Last updated: November 3, 2026
1. Who we are
AstroWay API is an astrology calculation service operating at api.astroway.info. Operator: sole proprietor Maksym Burkhan, Ukraine.
2. What data we collect
2.1 Account data
- Email address (for registration and communication).
- Hashed password.
- Selected plan.
2.2 API request data
- Request parameters (date, time, coordinates) are processed in memory and not written to the request log. For credit accounting we keep only daily counters: key, endpoint, day, request count and credits.
- We do NOT store names, cities, or any identifying data of your app’s end users. These fields are optional and processed only in memory.
2.3 AI endpoints (audit log)
- For
/interpret/*and/horoscope/*: input parameters (date, coordinates) and generated text are stored for 90 days for audit trail and service quality. - IP addresses are stored as SHA-256 hashes (irreversible): for rate limiting and anti-abuse.
2.4 Technical data
- IP address (salted SHA-256 and the first 16 bits), User-Agent, origin, coarse location from the IP (country, city, network), request time: the request log, 30-day rotation.
3. How we use data
- Service delivery: running calculations, credit accounting, rate limiting.
- AI content quality: audit log analysis to improve system prompts and safety filters.
- Communication: service changes, SLA incidents, terms updates.
- Anti-abuse: detecting free-tier abuse and attacks.
We do NOT:
- Sell your data to third parties.
- Use data for targeted advertising.
- Share calculation data with other users.
4. Storage and security
- Data is stored on a dedicated VPS in the EU (Hetzner, Nuremberg, Germany).
- API connections: HTTPS only, plain HTTP is redirected.
- Passwords hashed via bcrypt.
- IP addresses stored as salted SHA-256 hashes.
- Database access: localhost only (not exposed externally).
5. Data retention
| Data type | Retention |
|---|---|
| Account | Until account deletion |
| Daily usage counters (key, endpoint, count, credits) | 365 days |
| AI audit log | 90 days |
| Request log (no request parameters) | 30 days |
PDF report files (/v1/reports/*) | 24 hours, or retain_days up to 90, at your request |
6. Your rights (GDPR)
As a data subject, you have the right to:
- Access: request a copy of all your data via Dashboard or email.
- Deletion: delete your account and all related data via Dashboard or email.
- Rectification: update email or profile via Dashboard.
- Portability: export data in JSON format.
- Objection: opt out of data processing for marketing (we don’t do marketing anyway).
To exercise your rights, contact: api@astroway.info. Response within 30 days.
If you are in the United Kingdom, the same rights apply under the UK GDPR, and you can complain to the Information Commissioner’s Office (ico.org.uk).
7. Cookies
AstroWay API uses no cookies. The Dashboard uses:
- Session token (localStorage): for authentication. Cleared on logout.
8. Third parties
- AI providers: top-tier market LLMs (Google Gemini, Groq, OpenRouter, Mistral, and others) routed through our private AI gateway with multi-provider failover. They receive only the computed chart (signs, houses, aspects). No birth date, time, coordinates, name or place from your request reaches them. Each provider has its own privacy policy.
- Cloudflare: CDN and DDoS protection. Processes HTTP requests before routing to our server. EU/global edge.
- Hetzner: VPS hosting within the EU.
- SMTP provider (Brevo for transactional email): delivery of service emails - confirmations, password resets, usage notifications.
- Payment providers: Monobank (Universal Bank JSC, Ukraine), and from October 2026 also LiqPay (PrivatBank JSC, Ukraine). They receive the account owner’s payment details. They never see birth data: they have nothing to do with the API.
The sub-processor list in the DPA is shorter than this one on purpose: it holds only Hetzner and Cloudflare, the parties your API request data passes through. The payment and email providers process your account data, where we are the controller rather than you, so they belong here and not in the processing agreement.
8.1. Access from Ukraine
The data is stored and processed in Germany, but we administer those systems from Ukraine. Chapter V of the GDPR treats remote access as a transfer to a third country even when no data is copied out of the EU, and the European Commission has adopted no adequacy decision for Ukraine. So we do not write “no cross-border transfer”: the access exists, it is limited to the operator, it goes over SSH with a key, and on a customer’s request we sign the European Commission’s Standard Contractual Clauses. For customers under UK law, the DPA adds the ICO’s UK Addendum to them.
9. Changes
Material changes to this policy will be notified via email 30 days in advance.
10. Contact
Privacy questions: api@astroway.info