Your information, with care
Privacy policy & data notice
What we collect, why we use it and the choices you have. Last updated: 13 October 2026.
Google user data
iAstroGuru offers Google sign-in. If you choose it, we request only the openid, email and profile scopes. We store your Google account ID, verified email address, name and the time you signed in. We do not store your profile picture, Google password or Google access credentials. We do not access Gmail, Drive, Contacts or any other Google data.
We use it only to sign you in, identify your account and contact you about your account or orders. It is not used for advertising, not sold, not used to train AI models, and not shared except with the service providers listed here as needed to run the service, or where law requires.
iAstroGuru’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We keep these details while your account is open. When you ask us to delete your account, we delete them too, except records the law requires us to keep (see “How long we keep it” below).
To remove it, ask support@iastroguru.com to delete your account (in Settings you can export your data and remove reading data). You can also revoke iAstroGuru’s access at any time at myaccount.google.com/permissions.
Who this notice covers
This notice covers visitors, account holders and people whose details they add with permission. We collect data for the service, not public profiles. Birth profiles, charts and reports are private to the account. The operator/controller and Grievance Officer are listed below; contact support for any additional business details.
What we collect — notice at collection
- Account identifiers: name and verified email from Google; or, with email-code sign-in, the email address whose emailed code you entered; or, when enabled, verified phone number and account identifier from Supabase phone sign-in. We never receive your Google password. Phone accounts store the number through an internal, undeliverable email-shaped identifier; it is not a real email address.
- Birth profiles: supplied name, date and time of birth, time confidence, place, latitude/longitude, time zone and chosen astrology system, for you or people who give permission.
- Charts and reports: calculation snapshots, engine version, calculated chart details, reading content and status, report preparations, linked partner profiles and generation/error attempt records.
- Purchases: order ID, product, amount/currency, payment status, Razorpay order/payment/event references, signature verification, payment-event evidence and paid access entitlements. We do not store card numbers, CVV or banking passwords.
- Consent and service records: consent type, version and time; reading-request identifiers, input hashes, status and timing; and report availability updates you request.
- Security and operations: hashed session identifiers and expiry, email sign-in codes stored only as hashes (purpose: sign-in; kept 10 minutes or until used), rate-limit counters using hashed IP addresses, phone numbers or email addresses, and owner security/admin logs. For automated writing, a usage record notes the purpose, report/profile references and usage.
- Browser preferences and temporary details: cookies, localStorage and sessionStorage listed below. Messages and replies you send to support are also held in the support inbox.
We do not normally request a postal address, government ID, medical records or financial history. A business billing address/GSTIN is asked for only if you need a GST invoice.
Purposes & lawful bases
- Account access, chart calculation, saved readings, purchased reports and service emails: performing your request or contract (contract under EU/UK GDPR); in India, informed consent where required.
- Optional marketing: separate, withdrawable consent.
- Security, fraud prevention, rate limits, error checks and limited AI spend accounting: legitimate interests in a safe, reliable service under GDPR, balanced against your privacy; the applicable permitted basis in India.
- Tax, accounting and legally necessary payment evidence: legal obligation. We retain only what that purpose requires.
Without required details we may be unable to provide the relevant service. Readings do not make employment, insurance, lending or other decisions with legal or similarly significant effects on you.
Free tools & AI writing
Charts are calculated on our server by the iAstroGuru Engine, not sent to an outside astrology API. Free calculator tools, including Vedic/Western, Chinese zodiac, numerology and tarot, never use AI. Using a tool alone does not create a saved birth profile; details carried into the saving form may remain temporarily in that tab.
Readings and reports may be written with the help of AI from calculated chart facts, and then reviewed by our quality checks. For this, details are sent to AI service providers located outside India (for example, in the United States). For the free reading the AI provider receives chart facts only (ascendant, Moon, planets, yogas, doshas and current dasha periods), not your name, birth date, time or place. For a paid report it receives the calculated chart details, which include the profile’s name and birth details and, for matching, the other person’s relevant details.
Automated processing: readings, reports and answers are prepared automatically by computer systems, including AI services, from your calculated chart; no human astrologer writes them. They are not used to make legal or similarly significant decisions about you. You can ask support for human help.
We use business services from AI providers whose terms state that data sent to them is not used to train their AI by default, and we do not opt customer birth data into training. This is not a promise of zero retention: security, abuse-monitoring and legal retention can apply. A list of providers is available on request at support@iastroguru.com.
Providers & recipients
- Cloudflare: hosting, storage and security.
- Google: Google sign-in when chosen; Supabase and its SMS providers: phone-code delivery and verification when phone sign-in is enabled.
- Razorpay and relevant payment/banking providers: payments and refunds. We receive payment evidence, not card data.
- AI service providers (located outside India, for example in the United States): help writing readings, reports, question answers and Customer Care chat as described above.
- Zoho: the support@iastroguru.com support inbox and delivery of automatic emails, including your email sign-in code.
Providers receive information needed for their role. Processing on our behalf requires appropriate contractual terms; payment and identity providers may also act as independent controllers for their own obligations. Records may be disclosed in response to valid legal demands. A full list of providers is available on request at support@iastroguru.com.
Customer Care
Customer Care shows your orders, reports, saved profiles, preparations and consent records only to your account. Service requests are saved as support notes and queued support emails. Conversations are private, visible to our support team and deleted after 180 days. Chats, notes and email history are included in your export and reading-data removal controls.
Customer Care chat may be answered by an AI assistant. The text you type and the last six conversation turns go to an AI service provider located outside India. The AI is not given database access, birth details or payment records; fixed account-scoped actions run on the server. Avoid typing sensitive details. Astrology and unrelated topics are refused. Buttons and human service support are always available.
Service & marketing emails
Customer Care uses support@iastroguru.com; at launch reports and automatic customer emails will use guru@iastroguru.com. Transactional receipts, report delivery and security emails need no additional marketing consent. Phone-only accounts cannot receive email until a real address is securely added.
Free daily rashifal and weekly newsletter: only if you sign up for them separately and confirm through the link we email you (double opt-in). We store your email address, Moon sign, language, the lists you chose, when you signed up and confirmed, when you last clicked a link in our emails and, if any, the campaign name (UTM), only to send these emails and to know whether they are read. Sending pauses by itself after 30 days without a click. Every email has a one-click unsubscribe and a link to change your choices; unsubscribing deletes your subscription record and our stored copies of emails to you at once, keeping only a one-way hash of your address in a suppression list so we never email it again. Unconfirmed sign-ups are deleted 7 days after the first sign-up; signing up again does not extend that. A subscription under your account’s email address is included in your account data export and deleted when you remove your account data. These emails go through an email marketing provider (Zoho Campaigns) separate from our service emails; the confirmation email comes from noreply@. If your account’s email address is subscribed, you also get one greeting on your birthday and on the birthdays of your saved profiles, with a personal discount code; on your own birthday a short “year ahead” reading written from your chart is saved in your account. So that it arrives as your day begins, we keep the time zone your connection shows at sign-in (for example Asia/Kolkata) on your account.
Cookies & device storage
There are no advertising trackers or analytics cookies. After a review on 2 October 2026 we keep strictly necessary storage only: for sign-in and security, and for choices you make yourself (language, theme, chart style, city) or results you ask for (today’s tarot card). On the public site we use a cookieless analytics service that counts page views without identifying you or setting cookies. So no consent banner is needed. An automatic layout value and a lasting tarot identifier were removed. Any non-essential storage would require a consent banner and a refusal option before it is set.
- iastroguru_session: HttpOnly sign-in cookie, 30 days; only a hashed form of it is stored in the database. Secure on public HTTPS, SameSite=Lax.
