GDPR-ready astrology API for EU developers

The first astrology API with full EU-residency. If you’re building a B2C product for the European market, GDPR compliance becomes a question before you write your first line of code. AstroWay solves it by default - no extra tier, no legal gymnastics.

Why this matters

Every other astrology API (DivineAPI, AstrologyAPI, Prokerala) is US/India-hosted. That means:

Your birth.date, birth.time, birth.lat, birth.lon (=PII under GDPR) flows through US/India.
Subprocessor disclosure for your privacy policy: you have to list their jurisdiction.
DPA (Data Processing Agreement): either unavailable, or only on Enterprise via separate contract.
EU Data Protection Authority audit risk: cross-border transfer without SCC = €10M+ fines.

AstroWay on the Pro tier ($59/mo) gives you EU-residency by default: all data is stored and computed in Hetzner Nuremberg. We administer those machines from Ukraine, and the DPA covers that access with the Standard Contractual Clauses rather than pretending it does not happen.

Technical stack

Layer	Location / provider
Compute	Hetzner, Nuremberg (Germany)
Database	EU-resident, in the same data centre - data never leaves Nuremberg
CDN / DNS	Cloudflare with EU-region cache rules (EU requests served by EU edges)
Email transactional	Brevo (formerly Sendinblue), EU-based, GDPR-compliant SMTP
Report files	Our own infrastructure in Nuremberg: reachable only through a signed link with a limited lifetime, with no replication outside the EU
Analytics	GA4 with anonymize_ip + no PII in events (Plausible self-hosted on roadmap)
Logs	structured JSON, IP-hash only (no raw IPs), 30-day retention

By default (all Pro+ keys)

✅ EU-only data flow: birth-data never leaves Nuremberg
✅ Data stays in the EU, and we say precisely what that means: birth data is stored and computed in Nuremberg and copied nowhere else. We administer those systems from Ukraine, which Chapter V counts as a transfer even when nothing leaves the country, so the DPA covers that access with the Standard Contractual Clauses
✅ IP hashing: logs keep a salted SHA-256 plus the first 16 bits of the address, which name a network rather than a host. The address itself is stored nowhere: rate limiting counts in process memory and writes no address either
✅ 30-day log retention: auto-deleted after that
⚠️ Anonymized analytics (GA4): anonymize_ip enabled, no PII in events. Plausible self-hosted (cookie-free) is on the roadmap. Until then, use your own cookie banner on B2C frontends.
✅ Right to erasure: DELETE /v1/me/account (Bearer JWT, body {"confirmation": "DELETE"}) switches every key on the account off at once and schedules deletion 30 days out. Within that window POST /v1/me/account/cancel-deletion takes it back; after it, a daily job erases what we hold about you. The window is deliberate: deletion should not be irreversible on one mistaken command

On request (Pro+ subscribers)

📄 DPA (Data Processing Agreement): standard GDPR Art. 28 template. Read the full text, accept it with a button in the dashboard, and download a PDF that carries the acceptance record: account, version, date. Article 28(9) takes the contract “in writing, including in electronic form”, so there is nothing to wait for. A countersigned paper copy on request at legal@astroway.info.
📋 Sub-processor list: full breakdown (Hetzner, Cloudflare, our SMTP provider and our payment provider) with each provider’s compliance docs. Brevo as the SMTP vendor is named in the DPA appendix for customers who sign it.
🗂️ DPIA (Data Protection Impact Assessment) input: if your legal team runs a DPIA on your product, we provide the technical sheet from our side.

