1. Introduction

AstroKairos is operated by Plenty Planet Lda, a company incorporated and registered in Portugal ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. This policy complies with the EU General Data Protection Regulation (GDPR) and applicable US privacy laws.

Please read this Privacy Policy carefully. By using AstroKairos, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Personal Information

When you register for an account, we collect:

• Email address - Required for account creation and authentication
• Display name - Optional, for personalization
• Password - Stored in hashed format for security

2.2 Profile Information

You may optionally provide:

• Birth date - For astrological chart calculations
• Birth time - For accurate chart calculations
• Birth location (city and country) - For geographic coordinates
• Occupation - For personalized insights
• Education - For personalized insights
• Language preference - For localized experience

2.3 Usage Information

We automatically collect:

• Conversation data - Your messages and the AI's responses
• Usage analytics - Features used, session duration, interaction patterns
• Technical data - IP address, browser type, device information
• Cookies and tracking - See Section 7 for details

2.4 Third-Party Authentication

If you sign in with Google, we receive your email address and display name from Google. We do not receive your Google password.

3. How We Use Your Information

We use your information to:

• Provide the Service - Generate astrological charts and personalized insights
• Maintain your account - Authentication and profile management
• Improve the Service - Analyze usage patterns and optimize features
• Communicate with you - Send service-related emails and notifications
• Ensure security - Detect and prevent fraud, abuse, and unauthorized access
• Comply with legal obligations - Respond to legal requests and prevent illegal activities

4. Legal Basis for Processing (GDPR)

Under GDPR, we process your personal data based on:

• Consent - You have given explicit consent for specific purposes
• Contract - Processing is necessary to provide the Service you requested
• Legitimate interests - For fraud prevention, security, and service improvement
• Legal obligation - To comply with applicable laws and regulations

5. Data Sharing and Disclosure

We may share your information with:

5.1 Service Providers

• Hosting providers - For infrastructure and data storage
• AI service providers - Anthropic (Claude) and OpenAI (GPT) for AI responses
• Analytics providers - PostHog for usage analytics
• Authentication providers - Google for OAuth authentication
• Geocoding services - For converting location names to coordinates

5.2 Legal Requirements

We may disclose your information if required by law or in response to:

• Court orders or subpoenas
• Legal processes or government requests
• Protection of our rights, property, or safety
• Prevention of fraud or illegal activities

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. You may request deletion of your account and data at any time (see Section 9).

After account deletion, we may retain certain information:

• For legal compliance (e.g., tax records)
• For fraud prevention and security
• For dispute resolution
• In anonymized form for analytics

7. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Authentication - Keep you signed in
• Preferences - Remember your settings and language
• Analytics - Understand how you use the Service (via PostHog)
• Security - Detect and prevent fraudulent activity

You can control cookies through your browser settings. However, disabling cookies may limit functionality.

8. Data Security

We implement industry-standard security measures to protect your data:

• Encryption - Data in transit is encrypted using TLS/SSL
• Password hashing - Passwords are hashed using bcrypt
• Access controls - Limited access to personal data on a need-to-know basis
• Regular security audits - To identify and address vulnerabilities

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

9. Your Rights and Choices

9.1 GDPR Rights (EU Users)

If you are in the European Economic Area, you have the right to:

• Access - Request a copy of your personal data
• Rectification - Correct inaccurate or incomplete data
• Erasure - Request deletion of your data ("right to be forgotten")
• Restriction - Limit how we process your data
• Portability - Receive your data in a portable format
• Object - Object to processing based on legitimate interests
• Withdraw consent - Withdraw consent at any time
• Lodge a complaint - File a complaint with your data protection authority

9.2 US Privacy Rights

Depending on your state, you may have additional rights:

• California (CCPA/CPRA) - Right to know, delete, and opt-out of sale
• Virginia (VCDPA) - Right to access, correct, delete, and opt-out
• Other states - Rights as provided by applicable state laws

9.3 Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond within the timeframes required by applicable law (typically 30 days for GDPR requests).

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws than your jurisdiction.

When we transfer data from the EU/EEA to other countries, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions by the European Commission
• Other legally approved transfer mechanisms

11. Children's Privacy

The Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete it.

12. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies.

13. Do Not Track Signals

We currently do not respond to Do Not Track (DNT) browser signals. We may adopt a DNT standard if one is established in the future.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date
• Sending you an email notification (for material changes)

Your continued use of the Service after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at:

Email: [email protected]

For GDPR-related inquiries or to exercise your data protection rights (access, deletion, portability, etc.), please email us at the address above with "GDPR Request" in the subject line.

16. Specific State Privacy Notices

California Residents

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have specific rights regarding their personal information. We do not sell your personal information to third parties.

Nevada Residents

Nevada residents have the right to opt-out of the sale of their personal information. We do not sell personal information.

Delete your AstroKairos account

You can request deletion of your AstroKairos account and associated personal data at any time.

Request deletion by email

You can request account deletion by emailing us at [email protected] from the email address associated with your AstroKairos account.

Please include the subject line: Delete my AstroKairos account.

What data is deleted

When your account is deleted, we delete or anonymize personal data associated with your account, including your profile information, birth chart details, saved conversations, and authentication identifiers, unless we are required to retain certain information for legal, tax, fraud prevention, security, or compliance reasons.

How long it takes

We aim to process account deletion requests within 30 days.