Last updated: October 17, 2026
This policy explains what personal data Astrospot collects, why, who helps us process it, how long we keep it and how you can use your rights. We collect only what we need to give you your readings and run the service, we never sell your data and we do not use advertising or tracking cookies.
1. Who is responsible for your data
The controller of your personal data is SYNAPTIX BUSINESS SOLUTIONS S.R.L., a company registered in Romania (Trade Register number J2026008733005, tax identification code CUI 53856811), with its registered office at Str. Sapientei 1B, Sector 5, Bucharest, Romania. We operate astrospot.net (“Astrospot”, “we”, “us”).
For any question about your data or to use your rights, write to us through our contact page (mention “Privacy” in your message) or by post to the address above. We have not appointed a data protection officer, as the law does not require one for our activity.
2. The data we collect
Your account
Your name (as you want us to address you), your email address and your password. Your password is stored only as a cryptographic hash, so nobody, including us, can read it. If you choose to sign in with Google, Apple or Facebook, where we offer it, that provider sends us a unique account identifier, your email address and your name.
Your birth details
Your birth date, your birth time (only if you know it) and your birthplace: the town or city, its coordinates and its time zone. When a birth time falls on a daylight saving change, we also keep the option you chose. We use these details to calculate your charts and readings.
People you add
For compatibility readings you may add up to 10 people per subscription year: the name you give them and their birth details. Please add only people whose details you are allowed to use, and tell them. When you remove a person, we delete their details and keep only a note that a place was used that year (an identifier and a date), because it counts toward the yearly limit.
Your readings and settings
Your saved choices for the reading (for example the place and year of your solar return), your time zone, so dates and times are shown in your local time, and your email preferences. To make the site fast, we also store the readings we generate for you.
Your consents
What you agreed to (the Terms and Privacy policy, the use of your birth details, marketing emails), when you agreed, the version of the text and where you gave it (for example at sign-up or in your account). We do not store your IP address with these records.
Your orders and subscription
The subscription you bought, the amount, the currency, the country used for pricing, any coupon, the dates of payment and renewal, the status of your subscription, the payment references that Stripe gives us, and the date and version of the Terms you accepted. For customers in the European Union, the EEA and the United Kingdom, we also record your request for immediate access and your acknowledgment about the right of withdrawal (date, time and wording). Your card details are entered directly with Stripe and never reach our servers.
Your messages
When you use the contact form, we receive your name, your email address and your message by email. They are not stored in the website’s database.
Technical data
Like every website, our servers and our network provider receive your IP address, your browser type and the pages you request. We use this information for a short time to deliver the site, to keep it secure, to prevent abuse (for example, too many sign-in attempts) and to choose the right currency at checkout from your country. Our own visit counter does not use cookies and keeps no IP addresses: it records only the daily number of page views and visitors.
A note on sensitive data
We do not ask for health, religious, political or other special categories of personal data, and we do not intend to process them. Birth details are not special category data in themselves. Your readings are built from general astrological texts and do not draw conclusions about your health, beliefs or private life. Please do not send us sensitive information through the contact form unless it is needed for your request.
Waitlist
Until subscriptions open, you can leave your email address on the sign-up or checkout page to hear when they do. We store your email address, the date and time you joined, the version of the consent text you agreed to, the page you used and the country your connection comes from (so we know whether to quote US dollars or euros). We do not store your name or your IP address with it. We use it for one thing only: to send you one email when subscriptions open. The legal basis is your consent (Article 6(1)(a) GDPR). We delete the whole list once the opening announcement has been sent, or sooner if you ask. You can withdraw your consent at any time with the one-click unsubscribe link in that email or by writing to us through the contact page; this does not affect anything done before you withdrew it.
