Privacy notice
In force from 11 August 2026. Last changed: 10 November 2026.
This notice says which data we collect when you use AstraLunara, why we collect it, who it passes through and how long we keep it. It is written to be read, not filed away: if something is unclear, write to us and we will rewrite it. This is a translation of the Italian text, which is the one that governs.
Who processes your data
The data controller is HAWKSERVICE — Via del Sarago 1, 97016 Pozzallo (RG), Italy — VAT IT01734340886 — [email protected].
We have not appointed a Data Protection Officer, because for the kind and the amount of processing we carry out the appointment is not mandatory. For anything concerning your data write to [email protected]: the controller answers directly.
What we collect, and only when it is needed
The free tools — angel calculator, numerology, moon calendar, natal chart, tarot, affirmations — can be used without an account and without telling us who you are. What you type for a calculation serves that calculation and comes back to you as the result.
The data below is collected only at the moment a feature requires it.
| Data | When | Why | Legal basis |
|---|---|---|---|
| Name, email address, password (kept only as an irreversible hash, never in clear text) | When you create an account, or when you buy a Reading without having one: in that case we create it with the email you give us, and send you the password — generated by us — by email | Holding your readings and purchases together, and letting you back in | Performance of the contract (art. 6.1.b) |
| Full name and date of birth — yours, or of the person whose data you save or who the numerological Reading is for | When you save a profile or buy the Numerological and Kabbalistic Reading | They are the starting point of the calculation: without them the product does not exist | Performance of the contract (art. 6.1.b) |
| Date, time and place of birth, without the name — yours, or of the person the Natal Chart Reading is for | When you buy the Natal Chart Reading | They are the starting point of the chart calculation: without them the product does not exist | Performance of the contract (art. 6.1.b) |
| The text of your Reading and the PDF document | After the purchase | Delivering what you bought and letting you download it again | Performance of the contract (art. 6.1.b) |
| Order data: amount, date, transaction identifier, and the email you gave if you bought without an account | When you buy | Issuing and keeping tax records, answering a complaint | Legal obligation (art. 6.1.c) |
| The message you write to us from your area, with its topic and, if it concerns one, the Reading it refers to | When you ask us for more insight or for help | Answering you, and if needed making your Reading available again or writing it anew | Performance of the contract (art. 6.1.b) |
| Email address and IP address of sign-in attempts | When you sign in or try to | Limiting repeated attempts and protecting accounts | Legitimate interest in security (art. 6.1.f) |
| Action log: which tool was used and when, linked to your account identifier if you are signed in; it does not contain your name, email or the birth dates entered | Every time a tool is used, including without an account | Knowing which features are actually needed, in aggregate form | Legitimate interest in improving the service (art. 6.1.f) |
| Server logs: IP address, date and time, page requested, errors | On every request | Keeping the service running, finding faults, defending against abuse | Legitimate interest (art. 6.1.f) |
We do not collect payment data. Your card number never passes through our servers: payment happens on a Stripe page, and only the outcome comes back to us.
We do not ask for and do not want data about health, religious beliefs, sexual orientation or the other special categories of art. 9. If you write them to us spontaneously in a message, we process them only to reply and then delete them.
How we use artificial intelligence in the Readings
The Readings combine our calculations and original content with personalised texts automatically produced using artificial intelligence tools. For this purpose we use the services of the providers listed in the section “Who we pass data to”.
To prepare your Numerological and Kabbalistic Reading we send the name and the date of birth to the artificial intelligence service, which generates the text of the chapters. The meanings of the numbers and the angels are written by us, and they are the same ones you read for free on the site and form the basis of the Reading.
To prepare the Natal Chart Reading we send the same service the date, time and place of birth, and not the name: the chart does not need it, so we do not ask for it. We calculate the chart ourselves, and the meanings of the positions are the ones you read for free in the Natal chart.
If the primary provider does not respond, we use the alternative provider listed in the same section, with the same data and nothing more, to complete the Reading. When this happens we keep a record of it.
Three things worth spelling out:
- The data sent is not used to train the providers’ models: that is what our contracts with them for API use provide.
- The processing takes place in the United States. See the section on transfers below.
- There is no automated decision-making producing legal effects on you within the meaning of art. 22: the system writes a text, it does not take decisions about you. The Reading is material for personal reflection, not an assessment, not a diagnosis and not professional advice.
