0. Key points

This Policy describes what personal data Astrobot processes, why, for how long, and what rights users have. Processing complies with the Law of the Republic of Belarus No. 99-Z of 07.05.2021 "On Personal Data Protection"; for users from Russia the requirements of Federal Law No. 152-FZ are additionally taken into account. By using the Service you confirm having read the Policy; consent may be withdrawn at any time (see Rights).

1. Data controller

The data controller is the person operating the Astrobot Service (see Requisites in the Terms of Use). Data contact: support@astrobot.chat.

2. What data we collect

Required at signup: email (or Google/Telegram account identifier), interface language, record of document consent (version, timestamp, IP). Optional, at your discretion (needed for astrological calculations): birth date, time and place, current city, gender, names of compatibility participants. Technical: IP address and device details at login (to protect accounts), session cookies (httpOnly), operational logs. Chats and content you create remain in your account until deleted by you. Payment details are processed by the payment provider — the Operator never sees or stores them.

3. Why we process it (legal bases)

(a) contract performance (delivering astrology services): chart calculations from birth data, assistant answers, reports; (b) legitimate interest: protecting accounts and preventing abuse (login IPs, logs), security, fraud prevention; (c) consent: marketing emails (opt-out in settings), optional telemetry; (d) law: keeping payment records required by accounting and tax legislation.

4. AI processing and third-party sharing

Some features of the Service use artificial intelligence models provided by third-party service providers of the Operator. Only the data needed to fulfil your request is transmitted to them (e.g. birth date or question text); passwords and payment details are never shared with anyone. We advise against entering extraneous sensitive information into free chat text (document numbers, addresses, health details). All providers are bound by confidentiality obligations; their current list is provided upon request as described in the Rights section (Law No. 99-Z, Art. 12). The following anonymized processor categories are also used: hosting and infrastructure, email delivery, payment acceptance (payment data is handled solely by the payment provider and is unavailable to the Operator), technical error reporting.

5. Cookies and analytics

Technical cookies used: sessions (access/refresh, httpOnly, SameSite=Lax), CSRF token, referral tag, guest-banner flag. Anonymized usage analytics (on-page interactions) help improve the product. No advertising trackers. Analytics can be disabled via browser settings (Do Not Track, extensions) without loss of functionality.

6. Retention

Data is stored while the account exists. After account deletion, hard deletion happens immediately (cascade, including chats and charts); only payment documents (retention periods set by tax law) and anonymized aggregates survive. Backups rotate (14 days) and age out accordingly. Session logs last until account deletion or expiry.

7. Security

HTTPS everywhere, bcrypt password hashing, signed tokens, httpOnly cookies. Chart files are not directly accessible — ownership is checked per request. Production database access is restricted. A security breach creating risk to your rights will be communicated to you and to the supervisory authority (NCZPD) within statutory deadlines.

8. Your rights

You have the right to: information about processing (reply within 5 business days); a copy of your data; rectification of inaccurate data; demand cessation of processing and delete your account with all data (immediate cascade deletion); withdraw consent (deletion within 15 days; withdrawal does not affect processing before withdrawal); obtain information about third-party disclosures (once a year free of charge). Requests: support@astrobot.chat from your account's email. Replies follow the deadlines of Law No. 99-Z.

9. How to exercise rights

Send requests to support@astrobot.chat from the email bound to your account (this protects against third parties posing as you). Information about processing is provided free of charge within 5 business days; deletion or correction — within 15 days under Law No. 99-Z. Occasionally technical limitations apply (e.g. manual verification is required if an account compromise is suspected) — we will warn you and resolve the issue as soon as possible.

10. International transfers

The Service's servers are located outside the Republic of Belarus; some functions (AI text generation, technical error reporting) are performed by providers in other jurisdictions. Transfers rely on Art. 9 of Law No. 99-Z: your informed consent given at signup/use, or contract with you. The current list of recipients and countries is provided upon request.

11. Minors

The Service does not knowingly collect data of persons under 18. Any such account found is deleted together with its data. Parents who discover an account created by their child may contact support.

12. Changes to this policy

The Policy may be updated; the new version is published here with a date. Material changes may prompt a new consent request.