Privacy notice

Who is the controller

The controller of your personal data is Athene Holdings OÜ, registry code 14493325, Estonia.

Privacy questions go to support@astrowheel.app. No data protection officer is appointed, so requests are handled by the operator directly.

What is collected, and why

Account name and email address, to identify you and to contact you about the service (performance of the contract).

If you sign in with Google, the name, email address and account identifier that Google asserts for you. The identifier is stored so that the same Google account reaches the same workspace next time (performance of the contract). Google learns that you signed in to Astro Wheel; nothing else about your use of the service reaches Google.

Authentication and session records, to keep accounts secure (legitimate interest). Your password is stored only as a hash and cannot be read back.

Whether you accepted the Terms and the Privacy Notice, which version, and when (legal obligation, and proof of the contract).

Charts you save, and your interface preferences, so the product works as you left it (performance of the contract).

Payment records, held by Stripe, to take payment and meet accounting law (contract and legal obligation).

Your approximate location, worked out from your IP address, so that the chart shown on the page is cast for roughly where you are rather than somewhere else (legitimate interest). The lookup runs on our own server against a database file we hold: your address is never sent to a geolocation service, and the answer is a country, never a street and never a name. IP Geolocation by DB-IP (https://db-ip.com).

Birth data

A chart is calculated from a date, a time and a place of birth. That combination is personal data, and for your own chart it is data about you.

It is held to draw the charts you asked for, and for nothing else. It is not used to profile you, is not sold, is not shared with advertisers, and is not used to make any automated decision about you.

Charts you create for other people are held in your workspace on the same basis, and you are responsible for having a lawful basis to hold another living person's birth details. The Terms say the same under acceptable use.

When you look a birthplace up by name, that place name is sent to the OpenStreetMap Nominatim service to get coordinates. The date and time of birth are never sent with it, and the lookup carries nothing that identifies you or whose chart it is.

Deleting a chart deletes its birth data. Deleting the account deletes all of it. Ask at support@astrowheel.app and it is done for you.

Processors

Stripe Payments Europe processes payments and holds card data. Astro Wheel receives only the status of a payment and the last four digits.

Resend delivers transactional email and processes the address it is sent to.

Google provides the optional sign in with Google. It acts as an independent controller for your Google account under its own privacy policy, and Astro Wheel receives only what is listed above.

The OpenStreetMap Foundation operates the Nominatim place lookup described above, and receives the place names searched for.

The application itself runs on a virtual private server rented by Athene Holdings OÜ and located in the European Union. Its database is not shared with any other service this company runs.

Processors act on documented instructions under Article 28 agreements.

How long it is kept

Account data, saved charts and their birth data are deleted when the account is deleted, which happens when you ask for it.

Payment and invoice records are kept for seven years, as Estonian accounting law requires. This is the one exception to the sentence above, and deleting the account does not remove them.

Session and security logs are kept only as long as they are needed to investigate abuse.

Your rights

You may request access to your data, correction of it, erasure, a portable copy, restriction of processing, and you may object to processing based on legitimate interest.

Erasure and a change of email address are both done by asking. Deletion is carried out by hand so that it can be confirmed with you first, and a new address has to be verified before it can be used to sign in. You are sent a confirmation once an account has been deleted.

Write to support@astrowheel.app and the request is answered within one month.

Cookies and browser storage

Necessary. Astro Wheel sets a session cookie, which keeps you signed in for two days, or for thirty days if you ask to stay signed in. Signing out ends it earlier. Your theme, layout and chart preferences are saved to your account so that the workspace is the same on every device, and a copy is kept in the browser so that it opens without waiting. Neither can be switched off, because without them there is no sign-in and no saved workspace. Neither is used to recognise you on any other site.

Your answer about cookies. The choice you make in the banner is itself kept in a cookie, which records which version of the question you were asked, whether you accepted, and the date. It is necessary in the same way the others are: without it there is nothing to honour your answer with, and you would be asked again on every page. Closing the banner instead of answering it is remembered only until you close the browser.

Analytics. Nothing beyond the necessary is collected today, and no advertising or cross-site tracking cookie is set. Measuring which parts of the application help and which do not is the ordinary next step for a product this size, so the question is asked before rather than after: the banner offers Accept and Reject as two choices of equal weight, and analytics stay off unless you accept. Closing the banner is not consent, and neither is carrying on using the site. If a tool is ever introduced it is named here first, and the question is put again whenever what would be collected changes.

Changing your mind. Cookie settings, at the foot of the site, reopens the banner with your current answer shown, and either button replaces it. Withdrawing is as easy as giving.

International transfers

Data is processed inside the European Economic Area wherever possible. Where a processor transfers data outside it, the transfer relies on the European Commission's standard contractual clauses.

Complaints

You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, Tallinn, or to the supervisory authority of your own country.

Changes to this notice

Changes are published on this page with a new date at the top, and material changes are emailed to the address on your account.