For Enterprise customers (custom-tier)

🛡️ SOC 2 Type II: on the roadmap (audit firm not yet engaged, ETA TBD). If this blocks your integration - email legal@astroway.info; we’re open to a dedicated audit engagement.
🇪🇺 EU-only legal entity: current legal form is a Ukrainian sole-trader (Maxim Burkhan). If your procurement requires an EU GmbH (Germany / Estonia), we’ll discuss case-by-case via legal@astroway.info; standard timeline 4-8 weeks.
🔐 Dedicated infra option: a dedicated server in Nuremberg and an isolated database
📞 Direct security contact: security@astroway.info for incident response

Comparison: AstroWay vs US-hosted competitors

Critical for the EU developer	AstroWay Pro $59	DivineAPI	AstrologyAPI	Prokerala
EU-hosted compute	✅ Hetzner Nuremberg	❌ US	❌ US	❌ India
Standard DPA available	✅ on Pro+	❌ enterprise only	❌ enterprise only	❌ enterprise only
GDPR-compliant by default	✅ infrastructure-level	⚠️ via SCC	⚠️ via SCC	⚠️ via SCC
Cookie-free analytics	⚠️ GA4 anonymized (Plausible roadmap)	❌ GA4	❌ GA4	❌ GA4
EU-only data flow guarantee	✅ in writing	❌	❌	❌
DPIA technical input	✅ provided	❌	❌	❌
Right to erasure endpoint	✅ `DELETE /v1/me/account`	❌ ticket-based	❌ ticket-based	❌ ticket-based

Pricing

EU-residency, DPA, infrastructure-level GDPR - everything included in Pro $59/mo. No separate tier, no sales call, no custom pricing.

This is a deliberate strategy: Hetzner-residency costs us nothing extra (our infrastructure is in Nuremberg anyway), and DPA is a standard template signed once over email. There’s no reason to charge for privacy that should have been the default.

FAQ

Yes - Free runs on the same infrastructure (Hetzner Nuremberg), the same anonymized analytics, the same 30-day log retention. DPA is not available on Free (it’s an admin overhead that only pays off on a paid tier), but technically the data is processed identically.

If your legal team requires a signed DPA, Indie ($5/mo) doesn’t get it either. The cheapest tier with DPA is Pro $59.

What about Schrems II? Cloudflare CDN is a US company, isn’t it?

Cloudflare is a US company, but we use EU-region cache rules (EU IP requests are served by EU edges), and the origin server (where data is actually processed) is Hetzner Nuremberg. PII (birth-data) traverses the Cloudflare edge in the same region and is not stored on the edge - only in transit.

For ultra-sensitive use cases (medical apps, B2G), Cloudflare can be bypassed with DNS pointing directly at the origin - email legal@astroway.info.

How fast do I get the DPA after subscribing to Pro?

Standard DPA (our template): instantly. The text is open at /en/legal/dpa/, you accept it in the dashboard, and the PDF you download from there carries the acceptance record.
Custom redlines from your lawyer: we will look at them, but we do not promise a turnaround, because we do not keep a lawyer on staff. The standard Art. 28 clauses are not up for negotiation: they come from the Commission’s own template precisely so that nobody has to argue about them.

Do I need a DPA if I’m a B2B developer without my own PII?

If your end product handles PII (and birth-data is PII), your lawyer will likely want a signed DPA with all sub-processors. We provide it as standard. If your integration is internal (employees only), DPA is probably not critical, but it’s still a good idea to sign it.

What does AstroWay do when I call `DELETE /v1/me/account`?

API keys: soft-deleted (is_active = 0 for anti-abuse cooldown)
Account-to-key link: severed; key cannot be re-associated
User profile: flagged as deleted with timestamp
Usage logs: IP-hash no longer PII, kept for billing audit
Order history: retained, because tax law requires it. For a Ukrainian sole proprietor that is 1095 days under §44.3 of the Tax Code, three years rather than seven, and GDPR Art. 17 §3(b) leaves such records outside the right to erasure
Transactional email: auto-cleaned by our SMTP provider after 90 days

Full flow available on request via legal@astroway.info.

Contacts

Legal/DPA: legal@astroway.info
Security incidents: security@astroway.info
Subprocessor list / DPIA: hello@astroway.info

Was this helpful?

Suggest an edit

Last updated: Sep 20, 2026

// Previous

Per-endpoint Cost

Next //

Founders' Lifetime Deal