Privacy Policy

1. Data Fiduciary & Identity of the Organization

AstroLeaf ("AstroLeaf", "we", "us", or "our") operates as the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (India) and Data Controller under the General Data Protection Regulation (GDPR). We are committed to safeguarding the privacy and confidentiality of our users ("you", "Data Principal").

2. Categories of Personal Data We Collect

We collect only the minimum necessary personal data required to compute accurate Vedic astrological ephemeris mathematics, generate customized Janam Kundli reports, and deliver consultation services:

• Astrological Birth Parameters: Date of birth, Exact time of birth, City / Country of birth, Geographic Coordinates (Latitude, Longitude, Timezone offset), Name, and Gender.
• Account & Contact Information: Full name, Email address, WhatsApp / Phone number, and encrypted password credentials for account management.
• Transactional & Order Records: Order identification numbers, purchased report categories, booking timestamps, and transaction status. (Note: Sensitive payment card numbers, UPI PINs, and banking credentials are handled directly by PCI-DSS Level 1 certified gateways such as Razorpay and are never received, stored, or accessible on AstroLeaf servers).
• Technical & Session Data: Anonymized IP addresses, browser specifications, device identifiers, session cookies, and user consent records.

3. Purpose and Lawful Bases of Processing

We process your personal information strictly under lawful bases recognized by the DPDPA 2023 and GDPR:

• Contractual Necessity: To calculate planetary positions, divisional charts (D9 Navamsha, D10 Dasamsha), Vimshottari & Jaimini Dashas, generate personalized PDF reports, and schedule live astrologer consultations.
• Explicit Consent: To store your birth chart inputs in local functional cookies for multi-calculator continuity, and to load optional analytics upon opt-in.
• Statutory & Legal Compliance: To maintain verifiable accounting, invoice generation, tax reporting (GST), fraud prevention, and dispute resolution records.
• Legitimate Interests: To protect the platform against cyber threats, automated bot scraping, DDoS attacks, and abuse.

4. Non-Sale & Zero Data Brokerage Pledge

Your astrological parameters are used exclusively for computing charts and rendering the specific tools you request.

5. Third-Party Service Processors & Data Sharing

To maintain high platform availability and security, AstroLeaf engages certified third-party service providers bound by strict confidentiality and data protection agreements:

• Payment Gateways: Razorpay Software Private Limited (PCI-DSS compliant payment processing for UPI, Net Banking, and Cards).
• Geocoding & Location Search: Google Places API for converting city names into precise latitude and longitude coordinates.
• Cloud Infrastructure & Hosting: AWS / Cloudflare (providing SSL/TLS 256-bit encryption in transit and at rest, DDoS mitigation, and content delivery).
• Transactional Email: Certified SMTP infrastructure for dispatching purchased PDF reports and consultation calendar invites.
• Optional Analytics & Usability Diagnostics: Google Analytics 4 (anonymized visitor traffic) and Microsoft Clarity (Microsoft Corporation - anonymous heatmaps and interaction diagnostics). In strict accordance with India DPDPA 2023, IT Rules 2011, and GDPR, all sensitive birth parameters, contact inputs, and payment details are masked client-side prior to recording. Both services are strictly gated behind explicit cookie consent and immediately disabled upon opting out.

6. Data Retention, Storage & Personal Data Breach Notification (Section 8(6))

We implement bank-grade administrative, technical, and physical security measures:

• All data transmitted between your browser and our servers is secured using modern TLS 1.3 / 256-bit encryption.
• Calculator inputs from guest users remain in temporary browser storage and are automatically cleared based on your cookie settings.
• Account data is stored securely in encrypted databases. Transaction receipts are retained for 7 years as required by Indian taxation laws.

7. Your Legal Rights as a Data Principal (GDPR & DPDPA)

Under applicable data protection laws, you possess the following enforceable rights:

• Right to Access: Request a copy of all personal data AstroLeaf holds concerning you.
• Right to Rectification: Request correction of inaccurate, incomplete, or outdated personal or birth details.
• Right to Erasure (Right to be Forgotten): Request permanent deletion of your account, saved Kundlis, and profile records.
• Right to Withdraw Consent: Revoke consent for optional analytics or communications at any time without affecting past lawful processing.
• Right to Nominate (DPDPA 2023): Nominate an individual to exercise your data rights in the event of incapacity.

To exercise any of these rights, email us at contact@astroleaf.in with the subject line "Data Privacy Request".

8. Processing of Children's Personal Data (Section 9 DPDP Act)

In strict compliance with Section 9 of the Digital Personal Data Protection Act, 2023:

• Parental / Guardian Consent: AstroLeaf requires verifiable consent of a parent or lawful guardian before processing personal data of an individual who has not completed eighteen (18) years of age ("Child"). Birth chart calculations for minors may only be initiated by a parent or legal guardian for cultural, informational, and parental guidance purposes.
• Prohibition on Behavioral Monitoring: In accordance with Section 9(3), AstroLeaf strictly refrains from undertaking tracking, behavioral profiling, or targeted advertising directed at children.
• Protection of Well-Being: AstroLeaf does not process any personal data in a manner that causes or is likely to cause any detrimental effect on the well-being of a child (Section 9(2)).

9. Statutory Grievance Redressal & Complaint to Board

In accordance with the Information Technology Act 2000, IT Rules 2021, and the Digital Personal Data Protection Act 2023, you may escalate any unresolved data privacy concerns directly to our Nodal Grievance Officer: