GDPR-ready astrology API for EU developers

Last updated Nov 6, 2026 View as Markdown Agent setup

An astrology API with full EU-residency. If you’re building a B2C product for the European market, GDPR compliance becomes a question before you write your first line of code. AstroWay solves it by default - no extra tier, no legal gymnastics.

Why this matters

Most astrology APIs (DivineAPI, AstrologyAPI, Prokerala) are hosted in India or the US. That means:

Your birth.date, birth.time, birth.lat, birth.lon (=PII under GDPR) flows through US/India.
Subprocessor disclosure for your privacy policy: you have to list their jurisdiction.
DPA (Data Processing Agreement): either unavailable, or a document you request by email and sign.
EU Data Protection Authority audit risk: cross-border transfer without SCC = €10M+ fines.

AstroWay on every plan, Free included, gives you EU-residency by default: all data is stored and computed in Hetzner Nuremberg. We administer those machines from Ukraine, and the DPA covers that access with the Standard Contractual Clauses rather than pretending it does not happen.

Technical stack

Layer	Location / provider
Compute	Hetzner, Nuremberg (Germany)
Database	EU-resident, in the same data centre - data never leaves Nuremberg
CDN / DNS	Cloudflare with EU-region cache rules (EU requests served by EU edges)
Email transactional	Brevo (formerly Sendinblue), EU-based, GDPR-compliant SMTP
Report files	Our own infrastructure in Nuremberg: reachable only through a signed link with a limited lifetime, with no replication outside the EU
Analytics	GA4 with anonymize_ip + no PII in events (Plausible self-hosted on roadmap)
Logs	structured JSON, IP-hash only (no raw IPs), 30-day retention

By default (all keys)

✅ EU-only data flow: birth-data never leaves Nuremberg
✅ Data stays in the EU, and we say precisely what that means: birth data is stored and computed in Nuremberg and copied nowhere else. We administer those systems from Ukraine, which Chapter V counts as a transfer even when nothing leaves the country, so the DPA covers that access with the Standard Contractual Clauses
✅ IP hashing: logs keep a salted SHA-256 plus the first 16 bits of the address, which name a network rather than a host. The address itself is stored nowhere: rate limiting counts in process memory and writes no address either
✅ 30-day log retention: auto-deleted after that
⚠️ Anonymized analytics (GA4): anonymize_ip enabled, no PII in events. Plausible self-hosted (cookie-free) is on the roadmap. Until then, use your own cookie banner on B2C frontends.
✅ Right to erasure: DELETE /v1/me/account (Bearer JWT, body {"confirmation": "DELETE"}) switches every key on the account off at once and schedules deletion 30 days out. Within that window POST /v1/me/account/cancel-deletion takes it back; after it, a daily job erases what we hold about you. The window is deliberate: deletion should not be irreversible on one mistaken command

With any paid plan, from Indie

📄 DPA (Data Processing Agreement): standard GDPR Art. 28 template. Read the full text, accept it with a button in the dashboard, and download a PDF that carries the acceptance record: account, version, date. Article 28(9) takes the contract “in writing, including in electronic form”, so there is nothing to wait for. A countersigned paper copy on request at legal@astroway.info.
📋 Sub-processor list: full breakdown (Hetzner, Cloudflare, our SMTP provider and our payment provider) with each provider’s compliance docs. Only Hetzner and Cloudflare are in the DPA, since your request data passes through them; Brevo and the payment provider process account data, so they are named in the privacy policy.
🗂️ DPIA (Data Protection Impact Assessment) input: if your legal team runs a DPIA on your product, we provide the technical sheet from our side.

For Enterprise customers (custom-tier)

🛡️ SOC 2 Type II: on the roadmap (audit firm not yet engaged, ETA TBD). If this blocks your integration - email legal@astroway.info; we’re open to a dedicated audit engagement.
🇪🇺 EU-only legal entity: current legal form is a Ukrainian sole-trader (Maxim Burkhan). If your procurement requires an EU GmbH (Germany / Estonia), we’ll discuss case-by-case via legal@astroway.info; standard timeline 4-8 weeks.
🔐 Dedicated infra option: a dedicated server in Nuremberg and an isolated database
📞 Direct security contact: security@astroway.info for incident response

Comparison with other astrology APIs

Checked on 2026-10-18 against each vendor’s own trust, privacy, DPA and terms pages, and the RoxyAPI column again on 2026-11-07. If one of them has changed since, tell us at legal@astroway.info and we will correct the row.

