Privacy Policy

Version 1.0 — effective September 3, 2026

This policy explains what we collect, why, on what legal basis, who we share it with, how long we keep it, and what you can require us to do.

Controller: Pixel Rainbow Inc., doing business as iastral

700 North Fairfax Str. STE 614, Alexandria, Virginia 22314, USA

Privacy contact: privacy@iastral.ai

We are based in the United States and we offer the Service to people in Brazil, the European Union, the United Kingdom and elsewhere. Because of that, Brazil's Lei Geral de Proteção de Dados (LGPD), the EU and UK GDPR, and the California Consumer Privacy Act as amended (CCPA/CPRA) each apply to us in respect of the people they protect. This policy is written to satisfy all of them at once, with the country-specific sections at the end.

1. What we collect

1.1 When you use the free calculator, without registering

• Birth date, and, if you choose to enter them, birth time and birth place.
• Usage data: IP address, browser type, operating system, device type, referring page, pages viewed, and timestamps.

We do not require a name, an email address or an account for this.

1.2 When you request the free personal periods calendar

• Email address
• Birth date, birth time, birth place
• Optionally, a first name or nickname, used only to address you

1.3 When you create an account

• Email address and a password, which we store only as a cryptographic hash
• Your saved charts and the reports you have generated
• Your settings and language preference

1.4 When you buy something

• The purchase itself: product, price, currency, date, and a transaction identifier
• A payment-processor customer ID, the card brand and the last four digits

We never receive or store your full card number. Payment details go directly to our payment processor.

1.5 When you use WhatsApp or Telegram with us

• Your phone number or messenger identifier
• The messages you send us and our replies

1.6 When you order a chart for a child

• The child's first name or nickname, birth date, birth time and birth place
• Confirmation that you are the child's parent or legal guardian, and your explicit consent given for that specific purpose

1.7 Data about other adults

Compatibility readings require the birth data of a second person. We process that data on your instruction. You are responsible for having their permission, as set out in section 5 of the Terms of Use. We do not contact that person, do not create an account for them, and do not use their data for anything except producing the reading you asked for.

2. What we do not collect

We do not ask for and do not want:

• your religion, philosophy, political opinion, race, ethnicity, sexual orientation or trade union membership;
• health data, including diagnoses, medication, pregnancy or fertility;
• biometric or genetic data;
• government identity numbers.

Our automated chat is built to decline questions in these areas rather than engage with them. If you nevertheless send us information of this kind, we will not use it to build a profile of you, and you can ask us to delete it at any time.

We recognise that in some jurisdictions, including Brazil, information revealing a philosophical or religious conviction is treated as sensitive personal data. We therefore do not infer, record or act on any conviction of yours, and we do not use your use of this Service as a signal about your beliefs for advertising or any other purpose.

3. Why we process it, and on what legal basis

Where we rely on legitimate interest, we have weighed it against your rights and you can object at any time — see section 8.

4. Automated processing and artificial intelligence

Your reports are produced automatically. We want you to understand precisely how, because the answer is also the point of the product.

• The calculations are deterministic. Positions, houses, periods and calendar values are computed by ephemeris software from the birth data you enter. The same input always produces the same output. Nothing is invented.
• The interpretive text is assembled by an AI system from a fixed editorial glossary written by us, keyed to the calculated values. It is not reviewed by a person before you receive it.
• We do not make automated decisions that produce legal effects for you or that similarly significantly affect you. We do not score you, profile you for creditworthiness, employment or insurance, or share any inference about you with anyone who does.

You have the right to ask us how a particular result was produced, and we will explain which calculation and which glossary entries generated it. You may also ask for a human to review a result you consider wrong. Write to privacy@iastral.ai.

5. Who we share it with

We do not sell your personal data. We do not share it for cross-context behavioural advertising.

We use the following processors, each of which receives only what it needs:

Each processor is bound by a written agreement to process data only on our instructions and to apply appropriate security measures.

We may also disclose data where required by law or valid legal process, to establish or defend legal claims, to prevent fraud or harm, or in connection with a merger, acquisition or sale of assets — in which case we will notify you before your data becomes subject to a materially different policy.

6. Where your data is processed

We process and store data on servers in the United States.

For personal data of individuals in the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses, together with supplementary technical measures, as the transfer mechanism.

For personal data of individuals in Brazil, we apply safeguards equivalent to those required by the ANPD's Regulation on International Data Transfers, including standard contractual clauses with our processors. Where you provide data directly to us through the Service, you are providing it to a controller established outside Brazil, and we remain subject to the LGPD in respect of that processing.

