Privacy Policy

1. Introduction

AstraTalk Inc. ("we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered spiritual exploration platform ("the Service").

By using AstraTalk, you consent to the practices described in this policy. If you do not agree, please discontinue use of the Service.

2. Information We Collect

2.1 Information You Provide

• Account data: Name, email address, and password when you register.
• Birth data: Date of birth, time of birth, and place of birth — used to generate your Soul Codex, numerology profile, and astrological charts.
• Profile preferences: Spiritual interests, notification settings, and display preferences.
• Payment information: Billing details processed securely by Stripe. We do not store your full credit card number on our servers.
• Conversations: Messages you send to Astra (our AI guide) to provide personalized guidance.

2.2 Information Collected Automatically

• Device & browser data: IP address, browser type, operating system, and device identifiers.
• Usage data: Pages visited, features used, time spent, and interaction patterns via analytics tools (PostHog, Google Analytics).
• Cookies: Session cookies for authentication and analytics cookies for service improvement. See Section 8 for details.

3. How We Use Your Information

We use the information we collect to:

• Generate and deliver your Soul Codex, numerology profiles, and astrological charts.
• Power AI-driven personalized guidance through Astra conversations.
• Process payments and manage your subscription.
• Send transactional emails (account confirmation, password reset, billing receipts).
• Send optional marketing communications (daily guidance, weekly insights) — you can opt out at any time.
• Improve and optimize the Service through analytics and usage patterns.
• Detect and prevent fraud, abuse, and security threats.
• Comply with legal obligations.

4. How We Share Your Information

We do not sell your personal data. We may share information with:

• Service providers: Stripe (payments), Vercel (hosting), PostHog (analytics), and AI model providers — only as needed to operate the Service.
• Legal compliance: When required by law, subpoena, or government request.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to you.

All third-party providers are bound by data processing agreements and are required to protect your data in accordance with applicable law.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data: Retained until you delete your account.
• Birth data & charts: Retained until you delete your account or request deletion.
• Astra conversations: Retained for up to 12 months, then automatically purged unless you request earlier deletion.
• Payment records: Retained as required by tax and financial regulations (typically 7 years).
• Analytics data: Aggregated and anonymized after 26 months.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion:Request deletion of your data ("right to be forgotten").
• Export: Download your Soul Codex and profile data in a portable format.
• Restriction: Request that we limit processing of your data.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Withdraw consent for marketing communications at any time.

To exercise any of these rights, contact us at privacy@astratalk.com. We will respond within 30 days.

7. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption in transit (TLS 1.3) and at rest.
• Bcrypt password hashing with salt rounds.
• HTTP-only, secure session cookies.
• Rate limiting on authentication endpoints.
• Regular security audits and dependency updates.

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Cookies & Tracking

We use the following types of cookies:

• Essential cookies: Required for authentication and core functionality. Cannot be disabled.
• Analytics cookies: Help us understand how you use the Service (PostHog, Google Analytics). You can opt out via your browser settings or our cookie preferences.
• Marketing cookies: Used for retargeting and conversion tracking (Google Tag Manager). You can opt out at any time.

9. Children's Privacy

AstraTalk is not intended for children under 13. We do not knowingly collect personal data from children under 13. If we learn that we have collected data from a child under 13, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at privacy@astratalk.com.

10. International Transfers

Your data may be transferred to and processed in the United States and other countries where our service providers operate. We ensure appropriate safeguards are in place, including Standard Contractual Clauses where applicable.

11. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights:

• The right to know what personal data we collect and how it is used.
• The right to request deletion of your personal data.
• The right to opt out of the sale of personal data (we do not sell your data).
• The right to non-discrimination for exercising your privacy rights.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 14 days before taking effect. The "Last updated" date at the top reflects the most recent revision.

13. Contact Us

For privacy-related questions or to exercise your rights, contact us at:

• Email: privacy@astratalk.com
• AstraTalk Inc.
• Wilmington, Delaware, United States