Privacy Policy

Last updated 17 September 2026 · AstroRasa Inc.

1. Who we are

AstroRasa is operated by AstroRasa Inc., incorporated in Canada. We are the controller of the personal data described here.

Who is accountable. Canadian privacy law requires a named individual to be responsible for what follows, not only an address to write to. That person is:

They decide questions about this policy, answer requests under §9, and decide whether an incident under §12 must be reported. Québec's Law 25 requires the person's title and contact to be published; both are here.

This policy covers the AstroRasa websites and applications, on every platform we offer them, and the calculation and AI services behind them. Where AstroRasa Inc. is shown as the seller at checkout, we sell to you directly; where you buy through an app store, that store is the seller (§3, "Purchases").

2. The short version

• Your birth date, time and place are the core of this product, and in most privacy law they are sensitive personal data. We treat them that way.
• We do not sell your data, and we do not track you across other apps or websites. There is no advertising identifier, no analytics SDK and no ad network anywhere in this app — not disabled, not present.
• Your questions to the AI, and the chart context needed to answer them, are sent to a third-party AI provider (§5).
• You can delete your account and its data from inside the app (§9).

3. What we collect

Everything below corresponds to a real code path. Nothing is collected "just in case".

Identity

• Email address — sign-up and sign-in. It is the key for every per-user record: charts, credits, courses, subscription.
• Name — sign-up, and shown back to you in the app.
• Phone number — only if you choose phone sign-in, and optionally as a contact field you add to a saved chart.

Astrological data (sensitive)

• Date, exact time and place of birth, timezone, and optional sex — for you, and for any other person whose chart you create or save. See §4.
• Life events you enter for Birth-Time Rectification (for example: a marriage, a move, a bereavement). These can be sensitive in their own right.
• Questions you ask the AI, and the readings produced from them.

Location

• Device location, only at the moment you ask the app to use your current location, and only for the feature you asked for. It is not collected in the background and not tracked over time.
• Place names you type are sent to a geocoding service to turn them into coordinates (§5).

Where your charts are kept

• By default, on your device only. We keep no copy, and there is nothing about your charts on our servers.
• If you turn on chart sync (an optional setting in the app), a copy is stored in our database so your charts follow you between devices. That copy contains the birth date, time and place the chart was built from. Sync is off until you turn it on.
• Turning sync off deletes the stored copy. Deleting a chart deletes both copies. Deleting your account deletes all of them (§9).

Purchases

• Where we sell to you directly, payment is handled by our payment processor (named in §5). You enter your card details on the processor's own checkout page, not in our application. It tells us that a payment succeeded, for which product, and the tax it calculated — never the card number.
• Where you buy through an app store, payment is handled entirely by that store (such as the App Store or Google Play) under its own terms.
• Either way, we never see or store card numbers. We store only the result: your subscription status, what you own, your credit balance, and an order record for accounting and refunds.

Technical

• App version, device model and operating system, and crash diagnostics.

Cookies and storage on the web

Our website and desktop applications keep a small amount of data in your browser or on your device. There is no advertising or analytics cookie of any kind, now or planned.

These are what most privacy laws call strictly necessary — the service does not work without the first, and the second belongs to the payment step you chose to start. We do not ask for consent to set them, and we set nothing else.

What we do not collect

• No advertising identifiers. No cross-app or cross-site tracking. No analytics SDK. No third-party ad networks. No profiling for advertising purposes.

4. Charts you create about other people

This is unusual enough to deserve its own section.

AstroRasa lets you save charts for other people — family, clients, students. When you do, you are entering another living person's sensitive data, and that person has not agreed to anything with us.

• You are responsible for having a proper basis to enter someone else's birth details, and for telling them if they ask.
• If you are a professional astrologer using AstroRasa with clients, you are acting as the controller of their data and we are your processor for it. You are responsible for your own privacy notice to them.
• This release has no marketplace, no consultation network and no teaching platform. Those features are built and are held back to a later version. While they are held back, AstroRasa never asks you for another person's name, email or phone number, and no such list is stored on our servers. A chart you save about someone else stays on your device unless you switch chart sync on yourself.
• If a person whose chart you saved contacts us directly, we will tell them the chart exists and, where the law requires it, delete it — and we may need to tell you that we did.

