Privacy Policy

1. Data Controller

The AstralRead website (astralread.com) and service (the "Service") is operated by Viktor Balakirev, an individual (natural person) and tax resident of Montenegro ("we", "us"). The operator is the data controller for personal data collected through the Service within the meaning of the EU General Data Protection Regulation (GDPR) and the Montenegrin Law on Personal Data Protection.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use the Service.

2. Information We Collect

We collect the following categories of personal data:

• Account Information: Email address, display name, and password (stored as a bcrypt hash). If you sign in with Google, we additionally receive your Google account email, name, and profile picture URL via Google OAuth.
• Birth Data: Date of birth, time of birth, and city of birth — required to compute your natal chart.
• Chat History: Messages exchanged with our AI consultation system, stored to maintain conversation context and improve your experience.
• Billing Information: If you subscribe to a paid plan, the payment provider you choose (Lemon Squeezy, our Merchant of Record; lava.top; or NOWPayments for cryptocurrency — see Section 5) collects your payment details itself. We receive only subscription status and non-sensitive transaction metadata (subscription or order ID, plan code, amount, date) — never your full card details.
• Usage Data: Basic analytics such as page views, session duration, feature usage, and server logs (IP address, user agent, request timestamps) for security and service improvement. Page views are also reported to Meta through the Meta Pixel and to Google through Google Analytics (Section 13).
• Data we don't collect on purpose: the service does not ask for health, religious or political data. If you mention such things in a question, they are used only to answer that question; it's better to leave such details out. Consent to data processing is a separate document: astralread.com/en/consent.
• Sign-in and messaging data: if you sign in with Telegram, your Telegram ID, name, username and profile picture; if you write to our Instagram account, your messages there and your Instagram user ID.

3. How We Use Your Information

• To compute and display your natal chart and astrological interpretations.
• To provide personalised AI-powered astrological and psychological consultations.
• To authenticate you and secure your account.
• To send transactional emails (account verification, password resets, subscription receipts) via Resend.
• To process payments and manage subscriptions through our payment providers (Section 5).
• To maintain, improve, and monitor the quality and security of the Service.
• To respond to your inquiries and provide customer support.
• To comply with legal and tax obligations.

4. Legal Basis for Processing (GDPR Art. 6)

Under the GDPR, we process your personal data only when we have a lawful basis:

• Performance of a contract (Art. 6(1)(b)): account creation, delivery of the Service, processing of subscriptions, and customer support.
• Compliance with a legal obligation (Art. 6(1)(c)): retention of billing and tax records, responding to lawful requests from public authorities.
• Legitimate interests (Art. 6(1)(f)): security monitoring, fraud prevention, aggregated usage analytics to improve the Service, server log retention. We balance these interests against your rights and freedoms and only use such data to the extent strictly necessary.
• Consent (Art. 6(1)(a)): where you have given us specific consent (for example, by choosing to sign in with Google, which transfers your Google profile to us). For minors in the cases listed in Section 14, consent is given by a parent or legal guardian.

5. Third-Party Services and Data Processors

We share personal data only with the service providers below, and only what each one needs. Most of them act as data processors on our instructions; the payment providers, Google, Telegram and Meta also process data as independent controllers under their own privacy policies.

AI answers — your question, the relevant chart data (positions, aspects, transits) and recent messages of the conversation are sent to generate the answer. Your email and password are never sent.

• OpenRouter, Inc. — USA: our main AI gateway. Most answers, including the first natal reading, are written by open models (currently DeepSeek and Qwen) that OpenRouter runs on inference hosts it selects. Our preferred hosts include DeepInfra and Novita AI; if they are unavailable, other hosts may answer, including hosts outside the US and the EU (for example, Baidu in China).
• Anthropic, PBC (Claude API) — USA: writes answers for the paid Claude add-on and serves as a backup when the main models are unavailable. Anthropic does not use API inputs to train its models by default.
• Fireworks AI and Groq — USA: emergency backup AI providers, used only if they are configured and the providers above fail.

Payments — each provider collects your payment details itself; we receive only the subscription status and transaction metadata (ID, plan, amount, date), never full card details.

