Privacy notice

Who is responsible

28 PORTUGAL OPERATIONS LDA. is the controller for personal data processed through this website. NIPC 518 579 727. Registered address: Rua Joaquim António de Aguiar 43, 1º Dto, 1070-150 Lisboa, Portugal. Email [email protected] for privacy requests.

This notice describes the public website and protected preview as of 2026-09-21. An eventual account-based app, payments or AI reading service needs the additional notices shown when those features become available; this notice does not claim that they are active here.

Chart inputs and results

To calculate a chart, we process the birth date, available birth time, and selected birthplace. Completing the save step in a birth-chart or relationship calculator stores the supplied birth details and calculated result in your private library. These records are encrypted in the application database. Tools opened from a saved chart reuse its birth details.

We process these records to provide the requested calculation and private library under Article 6(1)(b) GDPR. Your email is used for account verification and recovery. Verification credentials are stored as protected hashes; pending delivery information is encrypted. This processing is separate from marketing consent.

A saved chart is accessible only with an authenticated browser session. Its URL is not a public share link. Share cards include only the displayed signs; they omit the email and birth details. You choose whether to download or share an image.

Email and marketing preferences

Your email is used for account verification and recovery. Account emails are requested separately from the optional marketing checkbox. Account verification and sign-in messages use the configured email delivery provider. The account page states when delivery is unavailable.

If you select the separate marketing checkbox, we record your email, request time, source form and versions of the terms, privacy notice and marketing consent. The address is encrypted in storage, with a keyed hash used to avoid duplicate requests. Chart inputs and results are not copied into that record.

The legal basis for optional marketing processing is consent under Article 6(1)(a) GDPR and the applicable rules for electronic communications. Terms acceptance is separate from that consent. During the preview, requests remain unverified and no marketing messages are sent. A pending request expires after 30 days unless you submit a new request.

Withdraw through the email-preferences form or contact [email protected]. Withdrawal stops future use based on consent; it does not change the lawfulness of processing before withdrawal. You can continue using free calculators. Any future marketing message must identify us and provide a working unsubscribe method.

Security and operational information

Servers and the protected-preview tunnel necessarily receive network information such as an IP address, requested route, timestamp and response status. The application uses a keyed network pseudonym for rate limiting rather than storing raw birth details in application request logs.

Our legitimate interests under Article 6(1)(f) GDPR include protecting the service against abuse, diagnosing failures and responding to security incidents. We limit operational records to what those purposes require. Application rate-limit windows last up to 24 hours. Infrastructure providers can have their own operational records and retention rules.

The public website does not currently use third-party advertising pixels, audience analytics or browser storage for search history. Live search sends the typed query to Astriel’s server to return suggestions. Avoid entering personal information into public-topic search. The cookie notice describes preview access and the private chart-session cookie.

Contacting us

If you email us, we receive the address and information in your message. We use these to respond, handle the request and maintain an appropriate record. Providing support and handling complaints rely on the relevant service relationship, legitimate interests or legal obligations, depending on the request.

Do not email a full birth record, identity document or another person’s information unless it is needed. We may ask for proportionate evidence before disclosing or deleting information. We will explain what is needed rather than requesting identity documents by default.

Recipients and transfers

Access is limited to authorized operators and service providers needed to run the website. The protected preview is served from a development environment through ngrok; requests pass through that tunnel provider. GeoNames and the IANA time-zone database supply reference data and do not receive a copy of each birth-chart submission from these local lookups.

If you allow AI readings or questions to Clara, Astriel sends calculated chart factors, and for Clara your question and recent conversation, through OpenRouter to Wafer, a provider based in the United States that runs the Kimi K3 model, to write the answer. Your email address and original birth date, time and place are not sent. These requests are routed only under a zero data retention policy: the provider does not keep them after answering and does not use them for training. You can withdraw this permission at any time on your account page.

No email delivery provider or advertising platform currently receives the pending marketing requests. We do not sell them. If hosting, email delivery, analytics or other processors change, we must update the relevant notices and establish appropriate data-processing arrangements before using them.

Where personal data is transferred outside the European Economic Area, the applicable transfer mechanism must protect it, such as an adequacy decision or appropriate contractual safeguards. This notice does not represent that every prospective provider or production deployment has already been approved. Contact us for information about the arrangements applying to your request.

How long data is kept

Unverified browser libraries expire after 30 days and are removed by scheduled cleanup. Verified chart libraries are kept until you delete the charts or account. Browser access cookies expire after 30 days; verified users can request a new sign-in link. A protected hash of the most recently requested email is kept with an unverified library for recovery. It is removed when the library is verified, deleted or expires. Verification links expire after 30 minutes. Pending email payloads expire after 30 minutes; expired proof records are removed within the following hour. Hashed email request counters are retained for up to 24 hours to limit abuse. Pending marketing requests expire after 30 days and are removed hourly.

Deleting a saved chart removes its birth details, computed chart and dependent readings. While the account remains active, we retain a minimal submission receipt to prevent an old form from recreating it. This receipt contains random request and chart identifiers, a keyed fingerprint and its creation time. It contains no birth details or chart content. Receipts are removed when the account is deleted, expires or is retired during account consolidation.

Support correspondence is kept for the time needed to resolve the request and any applicable legal obligations or disputes. We review whether continued retention is needed; a legal duty can require limited records to be retained after a request for deletion.

Deletion from a live service and expiry of infrastructure backups are different operations. Any retained backup must be access-restricted and subject to an appropriate expiry and restoration process. A production backup retention schedule is not claimed to be active for this preview.

Your rights

Subject to the conditions in the GDPR, you can request access, correction, deletion, restriction and data portability, and object to processing based on legitimate interests. You can object to direct marketing at any time. Where processing relies on consent, you can withdraw it.

Send requests to [email protected] or our registered address. Tell us enough to identify the relevant interaction. We normally respond within one month. Where the GDPR permits an extension because of complexity or number of requests, we will explain the extension within that first month. Requests are normally free of charge.

You may complain to the Comissão Nacional de Proteção de Dados at cnpd.pt or another competent supervisory authority. Contacting us first is optional. Our public tools do not make automated decisions with legal or similarly significant effects about you.

Children and changes

Astriel is intended for adults. Do not submit a child’s email for marketing. If you believe a child’s contact information was submitted, contact us so that we can investigate and remove it where appropriate.

We will update the version date when this notice changes. New processing purposes, processors or non-essential tracking require an updated assessment and appropriate notice or consent before activation.

Saved numerology results

Life Path uses the date you enter. Chaldean numerology uses your chosen name spelling; a legal name is not required. Neither calculation needs a birth time or birthplace.

After you complete the save step, the input and arithmetic result are encrypted in your private library. Name spelling is stored in the normalized form shown in the result. Verified email recovery can transfer these results into your existing library.

You can reopen or delete each result and include it in an account export. Deleting a birth chart leaves independent numerology results intact. Deleting the account removes them. Unverified libraries follow the same 30-day expiry as saved charts.

A deleted result leaves a minimal retry receipt while its library remains active, so retrying an old form cannot recreate it. Account consolidation preserves these receipts. Deletion evidence retains only the random result identifier and deletion time for backup-restoration checks.