3. Why we use your data and on what legal basis
Under the General Data Protection Regulation (GDPR), we may use personal data only when we have a legal basis. Here is what we do and why:
| What we do | Legal basis |
|---|---|
| Create and manage your account, sign you in, keep your account secure and send you account emails (confirmation, password, changes). | Contract (Article 6(1)(b) GDPR) |
| Calculate your charts, your reading, the tools and your sky today from your birth details. At sign-up we also ask you to confirm that you agree to this use of your birth details; you can end it at any time by deleting your account. | Contract (Article 6(1)(b)) |
| Calculate compatibility with the people you add. | Legitimate interest in providing the compatibility readings you ask for (Article 6(1)(f)) |
| Take payments, manage your subscription, send receipts, renewal reminders and notices about failed payments, and send the weekly transits email included in your subscription. | Contract (Article 6(1)(b)) |
| Show prices in the right currency and apply the consumer rules of your country, using the country detected from your connection. | Legitimate interest and legal obligation (Article 6(1)(f) and (c)) |
| Send news, horoscopes, offers, a birthday email and a reminder about an unfinished order. | Your consent (Article 6(1)(a)); for existing customers, offers similar to what you bought, with an easy opt-out in every email |
| Keep accounting records and invoices, and meet tax and consumer protection obligations. | Legal obligation (Article 6(1)(c)) |
| Protect the site and our users: prevent fraud, spam, bots and abuse, limit repeated attempts and investigate incidents. | Legitimate interest (Article 6(1)(f)) |
| Count visits (anonymous daily totals) and understand how the service is used, with server-side figures only. | Legitimate interest (Article 6(1)(f)) |
| Answer your messages and requests. | Legitimate interest, or contract if you are a customer |
| Keep proof of consents, of accepted Terms and of withdrawal acknowledgments, and establish or defend legal claims. | Legitimate interest and legal obligation (Article 6(1)(f) and (c)) |
Where we rely on legitimate interest, we have weighed it against your rights, and you can object at any time (see section 7). Where we rely on consent, you can withdraw it at any time, without affecting what we did before.
Your readings are produced automatically, but we do not make decisions about you that have legal or similarly significant effects based solely on automated processing, and we do not profile you for advertising.
4. Who we share your data with
We do not sell or rent your personal data, and we do not share it for advertising. We share it only with the service providers we need, and only as much as they need:
- Stripe (Stripe Payments Europe, Limited, Ireland, and its affiliate Stripe, Inc., United States) processes payments and helps prevent fraud. For some activities, such as fraud prevention and meeting its own legal obligations, Stripe acts as an independent controller under its own privacy policy, available at stripe.com/privacy.
- Cloudflare (Cloudflare, Inc., United States) delivers the site through its network, protects it against attacks and bots, and tells us the country of each visit so we can show the right currency.
- Our hosting provider, Vultr (The Constant Company, LLC, United States), from which we rent the virtual server that runs the website and its database.
- An email delivery provider that sends our emails on our behalf (account emails, receipts, reminders and, if you agreed, newsletters).
- Google, Apple or Meta (Facebook), only if you choose to sign in with one of them. They handle your sign-in under their own privacy policies.
- Professional advisers, such as our accountants and lawyers, under a duty of confidentiality.
- Public authorities, when the law requires us to, and a buyer of our business, if Astrospot is ever transferred, who would have to respect this policy.
The service providers that act on our behalf (processors) may use your data only on our instructions and under a contract that protects it.
5. International transfers
Some of our providers (Stripe, Cloudflare, Vultr and, where you use them, the sign-in providers) are based in the United States or may process data there. When your data is transferred outside the European Economic Area or the United Kingdom, we rely on the EU–US Data Privacy Framework (and its UK extension) for providers certified under it, and on the Standard Contractual Clauses approved by the European Commission (with the UK addendum where needed) for all other providers. You can ask us for more information about these safeguards through the contact page.
6. How long we keep your data
| Data | How long |
|---|---|
| Account, birth details, people you add, saved readings and settings, consent records | As long as your account exists. When you delete your account, they are deleted immediately from the live site, and from our backups within their normal rotation. |
| Accounts that were never confirmed | Deleted automatically after 7 days, unless a payment was made with them (then they are kept with the order records). |
| Orders, receipts and payment records, including accepted Terms and withdrawal acknowledgments | 10 years from the end of the financial year of the payment, as Romanian accounting law requires (Law No. 82/1991). When you delete your account, these records are detached from it and kept only for this purpose. |
| Orders that were started but never paid | 30 days (long enough to send at most one reminder and to understand checkout problems), then anonymized: we keep only the amount, currency, country and dates, without anything that identifies you. |
| Your request to stop marketing emails | As long as we send marketing emails, so we can respect it. We keep only a one-way hash of your email address. |
| Messages sent through the contact form | As long as needed to deal with your request and any follow-up, and no longer than 3 years. |
| Security data (counters for repeated attempts, stored as one-way hashes) | From a few minutes up to one hour. |
| Visit counting | The daily, anonymous visitor fingerprints are deleted after one day; only totals per day remain. |
| Server and network logs | A short period, usually no longer than 30 days, unless we need them longer to investigate a specific incident. |
7. Your rights
Under the GDPR (and the UK GDPR), you have the following rights:
- Access: you can ask for a copy of the data we hold about you.