• Lemon Squeezy, Inc. — USA: our Merchant of Record for card payments; responsible for invoices, taxes, refunds and chargebacks (lemonsqueezy.com/privacy).
• lava.top: card payments in RUB, USD and EUR, when offered on the pricing page. We pass your email to create the invoice.
• NOWPayments: cryptocurrency payments. We pass the order ID and amount; we do not receive your wallet's private data.

Sign-in, messages and infrastructure

• Google LLC — USA: if you sign in with Google, we receive your Google email, name and profile picture via OAuth.
• Yandex ID (Yandex LLC) and VK ID (VK LLC) — Russia: if you sign in with them, we receive your user ID, name and email (if you allow it). Users in Russia sign in only with these services or by email.
• Google Analytics 4 (Google Ireland Limited / Google LLC) — Ireland / USA: aggregate statistics of site visits (Section 13).
• Telegram (Telegram Messenger Inc.): if you sign in with Telegram, we receive your Telegram ID, name, username and profile picture from the Telegram Login Widget; we may send you account notices (for example, that a plan has ended) through our Telegram bot.
• Meta Platforms (Instagram) — USA / Ireland: if you write to our Instagram account, Instagram delivers your messages (for example, your birth data) to our bot, and our replies go back through Instagram. The Meta Pixel on the website is described in Section 13.
• Resend — USA: transactional emails. Only your email address and the content of the specific message are shared.
• Cloudflare, Inc. — USA: CDN, DNS, protection against attacks and email routing. Cloudflare processes standard web request metadata (IP addresses, request headers) and routes inbound emails for the astralread.com domain.
• Contabo GmbH — Germany: hosts our servers and the database (Section 7).
• Photon geocoder (komoot, OpenStreetMap data) — Germany: when you type a birth city, only the place name is sent to find its coordinates; the time zone is worked out on our server.
• Push notifications: if you allow them, your browser's push service (for example, Google, Mozilla or Apple) delivers our notifications; we store only the push subscription your browser gives us.
• Voice input: the microphone button uses your browser's built-in speech recognition. Depending on the browser, your voice may be processed by the browser maker (for example, Google in Chrome); we receive only the recognised text.

6. International Data Transfers

Our third-party service providers listed above are primarily located in the United States; some AI inference hosts used through OpenRouter may be located in other countries, including countries outside the EU without an adequacy decision (for example, China). When we transfer your personal data outside the European Economic Area or Montenegro, we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission, which ensure an adequate level of data protection. Copies of the applicable SCCs and data processing agreements are available on request to [email protected].

7. Data Storage and Security

Your data is stored in a PostgreSQL database hosted on secure cloud infrastructure in a European data centre. We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Passwords are hashed with bcrypt and never stored in plain text. All traffic between your browser and our servers is encrypted in transit using TLS 1.2 or higher.

8. Data Sharing

We do not sell, rent, or trade your personal data to third parties. We share data only with the processors listed in Section 5, and only to the extent necessary to provide the Service. We may disclose data when required by law, court order, or to protect our rights, users, or the public.

Shared cards. When you share a fragment of a reading, we publish a card at a unique link: anyone with the link can see it until you delete it in your account. Your birth date, time and place are never included; your name and question only if you left them on.

9. Data Retention

We retain different categories of personal data for different periods, based on the purpose of processing and our legal obligations:

• Account data (email, name, password hash): for the lifetime of your account plus 30 days after account deletion.
• Birth data and natal chart: same as account data.
• Chat history: same as account data; you can delete individual conversations at any time from your account.
• Billing and invoice records: retained for 7 years after the end of the fiscal year, as required by Montenegrin tax and accounting law. Lemon Squeezy separately retains billing records under their own policy.
• Server and security logs: 90 days, then automatically deleted.
• Google Analytics data: 14 months, then deleted by Google automatically.
• Backups: full encrypted backups retained for 30 days on a rolling basis.

You may request deletion of your account and associated personal data at any time by contacting [email protected]. We will delete or anonymise your data within 30 days of receiving your request, except data we are legally required to retain (e.g., billing records).