5. Who else processes your data

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

When this list changes. The table shows the processors we use today. We may replace one, or add one, as the service changes. Before a processor receives a kind of personal data it did not receive before, or processes it in a country not already listed, we update this policy and tell you as §15 describes. Replacing one provider with another that receives the same data in the same country is recorded in this table when it happens.

About the AI specifically. Your question and the chart context needed to answer it go to our AI provider (§5) through our own server, which holds the API key — the application never talks to the AI provider directly. We do not permit your questions or readings to be used to train anyone's model.

6. Why we are allowed to process it

Because birth data is special-category data, we rely on your explicit consent, which you give at sign-up and can withdraw (§9).

7. Your consent, and the record of it

When you create an account you are asked to accept the Terms of Service and this Privacy Policy. That acceptance is not a formality — we keep a record of which version of these documents you agreed to and when, so that what you agreed to can be established later.

If either document changes in substance, we ask again. An old agreement does not silently carry over to new terms.

What is asked together, and what is asked separately. Acceptance of the Terms and this Privacy Policy is a single step at sign-up, and it covers creating charts and asking the AI — the two things the product is for. Some processing is separately and individually opted into, and is off until you choose it: storing your charts on our servers (chart sync), sharing your device location, and marketing email (§9a).

8. Automated decisions, and what the AI is

AstroRasa produces readings automatically, including AI-written ones.

These are not decisions about you with legal or similarly significant effects. They are interpretations of a chart, offered for reflection. No automated process here decides anything about your employment, credit, insurance, health care or legal standing, and none of it should be used that way. See the Disclaimer.

The AI declines certain sensitive subjects by design — for example, questions about death and longevity — and suggests a human astrologer instead. Which subjects it declines may change as we improve it; no such change makes it decide anything about you.

9. Deleting your data, and your rights

In the app, at any time:

• Delete individual charts.
• Delete your account — from the account settings in the app. This erases the account and its data on the server, not merely on your device, and signs you out.

Wherever you live, you may ask us to:

• give you a copy of the personal data we hold about you, and tell you how it has been used and who it has been given to;
• correct anything inaccurate or incomplete;
• export it in a structured, commonly used, machine-readable format.

These three we honour for everyone, because Canadian law gives them to everyone — not only to residents of places that ask loudly.

Depending on where you live, you may also have the right to restrict or object to processing, to withdraw consent, or to complain to a regulator (§13).

How to ask, and what happens. Write to privacy@astrorasa.com. We may ask you to confirm your identity — we will not hand someone else your birth data on the strength of an email address. We answer within 30 days, and if we need longer we will tell you why before that deadline passes. There is no charge. If we refuse any part of a request, we will say which part, why, and how to challenge it.

Withdrawing consent to the processing of birth data means we can no longer compute charts, which is most of the product.

9a. Emails we send you, and how to stop them

Canada's Anti-Spam Legislation (CASL) governs commercial electronic messages, and it distinguishes two kinds. So do we.

Service messages — sent because you have an account with us. Confirming an account, resetting a password, receipting a purchase, warning about a failed payment or a security event, telling you that these documents have changed. These are part of the service you asked for. You cannot unsubscribe from them and keep a working account, though you can close the account (§9).

Marketing messages — sent only if you choose. New features, courses, offers. We send these only with your consent, and:

• every one identifies AstroRasa Inc. and gives our mailing address (2482 Yonge Street #1476, Toronto, ON M4P 2H5, Canada) and support@astrorasa.com, as CASL requires;
• every one carries an unsubscribe link that works for at least 60 days, and we act on it within 10 business days;
• we keep a record of when and how you gave consent, and of when you withdrew it.

Unsubscribing from marketing never affects your account, your purchases or the service messages above.

10. How long we keep it

11. International transfers

AstroRasa is operated from Canada. Your data may be processed in the countries listed for each processor in §5 — and, if a processor changes, only in a country we have first added to that table.

Where data leaves your region, we rely on the transfer mechanisms our processors provide — Standard Contractual Clauses, or an adequacy decision where one applies.

What we are telling you plainly: data held in another country is subject to the laws of that country, and can in principle be reached by its courts, police or security agencies, whatever our contracts say. That is true of every service of this kind, and we would rather state it than leave you to infer it.

