Privacy Policy

AstraCosmo Studio ("we", "us", "our"), operating the brand AstraCosmo, is the data controller for personal data processed through astracosmo.com. This policy explains what we collect, why, with whom we share it, and the rights you have under the EU GDPR, the UK GDPR, and the California Consumer Privacy Act (CCPA / CPRA).

1. Who we are

AstraCosmo Studio, a Studio.
Registered office: Majaka tn 26
Lasnamäe linnaosa
11412 Tallinn
Harju maakond
Estonia
Contact: support@astracosmo.com

2. What personal data we collect

• Account & contact data - first name, email address, preferred language.
• Birth & quiz data - date of birth, birth time (if provided), birth city, and your answers to the reflection questions.
• Payment data - processed by Whop and its payment providers. We never store full card details on our servers.
• Communications - messages you send us via the contact form or email.
• Technical data - IP address, device type, browser, pages viewed, cookie identifiers - collected for security, fraud prevention and site improvement.

3. Why we process it (legal basis under GDPR)

• To perform your contract (Art. 6(1)(b) GDPR): generating and delivering your report, providing customer support, handling refunds.
• Legal obligations (Art. 6(1)(c)): tax and accounting record-keeping.
• Legitimate interests (Art. 6(1)(f)): fraud prevention, service security, product improvement - always balanced against your rights.
• Consent (Art. 6(1)(a)): optional marketing emails and non-essential cookies. Withdrawable at any time.

4. Sub-processors we share data with

We use the following third parties strictly to deliver the service. Each is bound by a Data Processing Agreement and appropriate safeguards (SCCs or adequacy) for transfers outside the EEA.

• Contabo GmbH - dedicated server infrastructure (Germany, EU).
• Cloudflare, Inc. - DNS, DDoS protection, network edge (USA / global).
• Sendinblue SAS (Brevo) - transactional email delivery (France, EU).
• Google LLC (Gemini API) - LLM text generation for your report (USA).
• fal.ai, Inc. - LLM router for text generation (USA).
• Whop, Inc. - payment processing, invoicing, EU VAT collection (USA / EU).
• Open-Meteo - city geocoding (birth city → coordinates + timezone) (EU).

5. International transfers

Our infrastructure is primarily hosted in the EU (Germany). Some sub-processors are located in the United States. Transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, adequacy decisions (e.g., EU–US Data Privacy Framework).

6. How long we keep your data

• Order records & invoices - 7 years (EU tax law).
• Report PDFs and snapshot data - 12 months after delivery.
• Marketing consent & contact form messages - 24 months or until unsubscribe / delete request.
• Technical & analytics logs - 12 months.

7. Your rights

Under the GDPR / UK GDPR you have the right to: access, rectification, erasure, restriction of processing, data portability, objection, and to withdraw consent at any time.

Under the CCPA / CPRA, California residents have the right to know what personal information we collect, to request deletion, to correct inaccurate information, to opt out of the sale or sharing of personal information, and to non-discrimination for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising.

To exercise any right, email support@astracosmo.com. We reply within 30 days.

8. Children

Our service is not directed at children under 16. We do not knowingly collect personal data from minors.

9. Cookies

See our Cookie Policy for details.

10. Complaints

You have the right to complain to an EU supervisory authority. We ask that you first give us the chance to resolve any concern.

11. Changes

We update this policy when our practices change. Material changes are announced by email.