Privacy Policy

1. Controller

The controller of personal data processed in connection with the Astrolab service at astrolab.si and its app is Astrolab (hereinafter: the controller). Contact address for data protection matters: info@astrolab.si.

This policy applies to the public pages, the app and the waitlist.

2. Categories of personal data

The controller processes the following categories of personal data:

• account data: email address, name, password (stored exclusively in hashed form) and the chosen language; on sign-in via an external sign-in provider, also the name, email address and profile picture provided by that provider;
• birth data: date, time and place of birth with coordinates and timezone; optionally also gender and current place of residence. Without a birth date a natal chart cannot be computed; without a birth time the chart contains no Ascendant or houses;
• user content: conversations with the Nova assistant, dream interpretations, journal entries, saved people and automatically extracted notes (memories);
• subscription data: the subscription status as reported by the payment service provider; the controller does not receive or store payment card data;
• technical data: strictly necessary session cookies, error reports without IP addresses and anonymised visit statistics without cookies;
• waitlist: email address, language and time of consent; to limit abuse, only a one-way hashed value of the IP address is stored;
• data stored exclusively locally on the user's device (display preferences, mood entries) is not transmitted to the server.

3. Purposes and legal bases of processing

Personal data is processed for the following purposes on the following legal bases under Article 6(1) GDPR:

• performance of a contract (point b): account administration, computing and displaying the natal chart, readings, conversations with the Nova assistant and performance of the subscription;
• consent (point a): the waitlist; any communication beyond what is necessary takes place exclusively on the basis of prior consent. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal;
• legitimate interest (point f): ensuring security, preventing abuse, resolving errors and anonymised operational statistics; this processing may be objected to;
• legal obligation (point c): tax and accounting records relating to payments.

The provision of birth data is a contractual requirement; without it the service cannot be provided.

4. Processing in artificial intelligence services

When the Nova assistant or dream interpretation is used, the message content, name, gender (if provided) and an astrological summary of the user's chart are transmitted to an external artificial intelligence provider to prepare the reply. The language model is executed by established infrastructure providers with servers in the EU and the United States.

This content is transmitted to the named processors exclusively to prepare the reply. The controller does not sell conversations, does not disclose them for advertising purposes and does not use them to train models.

Automatically extracted notes (memories) can be reviewed and individually deleted by the user in settings.

No automated decision-making with legal or similarly significant effects within the meaning of Article 22 GDPR takes place.

5. Recipients of personal data

The database, sign-in, astrological computation and visit statistics run on the controller's own infrastructure and are not disclosed to external recipients. Personal data is disclosed to external recipients exclusively in the following categories, to processors on the basis of concluded data processing agreements:

• payment service provider: payments, invoices and tax records;
• artificial intelligence service providers: preparation of replies, interpretations and readings;
• error monitoring provider (ingest servers in the EU): error reports without IP addresses;
• email delivery provider: confirmation messages for the waitlist;
• external geocoding services: receive exclusively the place name entered, via the controller's server, without the user's IP address or other data;
• external sign-in provider: exclusively where the user chooses to sign in through it; for that processing it acts as an independent controller under its own privacy policy.

The controller does not sell personal data. Data is disclosed to public authorities only where required by applicable law.

More detailed information about individual recipients may be requested at info@astrolab.si.

6. Transfers to third countries

Some recipients (the payment service provider, artificial intelligence service providers, the email delivery provider and, where chosen, the external sign-in provider) process data in the United States. Transfers take place in accordance with Chapter V GDPR on the basis of the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses. A copy of the safeguards used may be requested at info@astrolab.si.

7. Retention period

Account data and user content are retained until the account is deleted. The user may delete any individual conversation, dream interpretation, note or saved person at any time; deletion is immediate.

Upon account deletion in settings, the account, birth data, conversations, dream interpretations, notes and saved people are permanently deleted from the controller's database.

Waitlist email addresses are retained until the launch of the service or until a deletion request. Error reports are automatically deleted by the processor within 90 days at the latest. Payment records are retained by the payment service provider for the periods prescribed by tax and accounting legislation.

8. Rights of the data subject

The data subject has the right to request:

• access to personal data and a copy of it,
• rectification of inaccurate data,
• erasure,
• restriction of processing,
• data portability in a machine-readable form,
• objection to processing based on legitimate interest,
• withdrawal of consent where processing is based on consent.

Rights are exercised in the app settings or by writing to info@astrolab.si. The controller responds without undue delay, at the latest within one month (Article 12(3) GDPR).

The data subject also has the right to lodge a complaint with a data protection supervisory authority.

9. Cookies and local storage

Only cookies strictly necessary for the operation of the service are used (session cookies for sign-in), for which no consent is required under the Slovenian Electronic Communications Act (ZEKom-2). There are no advertising or tracking cookies.

Visit statistics are measured without cookies and without writing to the user's device. Preferences (theme, display language, local entries) are kept in the browser's local storage and are not transmitted to the server.

10. Minors

The service is not intended for persons under 15 years of age (Article 8 ZVOP-2) and their data is not knowingly collected. If the controller establishes that an account was created by a person under 15, the account and the data are deleted.

11. Third-party data

For the compatibility feature the user may enter a third party's birth data exclusively for personal use and with that person's agreement. Upon a justified request of the third party, the controller deletes this data.

A compatibility invite link contains the user's name and birth date, of which the app gives notice at the time of sharing.

12. Security of processing

Connections are encrypted, passwords are stored in hashed form, and database access is restricted so that each account can access exclusively its own data. Requests to the astrology engine are cryptographically signed. Payment card data is processed exclusively by the payment service provider.

In the event of a personal data breach, the controller acts in accordance with Articles 33 and 34 GDPR.

13. Changes to this policy

Changes to the policy are published on this page with an updated date. Users are notified of substantial changes in advance in the app or by email.

14. Contact

Astrolab, info@astrolab.si.