Privacy policy and GDPR

Controller

The publisher’s identity is published on the legal notice when it is set.

You can also exercise your rights from your account while signed in.

Data we collect

Account: email address, first name, password stored as a hash, and the httpOnly session cookie lunara_session.

Birth data: date, time (or the fact that it is unknown) and place, used to compute the birth chart. The free rising-sign tool does not create an account and does not store the moment of birth.

Calls and voice: voice is processed in real time for the conversation. A text transcript may be kept for a written summary you request and for service safety. The raw call audio is not archived as a sound file.

Payments go through Stripe. Callastral does not store the full card number. Stripe returns the payment status, a transaction id and, if you entered one, billing contact details.

First-visit cookies: cl_ft (90 days) stores utm_source, utm_medium, utm_campaign, the referrer and the landing page. cl_vid (12 months) is a random id used to count unique visitors. They are set on the first visit, excluding /admin and known bots, and they are not used for advertising. The cl_ck cookie stores your choice and is strictly necessary.

Vercel Analytics and Vercel Speed Insights, only if you accept audience measurement.

Email via Resend: account messages, password reset, consultation summary, and one reminder if a payment is started and not finished. That reminder includes an unsubscribe link.

Purposes and legal bases

Contract: creating the account, computing the chart, running the call, taking payment, delivering a summary or report you asked for.

Legal obligation: accounting and lawful requests from authorities.

Consent: Vercel Analytics and Speed Insights. You can withdraw that consent at any time from the Cookies link.

Legitimate interest: cl_vid and cl_ft cookies, to see which pages and campaigns lead to an account or a payment, service security, abuse limits, and one payment-reminder email with an unsubscribe link.

Retention

Account data, the birth chart and transcripts are kept for the life of the account, then deleted or anonymised after an erasure request, subject to legal retention for invoices.

Measurement cookies expire at the latest on the periods above. The consent cookie cl_ck is kept for 6 months.

Technical security logs are kept only as long as needed to detect abuse, and are not a marketing profile.

Processors

Vercel: application hosting, and audience measurement only after consent.

Supabase: database, schema callastral, reachable only with a server key.

Stripe: payments.

xAI: the advisor’s voice during the call, and drafting of report texts you request.

Resend: transactional email.

These providers may process data outside the European Union. Transfers rely on their standard contractual clauses where required. Processing locations are those each provider publishes.

Cookies

No measurement cookie is set before a choice. Accept, Refuse and Customise have the same visual weight.

Refusing leaves the site usable. Page views are still counted without a cookie and without a cl_vid. Payment, the account and the call do not depend on this choice.

Your rights

You may request access, rectification, erasure, restriction, portability and objection, and you may withdraw consent, by writing to the contact address.

You may also lodge a complaint with your local data protection authority. In France, that authority is the CNIL (cnil.fr).

Advisor memory and morning horoscope

After a call, if advisor memory is on, Callastral stores a short summary: topics, questions, advice and mood. The summary is visible in the account history. The last three summaries are read by the virtual advisor on the next call, to pick up the thread. A recap email includes that summary, the week’s transits and an offer for the Découverte first week. Memory is on by default. In the account, the Advisor memory control turns it off, and the delete button removes this history.

The morning horoscope is a separate email. It asks for a consent checkbox and a second confirmation click. Stored data: email, language, sign, an optional birth date, the UTM source and the confirmation timestamp. The day’s text is prepared once per sign and language, not once per person. Each message has a one-click unsubscribe link.

The couple compatibility tool computes a score without an account. The shared link keeps only the score, the sentences and the initials: not the birth date, time or place.

Contact

You can also write from your account while signed in.