- iastroguru_oauth: HttpOnly Google sign-in security/PKCE cookie, up to 10 minutes; cleared on return.
- iastroguru-lang: English/Hindi choice, one year.
- localStorage: iastroguru-intro (when the opening scene last played, so it does not repeat), iastroguru-preferences (answer language and Hindi style you chose while signed out), iastroguru-theme (theme you chose), iastroguru-chart-style (chart style you chose), iastroguru-panchang-city (city you chose), iastroguru-tarot-day (today’s date and card, set when you ask for it, so it stays the same until tomorrow; replaced the next day). No identifiers; these may remain until you clear browser data.
- sessionStorage: iastroguru-motion-paused (motion choice), iastroguru-pending-birth and iastroguru-pending-match (birth/matching details before saving), checkout:… (payment request identifier to avoid duplicate charges). These last for the tab session; carried birth details are removed after successful saving.
- The owner has a separate HttpOnly admin-session cookie; it is not public customer sign-in. The Razorpay payment window may use its own security technologies.
You can clear cookies and storage in your browser; this may sign you out or reset choices but does not delete server reports. Any new storage is reviewed for necessity and added to this list before it is used.
Ask iAstroGuru: questions & payment
We save your selected birth profile, question, language, status, quoted price, payment state (held, charged, released or refunded), any discount code used, answer and AI usage record privately in your account. Questions are checked before payment; rejected questions and failed answers are not charged. Each follow-up is a new question.
For the first check, an AI service provider located outside India receives only the question. To help write the answer, an AI service provider receives the question and calculated chart facts (placements, dashas, transits, yogas and doshas), excluding the profile name, birthplace, birth date and birth time. Any private details you type in the question are sent as part of it.
Questions and answers stay until you delete them. Deleting a question, its profile or all reading data removes the associated questions and answers. Order, payment, discount and tax evidence, without the question text, remains for the applicable accounting period. Your export includes questions, answers, orders and discount-code uses. AI usage accounting follows the 730-day schedule below.
How long we keep it
Saved birth profiles, charts, preparations and readings stay until you delete them; there is no automatic inactivity deletion today. Removing all reading data clears request input hashes and report references, but keeps account-linked reading-request timing and status for a while for quota protection.
An automatic clean-up applies this schedule every day in small batches: expired sign-in sessions, phone and email codes, rate-limit counters and export locks after they expire; reading-request records after 90 days; abandoned (unpaid) checkouts after 30 days; Customer Care conversations after 180 days; sent automatic emails after 180 days (for bounced addresses only the address and status stay, so we do not send to them again, not the message); report availability requests after 365 days; admin/security logs and AI usage records after 730 days (2 years). Consent records, including withdrawn ones, stay with the account as evidence. Paid or refunded orders and their payment evidence are never removed by this clean-up. Contact support for review and erasure of records no longer needed.
Error reports and feedback: when something breaks we keep only an error code, the page and the browser type, no personal details; these logs and any screenshot sent with feedback are deleted after 90 days. A feedback message you send stays with your account.
Orders, payment and tax records must be kept for the period required by applicable law — for example, 8 years where company accounting law applies; disputes or investigations can require longer. GST has its own retention rules. These are never deleted automatically; they will be reviewed by hand once the period ends.
Self-service reading removal does not erase the account, consents, report availability requests or payment evidence. Protected backups may retain copies after deletion; there is no fixed backup retention schedule yet. Provider logs/backups follow their policies.
Withdrawal & your controls
Use account privacy controls to export saved information or remove reading data. To correct birth details, create a new reading from the saved profile and remove the old report separately. Send requests for account closure, other erasure, access or correction to support@iastroguru.com. There is no automatic full-account closure button today.
Withdraw consent by writing to support@iastroguru.com. Withdrawal does not invalidate earlier lawful processing. Withdrawing permission for required data can prevent the relevant service, while legally required records may remain.
