PRIVACY POLICY, AstralPro
Last updated: August 17, 2026
This Privacy Policy describes how AstralPro collects, uses, retains and protects the personal data of users and customers of the astralpro.fr website. It complies with the General Data Protection Regulation (GDPR, EU Regulation 2016/679) and the French Data Protection Act of 6 January 1978 as amended.
1. Data controller
GRIMAULT Dorian (Sole proprietor)
Trade name: AstralPro
Address: 173 Rue de Courcelles, 75017 Paris, France
SIREN: 104472626, RCS Paris 104472626
Email: [email protected]
GRIMAULT Dorian is the sole data controller within the meaning of Article 4(7) GDPR. AstralPro has not appointed a Data Protection Officer (DPO) as this is not mandatory given the nature and volume of processing carried out.
2. Data collected
2.1 Data provided directly by the customer when ordering
- First name (birth)
- Birth city
- Birth date
- Birth time
- Email address
This data is strictly necessary for the astrological calculation of the natal chart and for delivery of the product by email.
2.2 Data collected automatically
- IP address: used only for rate-limiting (anti-abuse), kept in server RAM for a sliding window of up to 1 hour depending on the feature concerned (notably the free preview tool, see section 2.7), never written to the database, then automatically erased. Your IP is never stored in the database nor retained beyond the rate-limiting window.
- Device type (mobile/desktop): inferred from the browser's User-Agent, immediately anonymized, never associated with a customer identifier.
- Country: inferred from the Stripe payment address at the time of transaction.
2.3 Data generated automatically
- Sun, moon and ascendant astrological signs: calculated from birth data, stored in anonymized aggregated statistics (never linked to a customer identifier).
- Time and day of the order: stored in anonymized statistics.
- Birth month (without year): stored in anonymized statistics for aggregated analysis.
2.4 Customer reviews (optional)
If you post a review on the website: first name (free, can be a pseudonym), rating from 1 to 10, text comment, language. The author's IP address is not stored (used only temporarily for rate-limiting).
2.5 Browser local storage
The website uses only browser local storage (localStorage) to remember your preferred language. This data remains on your device and is never transmitted to the AstralPro server. It is necessary for the multilingual functioning of the site and does not require separate consent (strictly necessary cookie within the meaning of the French CNIL).
2.6 Cookies and third-party trackers
AstralPro uses no advertising cookie, no tracking pixel and no third-party analytics tool: no Meta (Facebook), no Google Analytics, no Hotjar, no Matomo, no Plausible. The site therefore stores no tracker subject to consent and consequently displays no cookie banner: there is nothing to accept or decline. The only local storage used is the one described in article 2.5 (language preference), strictly necessary for the site to function within the meaning of the French CNIL. A Meta advertising measurement pixel was present on the site until 14 August 2026; it has been entirely removed, along with the consent banner that accompanied it.
2.7 Free tool "Preview"
The free preview offered on the site uses the data entered in the form: first name, gender, date, time and city of birth. It runs in two stages. The first stage displays the calculation of your sky (Sun-Moon-Ascendant Triad, dominances by element and by modality, dominant planet, Venus and Mars) without asking for any email address. The second stage, the written reading, is displayed after an email address is entered; its writing calls on our sub-processor Anthropic (section 5), to whom neither your first name nor your email address is sent. The date, time, city, language and gender are used for the astrological calculation; they are kept as a hashed (non-reversible) technical key, associated with the generated result, for a maximum of 7 days (a cache designed to avoid regenerating an identical result), then automatically purged. That key contains neither your first name nor your email address. The city is converted into coordinates by the Nominatim service (section 5). Legal basis for the calculation: legitimate interest (Art. 6.1.f GDPR), namely providing a free preview of the service and controlling generation costs. The processing of the email address requested at the second stage, and that of the optional checkbox accompanying it, are described in section 2.10.
2.8 Editorial newsletter (optional)
If you sign up for the newsletter via the site's sign-up form (footer), AstralPro collects your email address and your browsing language. This data is used exclusively to send you a free weekly editorial newsletter, "the sky of the week" (general, non-personalised astrological content) and new blog articles (the AstralPro encyclopedia). This sign-up alone entails no commercial solicitation, no advertising offers and no sharing with third parties for marketing purposes; the newsletter itself contains none. You can also join the newsletter via the optional checkbox offered at the time of an order: that checkbox names two purposes and additionally covers the sending of offers, a separate consent described in section 2.10. Legal basis: your explicit consent (Art. 6.1.a GDPR), obtained via a non-pre-ticked checkbox at the time of sign-up. The language is used solely to send you the content in your language. This data is kept until you unsubscribe. You may withdraw your consent at any time, without justification, via the one-click unsubscribe link at the bottom of every email (or by writing to [email protected]): your address is then immediately unsubscribed and no longer used.
2.9 Book (shipped physical good)
For the order of the Book, AstralPro additionally collects, via the order form on the website: the recipient's name, the postal delivery address and a phone number (required by carriers). The address is verified before payment with the partner printer (see section 5) to ensure deliverability. This data is strictly necessary for the manufacturing and shipping of the ordered copy.
2.10 Email address for the free preview, and prospecting by email (optional)
Two distinct processing operations coexist here, on two different legal bases. They are independent: the second never conditions the first.
(a) THE ADDRESS REQUESTED TO OPEN YOUR PREVIEW. To display the written reading of the free preview (section 2.7), AstralPro asks for your email address and records, along with it: your first name if you entered one, your browsing language, the source of the entry, your birth data (gender, date, time and city) and a summary of the calculated sky (Sun, Moon and Ascendant signs, dominant element, dominant planet). Legal basis: AstralPro's legitimate interest (Art. 6.1.f GDPR), namely identifying the user of a free service whose every generation has a cost, controlling its use and measuring its audience. If you do not tick the checkbox described in (b), that address receives NO email from us: no offer, no newsletter, no follow-up. This data is kept for 12 months, then automatically deleted by our daily purge script. RIGHT TO OBJECT (Art. 21 GDPR): you may object to this processing at any time and without justification, by writing to [email protected]; your data is then deleted without delay.
(b) THE SIGN-UP CHECKBOX, OPTIONAL. Below the preview's email field, at the time of an order, and in the footer form, a checkbox — not pre-ticked — offers you to receive by email the sky of the week, new blog articles (the AstralPro encyclopedia) and AstralPro's offers. Ticking it is never a condition of access: your preview is displayed and your order goes through identically if you leave it empty (Art. 7.4 GDPR). Legal basis: your explicit consent (Art. 6.1.a GDPR), whose date is recorded. This data is kept for 3 years after your last contact (sign-up or re-sign-up), then automatically deleted. You may withdraw your consent at any time, without justification, via the one-click unsubscribe link at the bottom of every email (or by writing to [email protected]): your address is then immediately excluded from all prospecting.
In both cases, this data is processed by AstralPro alone; no transmission to third parties for marketing purposes.
3. Purposes and legal bases for processing
3.1 Generation and delivery of the ordered astrological chart
Legal basis: performance of the sales contract (Art. 6.1.b GDPR).
This data is used to calculate the chart and generate the report; the writing of the texts is assisted by artificial intelligence (Anthropic's Claude API). Without this data, AstralPro is technically unable to provide the ordered service.
3.2 Billing and compliance with accounting and tax obligations
Legal basis: legal obligation (Art. 6.1.c GDPR, Articles L123-22 and L123-23 of the French Commercial Code).
3.3 Anonymized aggregated statistics
Legal basis: legitimate interest of the data controller (Art. 6.1.f GDPR), namely the continuous improvement of the service. The data used is strictly anonymized (no direct or indirect identifier of the customer).
3.4 Rate-limiting
Legal basis: legitimate interest of the data controller (Art. 6.1.f GDPR), namely protecting the service against denial-of-service attacks and fraudulent use.
3.5 Customer communication in case of technical incident
Legal basis: performance of the contract (Art. 6.1.b GDPR). In case of generation or delivery failure, AstralPro may contact the customer via the email provided to resolve the incident.
3.6 Manufacturing and shipping of the Book
Legal basis: performance of the sales contract (Art. 6.1.b GDPR). The recipient's name, postal address and phone number are transmitted to the partner printer (see section 5) for the sole purposes of printing, shipping and tracking the order.
3.7 Commercial prospecting by email
Legal basis: your explicit consent (Art. 6.1.a GDPR), obtained via a non-pre-ticked checkbox (see section 2.10). Consent can be withdrawn at any time, in one click, from every email sent.
4. Retention periods
Premium Pack (annual subscription and one-time payment valid for one year), To provide the service throughout the subscribed year, AstralPro retains the birth data (date, time, place) and the generated content for the duration of the year, from the purchase (legal basis: Art. 6.1.b GDPR), in order to generate the staggered deliverables (Monthly Transits and Daily Horoscope). This data and content are deleted at the end of the year. If an annual subscription is cancelled during the year, the customer keeps access and deliverables until the end of the year already paid; the data is deleted at that term, whether or not the subscription was cancelled. In case of renewal, retention is extended accordingly. Billing data is retained for the legal duration required by accounting and tax obligations, regardless of cancellation.
