, L.L.C. (USA)
• Anthropic, PBC (USA)
• Google LLC — Gemini API (USA)
• DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.)
• OpenRouter, Inc. (USA) — model routing aggregator
• Groq, Inc. (USA)
• YandexGPT (Yandex LLC)
• GigaChat (Sberbank of Russia PJSC)
• Cloudflare, Inc. (USA) — Workers AI, used for AI image generation (horoscope covers, astro portraits)

We require sub-processors not to use your data for training their foundation models. Where a provider offers such controls, we use the zero-retention / no-training API tier.

In addition to AI providers, the following service providers process limited data on our behalf as part of operating the Service:

• Cloudflare, Inc. (USA) — CDN, edge hosting, DDoS protection and object storage; processes all Service traffic as infrastructure.
• Resend, Inc. (USA) — delivery of transactional and (with your consent) marketing emails.
• Google LLC (USA) — Google Analytics 4 (loaded only after you grant analytics consent) and Google Fonts CDN (your browser requests font files from Google servers, which see your IP address and browser data).
• Paddle.com Market Ltd / ProfitWell — the Paddle checkout library, when active, also loads Paddle's ProfitWell (Retain) billing-analytics component.
• Telegram FZ-LLC — the Telegram WebApp script enabling the in-Telegram version of the Service.
• OpenStreetMap / Nominatim — birthplace geocoding. Queries are proxied through our backend, so your IP address is not exposed to OSM; only the place-name search string is transmitted.
• Flagpedia (flagcdn.com) — static country-flag images in the language switcher (a standard web request exposing IP address and browser data).

Connected AI assistants.

You can connect an AI assistant such as ChatGPT or Claude to your account, by signing in with OAuth or with an API key you create. The assistant can then read your saved charts and their calculations, create or edit a chart when you ask it to, and calculate transits, annual charts and compatibility. It receives only the data it requests while you use it; the company that provides the assistant processes that data under its own privacy policy.

For each request we record which tool was used, the result status, the time and the response time, to apply your plan’s limits and to help you if something goes wrong. We do not receive or store your conversation with the assistant. You can disconnect an assistant or delete an API key at any time in your profile.

6. Data Retention

• Account data — for the lifetime of your account, plus 90 days after deletion for backup rotation.
• Chat history — up to 24 months, or until you delete it from your account.
• Payment records — 5 years (tax and accounting law).
• Server and security logs — up to 12 months.
• Log of requests from connected AI assistants and API keys (tool, status, time) — up to 13 months.
• Analytics identifiers — up to 14 months (see Cookie Policy).

7. Your Rights

Depending on your jurisdiction you may have the right to: access, rectification, erasure (“right to be forgotten”), restriction, objection, data portability, withdrawal of consent, and the right to lodge a complaint with a supervisory authority. Users in California may exercise CCPA rights (know, delete, correct, opt-out of “sale/share” — we do not sell personal data).

To exercise any right, email privacy@astrocodex.ai. We respond within 30 days.

8. Children

The Service is not directed to children under 16. We do not knowingly collect personal data from minors under this age. If you believe a child has provided us data, contact privacy@astrocodex.ai and we will delete it promptly.

9. Security

We apply industry-standard technical and organisational measures including TLS 1.2+ in transit, encryption at rest, hashed passwords (bcrypt/argon2), role-based access, audit logs, DDoS protection and regular backups. No online service can guarantee absolute security; you are responsible for keeping your credentials confidential.

10. International Data Transfers

Our servers and sub-processors may be located outside your country of residence, including in the United States and the European Economic Area. Where required we rely on Standard Contractual Clauses (EU) or equivalent safeguards to protect your data during cross-border transfers.

11. Cookies

We use strictly necessary cookies and, subject to your consent where required, analytics cookies. Full details, cookie names, providers and retention periods are given in our Cookie Policy.

12. Changes to This Policy

We may update this Privacy Policy. Material changes will be announced via email or an in-app notice at least 14 days before taking effect. The “Last Updated” date at the top always reflects the current version.

13. Complaints

If you believe we have mishandled your personal data, first contact privacy@astrocodex.ai. You may also lodge a complaint with your local data-protection authority (e.g. the Irish Data Protection Commission for EU/EEA users, the ICO in the United Kingdom, or the California Privacy Protection Agency in California).