Privacy Policy

Astrolio is the data controller for the personal data processed through this platform. For any privacy question or to exercise your rights, contact us at privacy@astrolio.com.

Account data: phone number and/or email, and authentication identifiers from Google or Apple if you sign in with them.

Profile and consultation data: display name, birth data you choose to save (date, time, place), bookings, payments, reviews, chat messages and call metadata.

Saved tarot readings: if you choose to save a reading in the free tarot spread, the cards that came up and the moment you drew them are stored with your account. A reading you do not save is not stored at all — it exists only on the screen while you are looking at it.

Identity verification documents (astrologers only): a government-issued photo ID and a selfie, submitted when applying to become a verified astrologer or upgrading from a client account.

When you complete identity verification (uploading an identity document and a selfie), the materials are pre-screened automatically, including by a third-party AI model, as an additional, supporting check. The final decision on identity confirmation is always made by a human moderator — the AI cannot approve or reject an application on its own.

In the future, identity verification may instead be completed through Diia (Дія), Ukraine’s e-government identification service. In that case no document images are uploaded to or stored by Astrolio at all — the government system verifies your identity directly.

Technical data: device and browser information, IP address, and language/theme preferences.

To provide the service and perform our contract with you: registration, bookings, consultations, payments and support.

For our legitimate interests: security, fraud prevention, dispute resolution and improving the service.

With your consent, where required (for example, certain cookies).

Astrologers you book receive the data needed to deliver the consultation (e.g. the birth data you attach to a booking).

An astrologer you have booked can also open the tarot readings you have saved, in the same way and under the same setting as your birth data: you can withdraw that access for any astrologer at any time in your account settings, which stops any further access from then on.

Communications: Twilio delivers our SMS one-time codes; Resend delivers transactional email; Telegram delivers bot notifications, only if you connect it yourself. Expo delivers our push notifications to your device: it receives the notification's title and body text needed to display it, which can name another person (for example, who sent you a message or liked your comment) — for a new chat message specifically, the body carries the actual message text only if you have turned on the "Show message text in notifications" setting (off by default), and a generic placeholder otherwise. Expo is used for push delivery only.

AI: OpenAI processes your AI-consultant chat messages, and — for astrologers — the identity document and selfie images, to run the automated pre-screening check before a human moderator reviews your application.

If you turn on the optional "Let it use my account data" setting in your account settings, OpenAI additionally receives — as part of each chat message you send while it is on — your own upcoming booking details (date, astrologer name and service type) and the birth data and natal chart you have saved. This setting is off by default for every account, new and existing, and turns on only by your own explicit action; you can turn it off at any time, and it stops applying from your next message onward. Your wallet balance, payment history and payout details are never included, whether the setting is on or off, and no other user’s data is ever included.

Infrastructure: Cloudflare R2 stores files (documents, avatars, chat attachments); Supabase hosts our database. Video-consultation calls do not currently route through LiveKit or any other Astrolio infrastructure — see the "Video Consultations and Encryption" section below for how calls are actually handled today.

Payments: WayForPay is our currently active payment gateway. Stripe, PayPal, Fondy and Monobank are integrated as alternative gateways but are not yet processing real transactions. No provider gives us your full card details.

We do not sell your personal data.

Sensitive personal data (contact details, birth data, chat content) is encrypted at rest. Conversations are not read by staff outside a dispute you raise, and such access is audit-logged.

Account and profile data (contact details, birth data, bookings, chats, preferences): kept for as long as your account is active. You can export or permanently delete this data from your dashboard at any time.

AI-consultant chat history: stored alongside your account for as long as it is active, and deleted when you delete your account — the same as your other account data.

Saved tarot readings: kept for as long as your account is active. You can delete any single reading whenever you like, and all of them are deleted when you delete your account.

Verification documents (photo ID and selfie) for REJECTED astrologer applications: automatically deleted 90 days after the rejection decision, unless you re-apply before then.

Verification documents for APPROVED astrologers: kept for as long as the astrologer account is active, and deleted if the account is deleted.

Payment and financial records: kept after account deletion for as long as required by accounting and legal obligations. The underlying transaction facts are retained, but the personal identifiers on them are anonymised.

Subject to applicable law (including the GDPR), you have the right to access, rectify, erase, restrict or object to processing, and to data portability. You can also withdraw consent at any time and lodge a complaint with your data protection authority.

To exercise these rights, contact privacy@astrolio.com. You can delete your account from your dashboard at any time.

We use strictly necessary cookies (for example, to remember your language and session). Any non-essential cookies are used only with your consent.

We may update this policy; the "last updated" date above reflects the latest version. Questions: privacy@astrolio.com.

Video and audio calls are currently peer-to-peer: your device and the other participant's connect directly, with the media stream encrypted end-to-end by WebRTC's mandatory DTLS/SRTP. Astrolio's servers are not in the media path and never receive call audio or video. No call-recording capability exists in the product — none has ever been built — and no call has ever been recorded or stored in any form. Access to a call's signaling channel requires being an authenticated participant of that specific booking, for the duration of the scheduled session only. This describes Astrolio's current technical implementation. If a server-routed calling mode is introduced in the future (for example, for group sessions or optional recording), call media would then pass through Astrolio's infrastructure, and this policy will be updated before or alongside that change.