7. How long we keep it

After these periods data is deleted or irreversibly anonymised. If you ask us to delete your data sooner, we do so, keeping only what a legal obligation requires us to keep.

8. Your rights

Wherever you live, you can ask us to:

• confirm whether we process data about you, and give you access to it;
• correct anything inaccurate or incomplete;
• delete your data;
• port your data to you or to another provider in a structured, machine-readable format;
• restrict or object to processing based on legitimate interest;
• withdraw consent at any time, without affecting the lawfulness of what happened before;
• object to marketing, always and immediately;
• receive an explanation of how an automated result was produced, and request human review.

How: email privacy@iastral.ai, or use the controls in your account, where you can export or delete your data yourself.

Verification: we will match the request against the account it concerns. If we cannot verify you, we may ask for more information, and we will not disclose data to someone we cannot identify.

Timing: we respond within 15 days for requests under the LGPD where a simplified answer is due, and in any event within 30 days. Where the law allows an extension for complex requests we will tell you before the first period expires.

Cost: free, unless a request is manifestly unfounded or repetitive.

9. Children

The Service is for adults. You must be 18 or older to create an account or make a purchase, and we do not knowingly collect data from anyone under 18 acting on their own behalf. If we learn that we have, we delete it and close the account.

Charts ordered for a child. A parent or legal guardian may order a chart about their own child. In that case:

• consent is requested separately and prominently, at the point of purchase, for that specific purpose — it is never bundled into the general acceptance of the Terms;
• we take reasonable steps to confirm that the person consenting is an adult and is the child's parent or guardian;
• the child's data is used only to generate the report you ordered;
• it is never used for marketing, never used to create an account for the child, and never shared with any third party beyond the processors listed in section 5;
• it is deleted 30 days after delivery unless you choose to keep the chart in your account;
• you can delete it at any time, immediately, from your account.

We publish this section so that the information required by Article 14 of the LGPD about the types of data collected for children, their use, and how rights are exercised is publicly available.

10. Security

We protect data with encryption in transit (TLS), encryption at rest for stored birth data and account records, hashed passwords, access controls limiting access to personnel who need it, logging of administrative access, and regular review of our systems.

No system is perfectly secure. If a security incident occurs that is likely to create a risk or relevant damage to you, we will notify you and the competent supervisory authority within the time limits the applicable law requires.

11. Cookies

We use strictly necessary cookies to run the Service, and analytics cookies only where you have accepted them. See our Cookie Policy for the full list and for how to change your choice at any time.

12. Country-specific information

12.1 Brazil — LGPD

The LGPD applies to us because we offer the Service to individuals located in Brazil.

• Controller: Pixel Rainbow Inc. dba iastral, address above.
• Data protection contact (encarregado / channel for data subjects): privacy@iastral.ai. This is a monitored channel and requests are handled by a named responsible person within our team.
• Your rights under Article 18 of the LGPD are those listed in section 8 above, including confirmation of processing, access, correction, anonymisation or deletion of unnecessary or excessive data, portability, information about sharing, information about the consequences of refusing consent, and revocation of consent.
• Automated decisions: you may request a review of decisions taken solely on the basis of automated processing that affect your interests. See section 4 for how our processing works and how to ask.
• Complaints: you may lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

12.2 European Economic Area and United Kingdom — GDPR

Your rights are as set out in section 8. Legal bases are in section 3. Transfers are covered in section 6.

You have the right to lodge a complaint with the supervisory authority of your country of residence.

12.3 California — CCPA / CPRA

In the twelve months before the date of this policy we collected the following categories: identifiers (email address, account ID, IP address); commercial information (purchases); internet activity (usage data); and inferences drawn only from the birth data you supply, used solely to produce your report.

We have not sold personal information and have not shared it for cross-context behavioural advertising. We disclose personal information to the service providers listed in section 5 for the business purposes described there.

You have the right to know, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information, and not be discriminated against for exercising any of these rights. Email privacy@iastral.ai with the subject line "California Privacy Request". We respond within 45 days and may extend once by a further 45 days, telling you if we do. You may use an authorised agent with written authorisation.

13. Changes to this policy

We may update this policy. If a change is material we will post the new version with a new effective date and notify registered users by email at least 15 days before it takes effect. Previous versions are archived and available on request.

14. Contact

privacy@iastral.ai for anything in this policy or any request about your data.

legal@iastral.ai for formal legal notices.

Pixel Rainbow Inc. dba iastral

700 North Fairfax Str. STE 614, Alexandria, Virginia 22314, USA