10. Your Rights Under GDPR

If you are located in the European Economic Area, the United Kingdom, or Montenegro, you have the following rights:

• Right of Access: request a copy of the personal data we hold about you.
• Right to Rectification: request correction of inaccurate or incomplete personal data.
• Right to Erasure ("right to be forgotten"): request deletion of your personal data, subject to legal retention obligations.
• Right to Restriction of Processing: request that we limit how we use your data.
• Right to Data Portability: receive your data in a structured, commonly used, machine-readable format.
• Right to Object: object to processing based on legitimate interests.
• Right to Withdraw Consent: where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing based on consent before withdrawal.
• Right to Lodge a Complaint: see Section 11 below.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days. There is no fee for reasonable requests; we may charge a reasonable fee or refuse manifestly unfounded or excessive requests, as permitted by GDPR Art. 12(5).

11. Supervisory Authority and Complaints

You have the right to lodge a complaint with a data-protection supervisory authority if you believe we have violated your privacy rights.

• Montenegro: Agency for Personal Data Protection (Agencija za zaštitu ličnih podataka i pristup informacijama) — azlp.me
• EU residents: your national data-protection authority. A list is available at edpb.europa.eu/members
• UK residents: Information Commissioner's Office (ICO) — ico.org.uk

We would appreciate the chance to address your concerns directly before you approach a supervisory authority — please contact us first.

12. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach, in accordance with GDPR Article 33. Where the breach is likely to result in a high risk to you, we will also notify you directly by email, in accordance with GDPR Article 34.

14. Children and Teenagers

• AstralRead is for people aged 13 and over. If you are under 13, please do not use the Service.
• When a parent's consent is needed. If you live in the EU and are under 16 (or under the lower age your country has set, which can be 13, 14 or 15), or you live in Russia and are under 14, we may process your personal data only with the consent of your parent or legal guardian. Please ask them before you create an account.
• What a parent or guardian can do. Write to [email protected] and tell us the email address of the account. You can give or withdraw consent, ask what data we hold, and ask us to delete the account and its data — we delete it within 30 days, as described in Section 9.
• Paid plans are for adults. Users under 18 may buy a paid plan only with the permission of a parent or legal guardian (see our Terms of Service, Sections 4 and 6). The free features do not require a payment.
• If we learn that we hold personal data of a child under 13, or of a younger user whose parent's consent is required but missing, we delete it.

15. AstralRead App in ChatGPT and Claude

The AstralRead app for ChatGPT and the AstralRead connector for Claude (see the app page) work without an account. Here is what happens with your data when you use them:

• What we receive. When you ask for a chart or transits, the assistant sends us the birth date, the birth time (if given), the birth place or its coordinates, and the time zone (if given). For the sky of the day or a knowledge-base search we receive only the date or the topic.
• What we do with it. We use these data only to calculate the result and return it in the same request. We do not store them, do not write them to logs and do not link them to you — the app has no accounts.
• Place search.If you give a place name, only that name (never the date or time) is sent to the Photon geocoding service (photon.komoot.io, run by komoot, OpenStreetMap data) to find its coordinates; the time zone is then worked out on our server. Recent place names may be kept in our server's memory for a short time to answer faster — they are not linked to any person or date and are lost on restart.
• Logs. The app logs only technical events: which tool was used, language, the type of client (ChatGPT, Claude or other), success or error, and how long it took. To prevent abuse, the app counts requests per IP address in memory for a few minutes and does not log IP addresses. Like every request to our website, the request also passes through Cloudflare and our web server, whose standard access logs (IP address, time, address requested — not your birth data) are deleted after 90 days (Section 9).
• Links and cookies. The app sets no cookies and has no trackers. Links to astralread.com in its answers carry a utm_source tag (for example, chatgpt_app or claude) so we can count visits from the app in aggregate.
• Your conversation. The chat itself is processed by OpenAI (ChatGPT) or Anthropic (Claude) under their own privacy policies. We receive only the tool inputs listed above.
• Age and purpose. The app is suitable for users aged 13 and over. It offers astrology for self-reflection and is never medical, psychological, legal or financial advice.

Questions: [email protected].

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Where changes materially affect how we process your data, we will additionally notify you by email. Your continued use of the Service after changes constitutes acceptance of the updated policy.

17. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

• Email: [email protected]
• Contact page: /contact
• Postal: Viktor Balakirev, c/o Aleksandrova Obala 33, Zelenika, 85347 Herceg Novi, Montenegro