DPDPA Compliance

Under the DPDPA 2023, the Data Fiduciary for The Astro Nova is:

As a Data Fiduciary under the DPDPA, we collect the following categories of Digital Personal Data:

• Name -- as provided during registration (Google OAuth or email signup).
• Email address -- for account authentication, communications, and transactional emails.
• Phone number -- if provided for OTP authentication or WhatsApp notifications.
• Date of birth, time of birth, and place of birth -- required for generating accurate astrological charts and readings.
• Gender -- used for personalising astrological interpretations.
• Payment information -- transaction records processed via Razorpay (India) and Stripe (international). Full card details are never stored on our servers.
• Device and technical information -- IP address, device type, browser type, operating system, and session data.
• AI interaction history -- chat messages, voice call transcripts, and avatar session logs generated during consultations.

We process your personal data only for the following specified and lawful purposes, as required under Section 4 of the DPDPA:

• Astrological readings and consultations: Generating birth charts, horoscopes, compatibility reports, transit analyses, and personalized remedies across Vedic, Western, and Chinese astrological systems.
• Birth chart computation: Using your date, time, and place of birth to calculate planetary positions, house placements, Nakshatras, Dashas, and divisional charts.
• Payment processing: Processing credit purchases and maintaining transaction records for accounting and tax compliance.
• AI service improvement: Analysing anonymised interaction patterns to improve the quality and relevance of AI-generated astrological interpretations.
• Communications and updates: Sending transactional emails (receipts, OTPs, account updates) and, with your explicit consent, promotional content about new features or offers.
• Legal compliance: Fulfilling obligations under applicable Indian law, including tax regulations and law enforcement requests.

Under Chapter III of the DPDPA, you have the following rights:

• Right to Access (Section 11): Request a summary of the personal data we hold about you and the processing activities performed on it.
• Right to Correction (Section 12): Request correction of inaccurate or misleading personal data, or completion of incomplete data.
• Right to Erasure (Section 12): Request deletion of your personal data. You can delete your account and all associated data directly from your account settings.
• Right to Grievance Redressal (Section 13): Raise a grievance with our Grievance Officer. If unsatisfied with our response, you may file a complaint with the Data Protection Board of India.
• Right to Nominate (Section 14): Nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, contact our Grievance Officer at grievance@theastronova.com. We acknowledge every request within 24 hours and aim to resolve within 15 days, in compliance with DPDPA s.13(3) and Rule 3(2)(a) of the IT (Intermediary Guidelines) Rules 2021.

We retain personal data only for as long as necessary to fulfil the purposes outlined in this notice:

• Account data (content): Birth data, chat transcripts, remedy logs, and avatar uploads are retained for the duration of your active account. Upon account deletion, all personal content is permanently erased within 30 days.
• Account identifiers (IT Rules compliance): userId, email, phone number, and authentication logs are preserved for 180 days post-deletion as required under Rule 3(1)(h) of the IT (Intermediary Guidelines) Rules 2021 for law-enforcement cooperation. These identifiers are not used for any marketing or analytics purpose.
• Financial records: Transaction records are retained for 7 years as required under Indian tax regulations (Income Tax Act, 1961).
• AI conversation logs: Retained for up to 24 months for service improvement, then anonymised or permanently deleted.
• Marketing preferences: Retained until you unsubscribe from promotional communications or withdraw consent.

When data is no longer needed and not subject to a legal retention requirement, it is securely deleted or irreversibly anonymised.

In accordance with Section 9 of the DPDPA:

• The Astro Nova is not intended for individuals under 18 years of age.
• We do not knowingly collect, store, or process personal data from children.
• We do not engage in tracking, behavioural monitoring, or targeted advertising directed at children.
• If we become aware that we have inadvertently collected personal data from a child, we will delete it promptly.

Certain third-party processors may process data outside India. As permitted under Section 16 of the DPDPA, we transfer personal data only to countries and entities not restricted by the Central Government. All such processors are bound by contractual obligations to maintain the confidentiality and security of your data.

Complete processor list (synced April-18 with Privacy Policy s.3):

• Anthropic (US) — LLM inference for AI chat and voice agent prompts
• OpenAI (US) — embedding generation for semantic memory search
• ElevenLabs (US/UK) — voice synthesis and real-time conversational AI
• HeyGen / LiveAvatar (US) — streaming avatar sessions
• Stripe (US/IE) — international payment processing
• Razorpay (India) — domestic payment processing and GST invoicing
• Neon (US) — managed Postgres for application data
• Vercel (US) — application hosting and CDN
• Upstash (US) — Redis for rate limiting and webhook dedup
• Resend (US) — transactional email delivery
• PostHog (US, EU-hosted option) — product analytics (opt-in; gated by your cookie consent)
• Sentry (US) — error monitoring (PII-scrubbed)
• WhatsApp / Meta (US) — notification delivery if you opt in
• Google (Cloud Platform, OAuth) (US) — sign-in (if you choose Google OAuth) and location search

This list replaces any earlier abridged version. Every processor is listed for each purpose. If a new processor is added, this section and the Privacy Policy s.3 are updated within 30 days.