1. What we collect
- Your account: name, work email, password (stored only as a hash), company name, your mobile number if you give one, and your team members and their roles.
- Sign-ins: the IP address and browser of each sign-in, to keep you signed in and to spot misuse.
- API keys: only a hash of each key, plus its first and last few characters so you can recognize it. We never store the full key.
- API usage: for each call, the time, key, endpoint, status, timing and request ID; counts of calls, errors and reading credits; for failed calls, the error and our answer with personal details removed; and, per key, a hashed form of the calling IP address, the country and the client type, to protect you from stolen keys. None of this holds birth details or the names you send.
- Billing: your plan, payments and invoices. Dodo Payments handles your card; we never see the full card number.
- Messages: what you send through the contact form or a "notify me" sign-up.
- Website use: Google Analytics records pages viewed, how visitors arrived, their device, browser and country, and a few actions such as signing up. It never receives your name, email, API keys or birth details. Google reCAPTCHA checks our sign-up, contact and password forms for bots.
2. Birth details and names you send to the API
The API uses the dates, times, places and names in a request only to compute the answer. We do not store request bodies. Web addresses (URLs) can appear in server logs, so send birth details and names in the body of a POST request, not in the URL.
If you send your users' details, you decide how they are used, and you are responsible for telling your users and getting any consent the law requires. Business customers can ask for a data processing addendum (DPA) at the privacy email below.
3. Why we use it
- To run your account, your keys, billing and the API (our contract with you).
- To keep the service safe and stop abuse, including linking accounts run by the same person (legitimate interest).
- To understand and improve this website (legitimate interest).
- To reply to your messages (your request).
5. How long we keep it
- Account, team and settings
- While your account is open. We delete it within 30 days after you ask us to close the account.
- API keys
- Only a hash, while the key exists.
- Birth details and names in request bodies
- Never stored.
- Per-key usage signals (hashed IP, country, client type)
- 30 days.
- Daily usage counts
- 2 years.
- Account activity history
- 2 years.
- Contact-form messages and "notify me" sign-ups
- Up to 24 months.
- Sign-in sessions
- Until they end, 7 days after your last use.
- Google Analytics data
- 14 months.
After a period ends, the data is deleted in a regular cleanup within the following 30 days.
6. Your rights
You can ask to see, correct, export or delete your data, or object to how we use it. Email privacy@apiforastrology.com. These rights apply wherever you live, including under the GDPR (EU and UK), the CCPA (California) and India's Digital Personal Data Protection Act. You can also complain to your local data protection authority.
8. Security
We use HTTPS, store passwords and API keys only as hashes, and limit database access to the people who run the service. Our security page explains more. No service can promise perfect security. If a breach affects your data, we will tell you as the law requires.
9. Children
The service is not for anyone under 18, and we do not knowingly collect their data.
10. Changes to this policy
The date at the top shows when this policy last changed. For an important change, we email account owners before it applies.
11. Contact
Privacy questions: privacy@apiforastrology.com. Anything else: the contact form.