Data Processing Agreement

Data Processing Agreement, version 4

Effective 2026-11-07. AstroWay API, api.astroway.info. Changed from version 3 (2026-11-03): the agreement covers every plan, the Free plan included; section 8 sets breach notice at no later than 48 hours after we become aware of a breach.

1. Who we are and what this covers

This agreement is between you, the Customer, acting as data controller, and Maksym Burkhan, individual entrepreneur (ФОП), Ukraine, operating api.astroway.info as your data processor under Article 28 GDPR.

It applies for as long as your account exists and you send requests to the API, and it governs only the data you send through the API. Your own account details are a separate matter, where we are the controller and our privacy policy applies.

2. What we process, and why

Subject matter and purpose. You send birth data to the API: a date, a clock time, a timezone or offset, and coordinates. We compute an astrological result and return it. That is the whole purpose, and the API call is your instruction.

Categories of data subjects. Your end users, or anyone whose birth moment you submit.

Types of data. Date and time of birth, coordinates, and the optional name and city fields. name and city are not stored by any endpoint that returns its result in the response: they are held in memory for the duration of the request and written nowhere.

Report files. A PDF report from /v1/reports/* is a file we keep on your instruction, so that you can fetch it from its link. It holds what you sent for it, including the name if you sent one. It is kept 24 hours, or the number of days you set with retain_days, at most 90, and deleted by a cleanup that runs every six hours, so within six hours of that. You can delete it sooner with DELETE /v1/reports/files/{filename}. A report requested with format=html is returned in the response and not kept. The log of your reports keeps the type, size, language and dates, never the birth data or the name.

Duration. For the life of your account, subject to section 9.

What we log about the call rather than the person. Endpoint, method, status, latency, byte counts, a salted irreversible digest of the caller’s IP address and the first 16 bits of that address, the User-Agent, the origin, and a coarse country, city and network operator. We keep that for 30 days.

AI endpoints. /v1/interpret/*, /v1/horoscope/*, /v1/reports/ai/* and /v1/ai/* write their text with third-party language models. Those providers receive the computed chart only: signs, houses and aspects with whole-degree orbs. They never receive the birth date, time, coordinates, name or place you sent, which is why they are not sub-processors under section 4. Free text you write yourself, such as a tarot question or a chat message, is passed to the model as written.

3. What we undertake

• We process your data only on your documented instructions, which are the API calls you make and any written instruction you send us, unless EU or member-state law requires otherwise, in which case we tell you before processing unless that law forbids it.
• If an instruction looks unlawful to us, we say so immediately rather than carrying it out quietly.
• The service is operated by one person, who is bound to confidentiality and is the only human with administrative access.
• We keep the security measures in section 5.
• We help you answer a data subject’s request, and help with your obligations under Articles 32 to 36, insofar as that is possible and taking into account what we hold. That qualifier is the law’s own, and here it is concrete: apart from report files while they last (section 2), we store no name, no email and no identifier for your end users, so we usually cannot find one person’s rows on our side. You can, through your own records, and DELETE /v1/me/account erases everything we hold for your account.
• We do not use your data for our own purposes, do not sell it, and do not use it to train models.

4. Sub-processors

Two, and they are the infrastructure:

Sub-processor	Role	Location
Hetzner Online GmbH	compute, database and file storage	Nuremberg, Germany
Cloudflare, Inc.	CDN, DNS and DDoS protection, with EU-region cache rules	US company, EU edges serve EU traffic

We impose the same data-protection obligations on them as we carry here, and we remain fully liable to you for what they do.

You give general authorisation for these two. We will tell you by email at least 14 days before adding or replacing one, and you may object on reasonable data-protection grounds; if we cannot resolve the objection, you may stop using the service and we refund the unused part of any period you paid for.

Our payment and email vendors are deliberately not in that table, because they never see data covered by this agreement. Brevo sends transactional mail to you, and Monobank takes card payments, with LiqPay being added in October 2026. Both concern your account rather than your end users, so they are named in the privacy policy instead.

5. Security

• Transport is TLS only, and plain HTTP is redirected.
• Passwords are hashed with bcrypt. API keys have been stored only as a SHA-256 hash since 2026-10-15, so a key is shown once, when it is created. Encrypted backups taken before that date age out by 2027-01-13.
• IP addresses are stored only as a salted SHA-256, computed as the row is written. The salt lives in the server environment, never in the code.
• Database accounts are separated per consumer, each with the narrowest grant that works, and the database listens on loopback only.
• Backups are encrypted with AES-256 before they leave the machine.
• Administrative access is by SSH key, one person, no shared credentials.