- Rectification: you can correct inaccurate data. You can change your name, your email address and your birth time from your account page. Your birth date and birthplace are locked once saved, to keep each subscription personal (see our Terms), but this product rule never stops us from correcting a real error: write to us and we will fix it.
- Erasure: you can delete your account at any time from your account page. We then delete your account, birth details, people you add, readings and consents. We keep only what the law requires us to keep, such as payment records (section 6).
- Restriction: you can ask us to pause the use of your data while a question about it is being resolved.
- Portability: you can get your data in a structured, machine-readable format, using “Download my data” on your account page (an instant JSON file) or “Request a copy of my data” (we email you the full archive).
- Objection: you can object to any use based on our legitimate interest. You can object to marketing at any time, without giving a reason, and we will stop.
- Withdrawing consent: you can withdraw any consent at any time, for example by turning off marketing emails in your account or using the unsubscribe link in any email.
If you live in a US state with a consumer privacy law (such as California), you have similar rights to know, access, correct and delete your personal information, and we honor them in the same way, without discrimination. We do not sell or share personal information for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you.
8. How to use your rights
- On your account page: update your details and email preferences, download your data instantly, or request a copy by email (we email you a link to confirm the request, then send you the archive), and delete your account.
- In every marketing email and in the weekly transits email: an unsubscribe link.
- For anything else: write to us through our contact page.
Using your rights is free. We answer within one month; if a request is complex, we may extend this by up to two more months and will tell you why. We may ask you to confirm your identity, for example by writing from the email address of your account.
9. Your right to complain
If you think we have not handled your data properly, please tell us first, so we can put it right. You also have the right to lodge a complaint with a data protection authority, in particular in the country where you live, work or where the problem happened:
- in Romania, where we are established: the National Supervisory Authority for Personal Data Processing (ANSPDCP), Bd. General Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania, dataprotection.ro;
- in another country of the European Union or the EEA: your national data protection authority;
- in the United Kingdom: the Information Commissioner’s Office (ICO), ico.org.uk.
10. Cookies and similar technologies
Cookies are small files that a website stores in your browser. Astrospot uses only cookies that are strictly necessary for the site to work or that remember a setting the site needs to show you the right information. We do not use advertising cookies, tracking pixels, social media trackers or third-party analytics. Because of this, the law does not require us to ask for your consent to cookies, and you will not see a cookie banner.
Members of our team who sign in to the administration area also receive a few WordPress preference cookies.
The site also keeps a few settings in your browser’s own storage. They stay on your device and are never sent to us:
| Name | Purpose | Duration |
|---|---|---|
astrospot-theme | Your choice of light or dark mode. | Until you clear your browser data |
astrospot-test16 and astrospot-test16-rez | Your progress and last result in the personality test. | Until you clear your browser data |
astrospot-cas-place | The last place you used in the wedding dates tool. | Until you clear your browser data |
astroCheckoutSession | Prevents a double order if you submit the checkout twice. | Until you close the tab |
astrospot-sky-now and wpEmojiSettingsSupports | Keep the “sky now” panel and an emoji display check for a few minutes, so pages load faster. | Until you close the tab |
You can delete or block cookies in your browser settings. If you block the strictly necessary ones, you will not be able to sign in or pay.
11. Children
Astrospot is not meant for anyone under 18, and we do not knowingly collect personal data from children. If you think a child has created an account, write to us through our contact page and we will delete it. If you add a child’s birth details for a compatibility reading, you must be their parent or guardian or have their parent’s permission.
12. Security
We protect your data with technical and organizational measures suited to the risk: encrypted connections (HTTPS) on every page, passwords stored only as hashes, links and tokens stored as one-way hashes, limits on repeated attempts, protection against bots, restricted access for our team and regular backups. Card payments are handled entirely by Stripe, which is certified to the PCI DSS security standard. No system is perfectly secure; if a breach ever puts your data at risk, we will inform you and the competent authority as the law requires.
13. Changes to this policy
We may update this policy when our service or the law changes. The current version is always on this page, with the date of the last update at the top. If we make important changes, we will tell you by email or on the site before they apply.
14. Contact
Questions about your data or this policy? Write to us through our contact page, or by post to SYNAPTIX BUSINESS SOLUTIONS S.R.L., Str. Sapientei 1B, Sector 5, Bucharest, Romania.