Data Processing Agreement

Data Processing Agreement, version 1

Effective 2026-09-20. AstroWay API, api.astroway.info.

1. Who we are and what this covers

This agreement is between you, the Customer, acting as data controller, and Maksym Burkhan, individual entrepreneur (ФОП), Ukraine, operating api.astroway.info as your data processor under Article 28 GDPR.

It applies for as long as your account exists and you send requests to the API, and it governs only the data you send through the API. Your own account details are a separate matter, where we are the controller and our privacy policy applies.

2. What we process, and why

Subject matter and purpose. You send birth data to the API: a date, a clock time, a timezone or offset, and coordinates. We compute an astrological result and return it. That is the whole purpose, and the API call is your instruction.

Categories of data subjects. Your end users, or anyone whose birth moment you submit.

Types of data. Date and time of birth, coordinates, and the optional name and city fields. name and city are never stored: they are held in memory for the duration of the request and written nowhere.

Duration. For the life of your account, subject to section 9.

What we log about the call rather than the person. Endpoint, method, status, latency, byte counts, a salted irreversible digest of the caller’s IP address and the first 16 bits of that address, the User-Agent, the origin, and a coarse country, city and network operator. We keep that for 30 days.

3. What we undertake

• We process your data only on your documented instructions, which are the API calls you make and any written instruction you send us, unless EU or member-state law requires otherwise, in which case we tell you before processing unless that law forbids it.
• If an instruction looks unlawful to us, we say so immediately rather than carrying it out quietly.
• The service is operated by one person, who is bound to confidentiality and is the only human with administrative access.
• We keep the security measures in section 5.
• We help you answer a data subject’s request, and help with your obligations under Articles 32 to 36, insofar as that is possible and taking into account what we hold. That qualifier is the law’s own, and here it is concrete: we store no name, no email and no identifier for your end users, so we usually cannot find one person’s rows on our side. You can, through your own records, and DELETE /v1/me/account erases everything we hold for your account.
• We do not use your data for our own purposes, do not sell it, and do not use it to train models.

4. Sub-processors

Two, and they are the infrastructure:

Sub-processor	Role	Location
Hetzner Online GmbH	compute, database and file storage	Nuremberg, Germany
Cloudflare, Inc.	CDN, DNS and DDoS protection, with EU-region cache rules	US company, EU edges serve EU traffic

We impose the same data-protection obligations on them as we carry here, and we remain fully liable to you for what they do.

You give general authorisation for these two. We will tell you by email before adding or replacing one, and you may object on reasonable data-protection grounds; if we cannot resolve the objection, you may stop using the service and we refund the unused part of the period you paid for.

Our payment and email vendors are deliberately not in that table, because they never see data covered by this agreement. Brevo sends transactional mail to you, and Monobank takes card payments, with LiqPay being added in October 2026. Both concern your account rather than your end users, so they are named in the privacy policy instead.

5. Security

• Transport is TLS only, and plain HTTP is redirected.
• Passwords are hashed with bcrypt and API keys are stored hashed.
• IP addresses are stored only as a salted SHA-256, computed as the row is written. The salt lives in the server environment, never in the code.
• Database accounts are separated per consumer, each with the narrowest grant that works, and the database listens on loopback only.
• Backups are encrypted with AES-256 before they leave the machine.
• Administrative access is by SSH key, one person, no shared credentials.

What we do not have, because claiming it would be worse than saying it: we hold no SOC 2 report and no ISO 27001 certificate of our own. Hetzner holds ISO/IEC 27001 for the data centre our servers sit in.

6. Transfers, stated plainly

Your data is processed on servers in Nuremberg, Germany, and we do not replicate it outside the EEA.

We are nevertheless established in Ukraine, which has no adequacy decision under Article 45. Under EDPB Guidelines 05/2021 that alone makes this a transfer to a third country, and so does administrative access from Ukraine to those German servers, because remote access counts even when nothing is copied. So we do not tell you there is no cross-border transfer; there is one, and this is what covers it.

We enter into the Standard Contractual Clauses of Implementing Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated into this agreement by reference and prevail over it if the two conflict. Sections 2, 5 and 4 of this agreement serve as Annexes I, II and III respectively. A signed copy naming both parties is available on request at legal@astroway.info.

What is transferred in practice is authenticated administrative access to systems in Germany, not the export of a database.

7. Showing that we comply

We give you the information you need to demonstrate compliance with Article 28 through this agreement and our security description above, and we will complete one reasonable written security questionnaire in any twelve-month period at no charge.

If that is not enough, you may audit compliance with this agreement once in any twelve-month period, on thirty days’ written notice, remotely, during business hours, covering only the processing we carry out for you and never another customer’s data. You bear the cost of the audit and of any auditor you appoint. These limits do not apply where a supervisory authority requires an inspection.

8. If there is a breach

We notify you without undue delay after becoming aware of a personal data breach affecting data we process for you, by email to your account address. The first notification may be incomplete, and we follow up as we learn more.

We hold no contact details for your end users, so notifying them under Article 34 remains yours to do.

9. Ending it

When your account ends, tell us whether you want the data we hold for you returned or deleted, and we do that. If you tell us nothing, we delete it.

The one exception is what tax law requires us to keep: payment records, for 1095 days under §44.3 of the Ukrainian Tax Code. Three years, not the seven an earlier draft of this text guessed at. Article 17(3)(b) GDPR leaves records kept for a legal obligation outside the right to erasure, which is why a deletion request does not reach them.

10. Accepting this agreement

You accept it in your dashboard, and the record of that acceptance names your account, the version and the moment. Article 28(9) requires the contract to be in writing, “including in electronic form”, so that record is the contract and there is nothing to wait for. The PDF you can download carries the same record. A countersigned paper copy is available on request.

If we change this text materially, it becomes a new version and we ask you to accept that one; the version you accepted stays the one you agreed to.