What we do not have, because claiming it would be worse than saying it: we hold no SOC 2 report and no ISO 27001 certificate of our own. Hetzner holds ISO/IEC 27001 for the data centre our servers sit in.

6. Transfers, stated plainly

Your data is processed on servers in Nuremberg, Germany, and we do not replicate it outside the EEA.

We are nevertheless established in Ukraine, which has no adequacy decision under Article 45. Under EDPB Guidelines 05/2021 that alone makes this a transfer to a third country, and so does administrative access from Ukraine to those German servers, because remote access counts even when nothing is copied. So we do not tell you there is no cross-border transfer; there is one, and this is what covers it.

We enter into the Standard Contractual Clauses of Implementing Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated into this agreement by reference and prevail over it if the two conflict. Sections 2, 5 and 4 of this agreement serve as Annexes I, II and III respectively. A signed copy naming both parties is available on request at legal@astroway.info.

The choices the Clauses leave to the parties are these. Clause 7 (docking) and the optional wording of Clause 11 do not apply. Under Clause 9(a) we use Option 2, general written authorisation, with the 14 days of section 4. Under Clause 17, Option 1, the Clauses are governed by the law of Germany, and under Clause 18 the courts of Germany have jurisdiction. The competent supervisory authority for Annex I.C is the one Clause 13 makes competent for you as the exporter.

What is transferred in practice is authenticated administrative access to systems in Germany, not the export of a database.

If UK data protection law applies to you (the UK GDPR and the Data Protection Act 2018), this agreement reads with it in place of the GDPR wherever the two differ, and the Information Commissioner is the supervisory authority. Our servers are in the EEA, which UK law treats as adequate. Ukraine is not covered by UK adequacy regulations, so administrative access from Ukraine is a restricted transfer.

For that transfer the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, in force 21 March 2022, issued by the Information Commissioner under section 119A of the Data Protection Act 2018, is incorporated into this agreement by reference. Its Part 2 Mandatory Clauses apply as issued, including their replacement of Clauses 17 and 18: for a transfer under this Addendum, the Clauses are governed by the laws of England and Wales and disputes go to the courts of England and Wales. Its Part 1 tables are completed as follows.

Table	Content
1. Start date	The date you accept this version
1. Exporter	You, with the details on your account; key contact your account email
1. Importer	Maksym Burkhan, individual entrepreneur (ФОП), Ukraine; key contact legal@astroway.info; full address in the signed copy
1. Signatures	The acceptance record of section 10
2. Selected SCCs	Module Two, with the choices stated above in this section
3. Appendix	Annex IA: table 1. Annex IB: section 2. Annex II: section 5. Annex III: section 4
4. Ending it	The Exporter may end the Addendum as its Section 19 sets out

The transfer risk assessment UK law asks for is yours to make as the exporter. We answer what you need for it free of charge, under section 7.

7. Showing that we comply

We give you the information you need to demonstrate compliance with Article 28 through this agreement and our security description above, and we will complete one reasonable written security questionnaire in any twelve-month period at no charge.

If that is not enough, you may audit compliance with this agreement once in any twelve-month period, on thirty days’ written notice, remotely, during business hours, covering only the processing we carry out for you and never another customer’s data. You bear the cost of the audit and of any auditor you appoint. These limits do not apply where a supervisory authority requires an inspection.

8. If there is a breach

We notify you without undue delay, and no later than 48 hours, after becoming aware of a personal data breach affecting data we process for you, by email to your account address. The first notification may be incomplete, and we follow up as we learn more.

We hold no contact details for your end users, so notifying them under Article 34 remains yours to do.

9. Ending it

When your account ends, tell us whether you want the data we hold for you returned or deleted, and we do that. If you tell us nothing, we delete it.

The one exception is what tax law requires us to keep: payment records, for 1095 days under §44.3 of the Ukrainian Tax Code. Three years, not the seven an earlier draft of this text guessed at. Article 17(3)(b) GDPR leaves records kept for a legal obligation outside the right to erasure, which is why a deletion request does not reach them.

10. Accepting this agreement

You accept it in your dashboard, and the record of that acceptance names your account, the version and the moment. Article 28(9) requires the contract to be in writing, “including in electronic form”, so that record is the contract and there is nothing to wait for. The PDF you can download carries the same record. A countersigned paper copy is available on request.

If we change this text materially, it becomes a new version and we ask you to accept that one; the version you accepted stays the one you agreed to.