Preparing the Readings requires this processing. You can use the free tools without buying a Reading: their calculations run on our server and the data you enter is not sent to artificial intelligence providers.
Who we pass data to
We do not sell data and we do not hand it to anyone for their own purposes. We rely on these providers, who process it on our behalf and on our instructions, as processors within the meaning of art. 28.
| Provider | What it does | What it sees | Where |
|---|---|---|---|
| Railway | Hosts the application and the database | All the data we keep | European Union |
| Stripe Payments Europe, Ltd. | Takes the payments | Email, amount, card data (which stays with them) | Ireland, with transfers to the United States |
| Anthropic | Generates the text of the Readings | Numerological Reading: name and date of birth. Natal Chart Reading: date, time and place of birth, without the name | United States |
| OpenAI | Generates the text of the Readings when Anthropic does not respond | The same data sent to Anthropic, and only that | United States |
| Resend | Delivers service emails (order confirmation, Reading ready, password reset) | Email address and message content | United States |
| Umami (our own instance) | Counts visits without cookies and without identifying anyone | Page visited, in aggregate form | European Union |
We disclose data to other parties in two cases only: to our tax adviser for mandatory filings, and to judicial or police authorities when we are required to.
The names, coordinates and time zones of the birthplaces shown in the natal chart come from GeoNames (geonames.org), distributed under the Creative Commons Attribution 4.0 licence (creativecommons.org/licenses/by/4.0). We have reduced them to Italian municipalities and world cities above fifteen thousand inhabitants, and we keep them on our own server: GeoNames is not a provider and receives nothing of what you search for or enter.
Transfers outside the European Union
Three providers process data in the United States: Anthropic and, when Anthropic does not respond, OpenAI (the text of the Reading), and Resend (the emails). Stripe, although established in Ireland, may also transfer data to its United States parent company.
The transfer takes place on the basis of the European Commission’s adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, where the provider has certified under it, and in any case of the standard contractual clauses approved by the Commission, together with technical measures protecting data in transit.
We no longer rely on the Privacy Shield for any transfer: it was invalidated by the Court of Justice in 2020 and is not a valid safeguard.
How long we keep things
A stated retention period that is not enforced is worse than none. These are written into the code and carried out every night by automatic routines.
| What | How long | Then |
|---|---|---|
| Account and saved birth profiles | As long as you keep the account | Deleted when you ask for deletion |
| The Reading PDF document | 30 days from delivery | The file is genuinely deleted. The order and your calculations remain, so we can make it again |
| The generated text of the Reading | As long as you keep the account | It lets us reproduce the document without regenerating it, and answer a complaint |
| The messages you write to us from your area | 90 days after our reply, and never more than one year | Deleted automatically every night |
| Action log (linked to your account if you are signed in) | 365 days | Deleted automatically every night |
| Server logs | 12 months | Deleted |
| Tax records and order data | 10 years | It is the statutory term (art. 2220 of the Italian civil code), and we have no margin on it |
Your rights
You can ask us at any time to:
- tell you what data we hold about you and give you a copy (arts. 15 and 20);
- correct what is wrong or incomplete (art. 16);
- delete your data (art. 17), except what we are required by law to keep — in practice the tax records;
- restrict or object to processing based on our legitimate interest (arts. 18 and 21);
- withdraw a consent you gave us, without affecting what was done before.
Write to [email protected]. We answer within one month; if the request is complex we may take up to two months more, but in that case we tell you within the first.
If you believe we are handling your data improperly you can lodge a complaint with the Italian Garante per la protezione dei dati personali (www.garanteprivacy.it) or with the supervisory authority of the country where you live.
How we protect the data
We do not know your password: it is stored as an irreversible hash. Traffic is encrypted in transit. Access to your documents goes through signed links that expire. The PDF file name is random and contains neither your name nor your date of birth, so it does not end up in server logs or in browser history.
No measure makes a system impenetrable. Should a breach occur that entails a high risk to your rights, we will tell you without undue delay, as art. 34 requires.
Children
The service is not directed at children under 14 and we do not knowingly collect their data. If you notice that a child has given us data, write to us: we will delete it.
If we change this notice
The date at the top says when it was last changed. If something substantial changes — a new provider handling your data, a new purpose — we tell you by email before the change takes effect, and not merely by updating this page quietly.