Privacy notice

1. Controller

Cassandra Astro (also “Cassandra App”), domiciled in Guadalajara, Jalisco, Mexico, is responsible for processing your personal data under Mexican law on personal data held by private parties. We also follow the principles of the EU GDPR and California privacy laws. Privacy contact: cassandra.astro.help@gmail.com.

2. Data we process

• Birth data: date, time and place (with its coordinates and time zone), yours and those of people you add, for example in a synastry.
• Name or nickname: yours and those of people you add, to personalize the reading and the PDF.
• Account (app only): email, user ID and sign-in method (Google, Apple or email).
• Payments: on the website, Stripe processes your card and we only receive the purchase email, amount, currency and payment status. In the app, Google Play processes the charge and we receive the status of your purchase or subscription.
• Email: if you ask to receive your PDF by email and, only if you agree, to send you news.
• Contact messages: the email, subject and message you send through the contact form.
• Current location (optional): only if you tap “use my location” or grant permission in the app, to fill in the place. We store the chosen place, not a history of your locations.
• Technical and usage data: an anonymous session ID, your IP address, your time zone, language and device or browser type, the campaign parameters you arrived with (utm), usage statistics and, in the app, crash reports and the token used to send you notifications.

We do not ask for sensitive data. Please do not include health or other sensitive information in free-text fields such as the contact form.

3. What we use your data for

Purposes needed to provide the Service:

• Calculating your astrological charts and generating their interpretation.
• Showing your readings, unlocking what you bought, generating your PDF and sending it to the email you provide.
• Managing your app account and answering support requests.
• Preventing fraud and abuse (for example, the daily limit on free readings) and keeping the Service secure.
• Complying with legal and tax obligations.

Secondary purposes you can refuse without affecting the Service: sending you news and promotions (only if you ticked the box or agreed in the app) and using usage statistics to improve the Service and measure our campaigns. To refuse them, write to us or use the unsubscribe link in any email.

We do not sell your data, we do not use your birth data for targeted advertising and we do not build advertising profiles.

4. Artificial intelligence

To generate interpretations we send our AI providers (Google Vertex AI and, as a backup, OpenAI) the chart data: positions, houses, aspects and language and, in a synastry, the other person’s name or nickname. We do not send them your email or payment details. Under their business API terms, these providers do not use this data to train their models.

We temporarily store results (up to 90 days) to answer identical requests faster.

5. Reading links

Each website reading has a private link, and the app lets you share readings with a link. Anyone who has the link can view that reading, so share it only with people you choose.

6. Who we share your data with

Only with providers that process it on our behalf (processors) to operate the Service, under contracts that prevent them from using it for their own purposes:

• Google: Firebase (hosting, authentication, database, functions, PDF storage, Analytics, Crashlytics and notifications), Google Maps Platform (place search and time zones) and Vertex AI.
• OpenAI: backup generation of interpretations.
• Stripe: website payments. Stripe also processes your payment data under its own privacy notice, for example to prevent fraud.
• Google Play and RevenueCat: in-app purchases and subscriptions.
• Resend: sending emails with your PDF.
• EmailJS: delivering contact form messages.
• Mapbox and ChottuLink: maps and links in the app.

These providers may process data outside Mexico, mainly in the United States. We will only share your data with authorities when the law requires it.

7. Cookies and local storage

The website stores in your browser your language preference, form drafts, the campaign you arrived from and your anonymous session (needed to view your readings). Google Analytics uses cookies for usage statistics, and Stripe’s payment form uses cookies for security and fraud prevention. You can delete or block them in your browser, although without the session you will not be able to view your readings on that device.

8. How long we keep your data

• Website readings that are not paid for: deleted automatically after 30 days, along with their data and files.
• Paid readings and their PDF: while the Service is available, or until you ask us to delete them.
• Temporarily stored AI results: up to 90 days.
• Abuse-prevention counters: 48 hours. In them, your IP is only stored as an irreversible hash.
• Payment records: as long as tax laws require.
• App account: until you delete it from your profile or ask us to delete it.
• Email for news: until you unsubscribe.

Our infrastructure providers may keep technical logs (with IP addresses, for example) for short periods.

9. Your rights

You can access, rectify or delete your data or object to its processing (ARCO rights), as well as withdraw your consent or limit the use of your data. Write to cassandra.astro.help@gmail.com with the subject “ARCO rights”; include your reading link or the email of your purchase or account, and what you are requesting. We will reply within 20 business days and, if appropriate, apply it within the following 15 business days. In the app you can also delete your account from your profile.

If you live in the European Union or the United Kingdom, you also have the rights to data portability, to restrict processing and to lodge a complaint with your data protection authority. In Mexico you may go to the competent personal data protection authority. If you live in California, we do not sell or share your information for behavioral advertising.

10. Minors

The Service is not directed to people under 18. We only process minors’ data when entered by their parent or guardian (for example, in a synastry). If we detect a minor’s data entered without authorization, we will delete it.

11. Security

We use encryption in transit (TLS), access controls and rules that prevent the browser from reading a reading’s full content before payment, or any internal data. No system is 100% secure; if a breach affects your data, we will notify you as required by law.

12. Changes to this notice

We may update this notice. We will publish the new version on this page with its date and, if the change is material, announce it on the site or in the app.

By using the Service and giving us your data, you consent to its processing under this notice.