Québec. Law 25 requires an assessment of the privacy implications before personal information is communicated outside Québec, and the transfer to proceed only if the information receives adequate protection. We have not yet completed that assessment.

12. Security

• Traffic between the app, the engine and the AI provider is encrypted in transit (TLS).
• Passwords are never stored in plain text.
• The application key that reaches our database is a publishable key, and every record it can reach is protected by row-level security. Keys that could bypass those rules are never shipped in the app.
• Access to production data is limited to those who need it.

No system is perfectly secure, and we do not claim otherwise.

If something goes wrong

If personal data we hold is lost, accessed or disclosed without authorisation, we will:

• contain and investigate it, and keep a record of it. We keep a record of every such incident, whether or not it is serious enough to report, because the law requires the record and because a pattern of small incidents is itself information;
• tell you if the incident creates a real risk of significant harm to you — as soon as feasible, in plain language, saying what happened, what data was involved, what we have done, and what you can do;
• tell the regulator, on the timetable each one sets: the Office of the Privacy Commissioner of Canada under PIPEDA, the Commission d'accès à l'information under Québec's Law 25 where a Québec resident is affected, and a supervisory authority within 72 hours where the GDPR applies;
• tell anyone else who can reduce the harm, such as a processor or a payment provider.

Because birth data is sensitive, an incident involving it is more likely to meet the "real risk of significant harm" threshold than one involving an email address alone, and we will treat it that way.

13. Contact, and complaints

privacy@astrorasa.com — for any question about this policy, or to exercise a right in §9. By post: Privacy Officer, AstroRasa Inc., 2482 Yonge Street #1476, Toronto, ON M4P 2H5, Canada.

Grievance Officer (India, DPDP Act 2023): Ravi Sharma, privacy@astrorasa.com. Users in India may raise a grievance here and are entitled to a response. This is the same person named as Privacy Officer in §1, which the Act permits — what it requires is that a named individual is reachable and answers, not that the roles be held apart.

You also have the right to complain to a regulator:

• Canada — the Office of the Privacy Commissioner of Canada, which oversees PIPEDA. AstroRasa Inc. is an Ontario corporation; Ontario has no separate private-sector privacy statute, so PIPEDA applies federally.
• Québec — the Commission d'accès à l'information, under Law 25, if you are a Québec resident.
• EU / UK — your national supervisory authority.
• California — the California Privacy Protection Agency.

14. Children

AstroRasa is not intended for anyone under 16, and we do not knowingly collect their personal data. If you believe a child has given us data, write to privacy@astrorasa.com and we will delete it.

How this is enforced, precisely. Creating an account requires you to confirm that you are 16 or older. It is a separate step from accepting these documents, so that what you confirmed is unambiguous, and we record it alongside the version of this policy you accepted and the date — which means we can show, later, what was declared and when.

What we do not do is verify it. We take your word. There is no identity check, no document upload, and no estimate made from anything else you tell us. We say so plainly rather than implying a check that does not happen, and we act on what we learn: if we discover an account belongs to someone under 16, we delete it and its data.

We do not ask for your date of birth to open an account — only that you confirm the threshold. Your birthday is not something the account needs, and collecting it would sit badly with the minimisation the rest of this policy promises. The birth date you enter for a chart is a different thing, often about a different person, and is covered by §3.

Québec treats anyone under 14 differently: their personal information generally cannot be collected without the consent of a parent or guardian. Anyone who has confirmed they are 16 or older has necessarily confirmed they are not under 14, which is why one declaration answers both — though whether a self-declaration is sufficient for the Québec rule is a question below.

15. Changes

This policy describes how we handle personal data, not which products we sell. Changing a price, adding a course or a feature, or redesigning a screen does not change it, and we do not re-issue it for those.

We do update it, with a new version and date, when what we collect, why, who receives it, where it is processed, or how long we keep it changes. When such a change is material — a new kind of data, a new purpose, or a new country of processing — we:

• tell you in the app, and by email where you have an account, before the change takes effect;
• ask you to accept the new version before continuing (§7); and
• do not apply a new purpose to data collected before it without your consent, where the law requires consent.

Minor corrections — a clearer sentence, a renamed setting — are published with a new date and do not ask you to accept again.