Critical for the EU developer	AstroWay	RoxyAPI	astrology-api.io	DivineAPI	AstrologyAPI	Prokerala
Where data is stored	✅ Hetzner, Nuremberg	✅ Hetzner, Nuremberg	⚠️ “in the EU”, provider not named	❌ India (AWS, DigitalOcean)	❌ India and US (AWS, Google Cloud)	❌ India
DPA	✅ every plan, Free included, accepted with a button	✅ every plan, applies without signing	❌ none published	⚠️ PDF you sign and email back	⚠️ on request, signed by both sides	❌ none
Public sub-processor list	✅	✅	❌	✅	✅	❌
Request log kept	30 days	120 days	30 days	90 days	endpoint name and status only	not stated
Backups encrypted	✅ AES-256	not stated	not stated	✅ AES-256	not stated	not stated
Account deletion	✅ self-serve: `DELETE /v1/me/account` or the dashboard	⚠️ by request, within 30 days	✅ dashboard	⚠️ by email, within 7 days	⚠️ by email	❌ no process described
Site analytics	⚠️ GA4, anonymized	✅ no third-party analytics	⚠️ “basic analytics”, tool not named	⚠️ cookies, provider not named	❌ GA4, Tag Manager, Intercom	not stated

Pricing

EU-residency, infrastructure-level GDPR and the DPA come with every plan, the Free plan included. No separate tier, no sales call, no custom pricing.

This is a deliberate strategy: Hetzner-residency costs us nothing extra (our infrastructure is in Nuremberg anyway), and the DPA is a standard template accepted once with a button in the dashboard. There’s no reason to charge for privacy that should have been the default.

FAQ

Yes - Free runs on the same infrastructure (Hetzner Nuremberg), the same anonymized analytics, the same 30-day log retention. The DPA covers Free too, since version 4 of 2026-11-07.

If your legal team requires a DPA, the Free plan already has it: accept it in the dashboard and download the PDF with the acceptance record.

What about Schrems II? Cloudflare CDN is a US company, isn’t it?

Cloudflare is a US company, but we use EU-region cache rules (EU IP requests are served by EU edges), and the origin server (where data is actually processed) is Hetzner Nuremberg. PII (birth-data) traverses the Cloudflare edge in the same region and is not stored on the edge - only in transit.

For ultra-sensitive use cases (medical apps, B2G), Cloudflare can be bypassed with DNS pointing directly at the origin - email legal@astroway.info.

How fast do I get the DPA after paying for a plan?

Standard DPA (our template): instantly. The text is open at /en/legal/dpa/, you accept it in the dashboard, and the PDF you download from there carries the acceptance record.
Custom redlines from your lawyer: we will look at them, but we do not promise a turnaround, because we do not keep a lawyer on staff. The standard Art. 28 clauses are not up for negotiation: they come from the Commission’s own template precisely so that nobody has to argue about them.

Do I need a DPA if I’m a B2B developer without my own PII?

If your end product handles PII (and birth-data is PII), your lawyer will likely want a signed DPA with all sub-processors. We provide it as standard. If your integration is internal (employees only), DPA is probably not critical, but it’s still a good idea to sign it.

What does AstroWay do when I call `DELETE /v1/me/account`?

API keys: soft-deleted (is_active = 0 for anti-abuse cooldown)
Account-to-key link: severed; key cannot be re-associated
User profile: flagged as deleted with timestamp
Usage logs: IP-hash no longer PII, kept for billing audit
Order history: retained, because tax law requires it. For a Ukrainian sole proprietor that is 1095 days under §44.3 of the Tax Code, three years rather than seven, and GDPR Art. 17 §3(b) leaves such records outside the right to erasure
Transactional email: auto-cleaned by our SMTP provider after 90 days

Full flow available on request via legal@astroway.info.

Contacts

Legal/DPA: legal@astroway.info
Security incidents: security@astroway.info
Subprocessor list / DPIA: hello@astroway.info

Trust and data handling