Data Processing Agreement

This Data Processing Agreement (“DPA”) describes how AstroStella (“we,” “us,” or “the Controller”) processes personal data in connection with the AstroStella mobile application and related services. This DPA supplements our Privacy Policy and provides additional detail required under the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

1. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person (“Data Subject”).
• Processing: Any operation performed on Personal Data, including collection, storage, use, transfer, and deletion.
• Controller: AstroStella, which determines the purposes and means of processing.
• Processor: A third party that processes Personal Data on behalf of the Controller.
• Sub-processor: A third party engaged by a Processor to assist in processing.

2. Categories of Data Subjects

• Registered users of the AstroStella mobile application.
• Users who interact with AstroStella’s features without a paid subscription (free tier).
• Paid subscribers (Celestial tier).

3. Categories of Personal Data Processed

3.1 Identity Data

Email address, display name, Firebase user ID.

3.2 Birth Data

Date of birth, time of birth, place of birth (city, country, geographic coordinates). Processed to generate astrological charts and personalized horoscopes.

3.3 Reading Data

Tarot reading history, palm reading results, horoscope history, and AI chat session content. Stored to provide reading history and personalized insights.

3.4 Usage Data

Feature usage counters (tarot readings today, palm readings this week, chat messages today). Used for rate-limiting enforcement only, not behavioral analytics.

3.5 Technical Data

Device push notification tokens (via OneSignal), subscription status (via RevenueCat), app version.

3.6 Consent Records

Records of which data processing activities the user has consented to (birth data use, reading history analysis, usage analytics, personalized offers, marketing communications).

4. Purposes and Legal Basis for Processing

5. Sub-processors

We engage the following sub-processors to deliver the AstroStella service:

All US-based sub-processors provide adequate safeguards through Standard Contractual Clauses (SCCs) or equivalent mechanisms as required by GDPR Chapter V.

6. Data Security Measures

We implement the following technical and organizational measures:

• All data in transit is encrypted using TLS 1.2 or higher.
• Data at rest in Cloud Firestore is encrypted by default (AES-256).
• Firebase Authentication manages secure credential handling and session tokens.
• Firestore Security Rules enforce document-level access control (users can only access their own data).
• Cloud Functions run in isolated serverless environments with least-privilege service accounts.
• Sensitive client-side data (tokens, keys) is stored in encrypted device storage via Flutter Secure Storage.
• Palm images are processed in memory on the device and server; they are not persisted to disk after analysis.

7. Data Subject Rights

Data subjects may exercise the following rights through the App (Settings > Privacy) or by contacting [email protected]:

• Right of Access (Art. 15): Export personal data via the in-app data export feature.
• Right to Rectification (Art. 16): Edit profile and birth data via Edit Profile.
• Right to Erasure (Art. 17): Delete account and all data via Delete My Account.
• Right to Restriction (Art. 18): Toggle individual consent settings in Privacy Settings.
• Right to Data Portability (Art. 20): Export data as JSON via the export feature.
• Right to Object (Art. 21): Withdraw consent for analytics, marketing, or personalized offers.

We will respond to all data subject requests within 30 calendar days.

8. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of data subjects, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach.
• Notify affected data subjects without undue delay if the breach is likely to result in a high risk to their rights and freedoms.
• Document all breaches, including facts, effects, and remedial actions taken.

9. International Transfers

Primary data processing occurs in the EU (europe-west1, Belgium). Where data is transferred to the United States (RevenueCat, OneSignal, Mapbox), transfers are protected by Standard Contractual Clauses approved by the European Commission, or by the processor’s participation in an adequate transfer framework.

10. Data Retention Schedule

• Account data: Retained while the account is active. Deleted within 30 days of account deletion.
• Reading history: Retained while the account is active. Automated cleanup removes readings older than 12 months for free-tier users.
• Usage counters: Reset daily/weekly as appropriate. Historical counters are not retained.
• Chat sessions: Retained while the account is active. Deleted with the account.
• Backups: Automated backups containing personal data are purged within 90 days of account deletion.

11. CCPA Disclosures

For California residents:

• We do not sell personal information.
• We do not share personal information for cross-context behavioral advertising.
• Categories of personal information collected: identifiers (email, name), geolocation (birth place), and internet/electronic activity (feature usage counts).
• You may exercise your rights under the CCPA by contacting [email protected] or using the in-app privacy controls.

12. Contact

For questions about this Data Processing Agreement:

AstroStella
Email: [email protected]