Privacy Policy

01Data we collect

To run the Service, we collect:

• Email address — used as your login identifier, via magic-link authentication (Supabase Auth).
• Practice details — optional business info you enter if you configure white-label PDF export (practitioner name, logo, address).
• Client charts you create — birth data (name, date, time, place), notes, custom fields. This is content you author.
• Technical logs — IP address, browser user-agent, timestamps of key actions. Used for debugging, abuse prevention, and security.

Payment information (card, billing address) is never handled by Astrodesk directly — it is collected and stored by Gumroad, our merchant of record.

02How we use it

• To provide the Service — render charts, sync data between your devices, personalize the interface.
• To send transactional emails — magic-link login codes, receipts (via Gumroad), important service notifications.
• To debug and improve the Service through aggregated technical logs.

We never sell your data. We never use it for advertising. We never use your client charts or notes to train AI models.

03Where it lives

Astrodesk relies on a small number of specialized subprocessors, all GDPR-compliant:

We do not use any other analytics, tracking, or advertising subprocessor.

04Encryption

All connections to Astrodesk use TLS in transit (HTTPS everywhere). At the database layer, Postgres is encrypted at rest using Supabase's native disk encryption.

Access to your data is enforced by Row-Level Security (RLS) at the Postgres layer: your rows are hard-isolated per account, and no other user — nor any part of the Service running outside your session — can read them.

05Practitioner responsibility

The client charts you enter into Astrodesk are personal data belonging to third parties (your own clients). Under GDPR and equivalent privacy laws, you are the data controller for that information — Astrodesk is the data processor.

That means: you are responsible for informing your clients about how you store their birth data, for obtaining any consent that may be required, and for handling access or deletion requests from your clients. We help by giving you tools to export or delete their records on demand.

06Your rights

You have the right to access, correct, delete, and export your personal data. Most of these actions are available directly in your account settings. For anything you cannot do yourself, write to hello@astrowildchild.com and we will respond within 30 days.

If you are in the EU/UK, you additionally have the right to lodge a complaint with your local data protection authority.

07Retention

Your data is retained for as long as your account is active. After account deletion, data is kept for a 90-day grace period (for accidental deletion recovery and legal / financial record-keeping), then permanently purged from live databases.

Backups are rotated on a 30-day cycle and eventually overwritten.

08Cookies & tracking

Astrodesk uses session cookies only — strictly to keep you logged in. We do not use Google Analytics, Facebook Pixel, or any marketing / behavioural tracking. No third-party advertising cookies are set by the Service.

09Children

Astrodesk is a B2B professional tool intended for astrologers and adult learners. The Service is not intended for children under 18, and we do not knowingly collect data from minors.

10International transfers

Because our infrastructure providers (Supabase, Resend, Vercel) are US-based, data collected from users in the EU/UK is transferred to the United States. These transfers are covered by Standard Contractual Clauses (SCCs) signed with each subprocessor, in line with GDPR Article 46.

11Changes to policy

We may update this Privacy Policy from time to time. Material changes will be announced by email at least 30 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.

12Contact

Privacy questions, data requests, or anything that feels off — write to hello@astrowildchild.com. A human will read it.