Your Privacy Matters

Privacy Policy

Last updated: April 18, 2026

This Privacy Policy explains how The Astro Nova ("we," "us," or "our") collects, uses, shares, and protects your personal data when you use our AI-powered astrology platform at theastronova.com.

1. Data We Collect

We collect the following categories of personal data to provide our astrology services:

Account Information: Name, email address, and profile photo when you register via Google OAuth or email/password credentials.
Birth Data: Date of birth, time of birth, and place of birth. This information is essential for generating accurate astrological charts and readings across Vedic, Western, and Chinese systems.
Payment Information: Payment details are processed securely by our payment partners Razorpay (for India) and Stripe (for international transactions). We do not store your full card numbers on our servers.
Usage Data: Pages visited, features used, session duration, device type, browser type, and interaction patterns. We use PostHog for product analytics.
AI Interaction Data: Chat messages, voice call transcripts, and avatar session logs generated during your consultations with our AI astrologer.
Technical Data: IP address, browser user-agent, referring URLs, and error logs for service reliability.

2. How We Use Your Data

Your personal data is used for the following purposes:

Astrology Services: Generating birth charts, horoscopes, compatibility analyses, numerology reports, tarot readings, and personalized remedies based on your birth data.
AI Consultations: Powering AI chat, voice call, and avatar session features to deliver personalized astrological guidance.
Account Management: Authenticating your identity, managing subscriptions, processing payments, and providing customer support.
Service Improvement: Analyzing usage patterns to improve features, fix bugs, and develop new capabilities.
Communications: Sending transactional emails (receipts, account updates) and, with your consent, promotional content about new features or offers.

3. Data Sharing & Third Parties

We do not sell your personal data. We share data only with the following categories of service providers, strictly as needed to operate the platform. This list is kept in sync with the more detailed list on the DPDPA page.

AI Processing: Anthropic (Claude) for AI-powered astrological interpretations, and OpenAI for semantic search embeddings. Conversation data is processed but is not used to train third-party models. Both providers operate under data processing agreements.
Payment Processing: Razorpay (India, domestic payments + GST invoicing) and Stripe (US/IE, international payments). Both are PCI-DSS compliant.
Voice & Avatar: ElevenLabs (US/UK) for voice synthesis and real-time conversational AI; HeyGen / LiveAvatar (US) for streaming avatar sessions. Only session-specific data is transmitted.
Analytics: PostHog (US, EU-hosted option) for product analytics — opt-in and gated by your cookie consent. Sentry (US) for error monitoring, with PII-scrubbed payloads. Both are disabled by default until you accept analytics cookies.
Infrastructure: Neon (US, managed Postgres), Vercel (US, application hosting + CDN), Upstash (US, Redis for rate limiting). Data is stored in encrypted environments.
Communications: Resend (US) for transactional email delivery; WhatsApp / Meta (US) for notification delivery if you opt in.
Sign-in / Maps: Google (Cloud Platform, OAuth) for Google sign-in if you choose that option, and for location search via Places API.
Legal Requirements: We may disclose data if required by law, court order, or to protect the rights, property, or safety of The Astro Nova, its users, or the public. See Terms s.8 for our Nodal Officer channel for law-enforcement requests.

4. Data Security

We implement industry-standard security measures to protect your data:

All data transmitted between your browser and our servers is encrypted using TLS 1.3.
Passwords are hashed using bcrypt with salt rounds, never stored in plain text.
Database connections use SSL encryption. Sensitive fields (birth data) are encrypted at rest.
API keys and secrets are stored in encrypted environment variables, never in source code.
We conduct regular security audits and follow OWASP security best practices.
Access to production data is restricted to authorized personnel with role-based access controls.

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

5. Your Rights

Under India's Digital Personal Data Protection Act (DPDPA) 2023 and the EU General Data Protection Regulation (GDPR), you have the following rights:

Right to Access: Request a copy of all personal data we hold about you.
Right to Correction: Request correction of inaccurate or incomplete data.
Right to Erasure: Request deletion of your personal data. You can delete your account and all associated data from Settings at any time.
Right to Data Portability: Request your data in a structured, machine-readable format.
Right to Withdraw Consent: Withdraw consent for data processing at any time. This may limit your ability to use certain features.
Right to Grievance Redressal: Under DPDPA, you may raise concerns with us or the Data Protection Board of India.

To exercise any of these rights, contact us at grievance@theastronova.com. We acknowledge every request within 24 hours and aim to resolve within 15 days, in compliance with DPDPA s.13(3) and Rule 3(2)(a) of the IT (Intermediary Guidelines) Rules 2021.

6. Cookies & Tracking

We use the following types of cookies and similar technologies:

Essential Cookies: Required for authentication (NextAuth.js session cookies), security (CSRF tokens), and basic site functionality. These cannot be disabled.
Analytics Cookies: PostHog analytics cookies to understand usage patterns and improve the platform. You can opt out via cookie preferences.
Preference Cookies: Store your theme preference, language selection, and other UI settings locally.

We do not use third-party advertising cookies. We do not participate in cross-site tracking or sell data to advertisers.

7. Contact & Data Protection Officer

For any privacy-related inquiries, data requests, or complaints:

Run AI Intelligence Private Limited (trading as "The Astro Nova")

CIN: U62099DL2025PTC452659

GSTIN: 07AAOCR8832L1ZM

Registered Office: Ground Floor, Plot No. 111B, Pocket-3, Sector 17 Dwarka, New Delhi, 110078

Grievance Officer: Office of the Data Protection Officer

Phone: +91 97738 77969

Email: grievance@theastronova.com

General inquiries: support@theastronova.com

Pursuant to DPDPA s.13(3) and Rule 3(2)(a) of the IT (Intermediary Guidelines) Rules 2021, we acknowledge every privacy inquiry within 24 hours and aim to resolve within 15 days. If you are unsatisfied with our response, you may lodge a complaint with the Data Protection Board of India, approach a District Consumer Disputes Redressal Commission, or file via the e-Daakhil portal.

Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Birth chart data and AI conversation history are retained to enable continuous, personalized readings. If you delete your account, all personal content (birth data, chat transcripts, remedy logs, avatar uploads) is permanently erased within 30 days. Account identifiers (userId, email, phone) and authentication logs are preserved for 180 days post-deletion as required under Rule 3(1)(h) of the IT (Intermediary Guidelines) Rules 2021 for law-enforcement cooperation. Financial transaction records (invoices, credit-transactions, refunds) are retained for 7 years per CGST Rule 56 and the Indian Income Tax Act s.44AA.

Children's Privacy

The Astro Nova is not intended for children under 18 years of age. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal data, please contact us at support@theastronova.com and we will promptly delete such information.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the platform at least 15 days before they take effect. Continued use of the platform after changes constitutes acceptance of the updated policy.

Data Retention