India: DPDP rights & grievances
Under the Digital Personal Data Protection Act 2023 and Rules 2025, where applicable, rights include information/access, correction, updating, erasure and grievance redressal. You may nominate someone to exercise your rights in case of death or incapacity. Contact our Grievance Officer; if unresolved, you may complain to the Data Protection Board of India through the applicable process.
The Act and Rules have phased commencement; not all provisions are in force on 2 October 2026. You can request the service controls described here now; statutory rights apply according to their commencement. Official Rules and enforcement timeline.
EU/UK: GDPR rights & international transfers
Where GDPR applies, request access, correction, erasure, restriction, portability, objection to legitimate-interest processing and withdrawal of consent. We normally respond within one month and explain any lawful extension. You may complain to your local supervisory authority or the UK ICO.
Providers may process data in India, the US or other countries; we do not promise one-country residency. Applicable EU/UK safeguards may include adequacy decisions, providers’ Standard Contractual Clauses (SCCs) and a required UK addendum/IDTA. Appropriate agreements and transfer assessments must be completed before public launch; this notice alone does not establish they are in place. Ask support for the relevant safeguards. Any required EU/UK representative must be assessed and appointed before launch into those markets.
California: CCPA/CPRA notice
We do not sell or share personal information for cross-context behavioural advertising. The collection notice above lists identifiers, contact/profile details, commercial/payment records, internet/device activity and chart-derived interpretations/inferences. Birthplace coordinates are not your current device GPS location. Any sensitive information is used only for requested services, security or legal requirements.
Where CCPA/CPRA applies, rights include knowing/access, correction, deletion, opting out of sale/sharing and limiting certain sensitive-information uses, without discrimination. Send requests to support@iastroguru.com. Proportionate identity verification is required; authorised agents can request with evidence of authority. We normally respond within 45 days and explain any lawful extension.
Children’s data
Accounts are for adults 18+. The service is not directed to children under 13 and we do not knowingly collect data directly from them (COPPA). Before saving birth details for a child under 18, the parent or lawful guardian gives explicit consent and provides their own birth year, which must indicate an age of at least 18. These voluntarily provided age details support the Rule 10 route. We record the consent purpose, version, parent’s account ID, child’s profile ID, declared birth year and timestamp.
Withdraw consent by deleting the child’s profile from My readings; this removes the associated details and readings and stops their further use. We do not market to, track, behaviourally monitor or target advertising at children; their details are excluded from customer tags and marketing segments.
Security, breach notification & changes
Safeguards include public HTTPS, account-scoped access, HttpOnly sessions and payment verification. No system guarantees complete security. If a personal-data breach occurs, we will investigate, contain it and take protective steps. We will notify affected people without undue delay in plain language about what happened, affected data, protective steps and help, and notify authorities within applicable deadlines.
Where GDPR requires authority notification, the deadline is 72 hours from awareness; individual notification follows its risk threshold. Under the applicable DPDP process, initial notification to affected people/the Board is without delay and detailed Board notification is normally within 72 hours. Requirements depend on the applicable law and commencement.
We will update this notice for material data-use changes and obtain fresh consent where required. Report security or privacy concerns to the support email.
Operator & Grievance Officer
The seller of this service and controller of your personal data (Data Fiduciary in India):
- Legal name
- Shiv Shakti Software Solutions (sole proprietorship of Mohan Minda; Udyam registered), trading as iAstroGuru
- Location
- New Delhi, India (full postal address for legal notices on request by email)
- Contact
- support@iastroguru.com
- Grievance Officer name
- Mohan Minda (proprietor)
- Grievance Officer email
- support@iastroguru.com
Support and privacy requests: support@iastroguru.com. We will acknowledge complaints within 48 hours and resolve consumer grievances within one month of receipt, or sooner where applicable law requires.
Related policies & language
English is the governing text. Every policy is available in English and Hindi.