0. Data Controller

Astrolas (operating the website astrolas.com) is the data controller responsible for processing your personal data. Contact: [email protected].

1. Information We Collect

We collect: (a) information you provide directly - name, email, password (hashed), birth data (date, time, place) for astrology calculations, payment records; (b) information collected automatically - IP address, browser/device, pages viewed, timestamps, referrer.

2. How We Use Your Information

We use your data to: provide chart calculations and interpretations, manage your account, process payments and refunds, send transactional emails (verify email, reset password, purchase confirmations), prevent abuse, comply with legal obligations, and improve the service. Birth data is used solely for chart generation and is never sold or shared for marketing.

3. Cookies

We use cookies to maintain login sessions, remember preferences (theme, language), and collect anonymous analytics. Essential cookies cannot be disabled; analytics cookies require consent (see the cookie banner). Disabling cookies may break some features.

4. Third-Party Services

We share minimum necessary data with:

• Stripe (payments) - card data handled by Stripe, not stored by us. Stripe privacy.
• MailJet (transactional email) - email + name to send verification, password reset, purchase receipts. MailJet privacy.
• Sentry (error monitoring) - anonymized error traces, may include IP and user ID. Sentry privacy.
• Google Analytics 4 (analytics) - anonymized IP, page views, no cross-site tracking. Google privacy.

5. Data Retention

Account and birth data are retained while your account is active. After you delete your account, personal data is permanently removed within 30 days. Payment and transaction records are retained for 5 years to comply with Vietnamese tax law. Anonymized analytics aggregates may be kept indefinitely.

6. International Data Transfer

Some providers store data outside Vietnam (Stripe in the US, MailJet in the EU, Sentry in the US/EU). We rely on these providers' certifications and standard contractual clauses where applicable.

7. Your Rights

You have the right to: access your data, correct inaccuracies, export your data, delete your data, object to processing, and withdraw consent at any time. EU/EEA users additionally have the right to lodge a complaint with their local data protection authority. Exercise these rights from account settings or by emailing [email protected]; we respond within 30 days.

8. Children

Astrolas is not intended for users under 16 (Vietnam and EU) or under 13 (US COPPA). We do not knowingly collect data from minors. If you believe a child has provided data, contact us for deletion.

9. Security

We protect data with HTTPS, bcrypt password hashing, rate limiting, and access controls. No online service is 100% secure; in case of a breach affecting your data, we will notify you within 72 hours where required by law.

10. Changes

We may update this policy. Material changes will be notified via email or a site banner at least 14 days before taking effect.

11. Contact

Privacy questions or data requests: [email protected]