Legal
Data Processing Addendum
Last updated: August 2026
1. Scope
This DPA applies when AstroVibe processes personal data on your behalf in connection with the Service, and where the GDPR (EU/UK) applies. We act as a processor; you are the controller.
2. Processing activity
Categories of data: birth details (date, time, location — potentially special category data under Article 9), account contact details, and request metadata. The engine processes birth details transiently in memory for computation only and does not store them. Duration of processing: while you use the Service; engine request payloads are not retained after processing.
3. Our obligations
We process personal data only on documented instructions from you, implement appropriate technical measures (encryption in transit, hashed keys, least-privilege access), ensure confidentiality of persons authorised to process the data, assist you with data subject requests where technically feasible, and notify you without undue delay of a personal data breach.
4. Subprocessors
You authorise the subprocessors listed in our subprocessor register (hosting: Cloudflare; payment: the provider active on your checkout). We maintain a dated register available on request and will notify you of changes with an opportunity to object.
5. Transfers
Data may be processed by subprocessors located in the EU, US, and India. Where transfers outside the EEA occur, they are covered by the European Commission's Standard Contractual Clauses or an equivalent recognised transfer mechanism, as applicable.
6. Deletion
On termination, account and order data are deleted within 90 days unless retention is required by law. Engine request payloads are not stored and therefore require no deletion step. This DPA is incorporated into the Terms of Service by reference.