| Data | Duration | Justification |
|------|----------|---------------|
| Birth data (first name, city, date and time), one-time purchases (Discovery Pack, Compatibility) | 7 days after the order | Strictly necessary for delivery |
| Birth data (first name, city, date and time), Premium Pack | Duration of the subscribed year (purchase + 1 year) | Generation of the monthly deliverables during the year |
| Birth data and generated content, Premium Monthly | Duration of the subscription (until the end of the last paid month) | Daily horoscope and monthly transits |
| Generated content (chart, solar return, transits, horoscope, HTML/PDF) | One-time purchases: 7 days; Premium Pack: duration of the subscribed year | Online access during this period (the PDF remains accessible for life in the customer's email inbox) |
| Customer email (AstralPro server side) | One-time purchases: 7 days; Premium Pack: duration of the subscribed year | Delivery, service and incident resolution |
| Billing data (amount, date, currency, Stripe ID, language, country) | 10 years | Accounting obligation (Art. L123-22 of the French Commercial Code). Note: the customer's email is not retained in the AstralPro billing database but remains traceable via Stripe for accounting purposes. |
| IP address (rate-limiting) | Sliding window of up to 1 hour depending on the feature (RAM, never in database) | Anti-abuse security (Art. 6.1.f GDPR) |
| Anonymized statistics (astro signs, country, language, etc.) | Indefinite retention | Strictly non-identifying data |
| Customer reviews (first name, rating, comment, language) | Indefinite retention unless deletion request | Public display on the site |
| Postal address, phone number and recipient name (Book) | 60 days after the copy is shipped, then deletion | Manufacturing, shipping, parcel tracking and handling of a claim or reshipment |
| Address left to open the free preview, WITHOUT the box ticked (email, first name, language, source, birth data, summary of the calculated sky) | 12 months, then automatic deletion. No email is sent to this address | Legitimate interest (Art. 6.1.f GDPR): identifying the user, controlling use and measuring the audience of a costly free service. Right to object (Art. 21 GDPR) |
| Prospecting leads, box TICKED (same data + consent and unsubscribe dates) | 3 years after the prospect's last contact, or less upon withdrawal of consent (the address is then excluded from all prospecting, then deleted at the same term) | Consent-based prospecting (Art. 6.1.a GDPR), standard CNIL duration |
| Book print files (personalized interior and cover PDFs) | 2 years from the order | Legal guarantee of conformity (Art. L217-3 of the French Consumer Code): a replacement copy must be reprinted identically from the original files |
Beyond the applicable period (7 days for one-time purchases; end of the subscribed year for the Premium Pack; end of the subscription for Premium Monthly), generation data (first name, city, date and time of birth, generated content, email) is automatically and permanently deleted from our servers by our purge scripts. Sign-ups consented to separately, the newsletter (section 2.8) and email prospecting (section 2.10), follow their own retention periods and are not affected by this purge: they continue until consent is withdrawn or until their own term.
5. Recipients and sub-processors
Your data is transmitted only to the technical service providers necessary for the execution of the service, strictly limited to what is necessary for them:
| Sub-processor | Role | Location | Data transmitted | Legal framework |
|---------------|------|----------|------------------|-----------------|
| Stripe Payments Europe Ltd | Payment processing | Ireland (EU HQ), USA servers | Email, first name, amount, country | DPF + Standard Contractual Clauses (SCC) |
| Plus Five Five, Inc. (trade name: Resend) | Sending the email containing the PDF | USA | Email, first name, PDF content | DPF + SCC |
| Anthropic Ireland, Limited (contracting entity for EEA/UK/Switzerland residents under Anthropic's Commercial Terms) | Text content generation via Claude (AI) | Ireland (EU), USA servers (Anthropic, PBC) | First name, date/time/city of birth, language | Intra-EU processing for the contract; transfers to USA governed by SCC + Data is not used to train Anthropic models (Commercial Terms) |
| Astrologer API (Giacomo Battaglia) | Astronomical calculations (planetary positions, houses, aspects) | Italy (EU) | Birth date, time and GPS coordinates (no email or first name) | Intra-EU processing, GDPR directly applicable |
| Nokia of America Corp (Rapid) | Technical intermediary platform (API gateway) between AstralPro and Astrologer API | USA | Same data as Astrologer API (routed through the Rapid platform) | DPF + SCC |
| Nominatim (OpenStreetMap Foundation) | City geocoding (city → GPS coordinates) | Germany (EU) | City name entered (no associated customer data) | Intra-EU processing, GDPR directly applicable |
| Railway Corp | Backend server and database hosting | USA | All stored data | DPF + SCC |
| Cloudflare, Inc. | Frontend hosting (static HTML) | USA | Anonymized access logs (no PII) | DPF + SCC |
| Lulu Press, Inc. (Lulu Direct) | On-demand printing and shipping of the Book | USA (North Carolina) | Recipient name, postal address, phone number, Book PDF files | Standard Contractual Clauses (SCC) |
Delivery emails (containing the PDF) transit through Resend, hosted in the United States and covered by the Standard Contractual Clauses through a data processing agreement (DPA); Resend retains messages and their attachments for a maximum of 30 days before automatic deletion.
Transfers outside the European Union are governed by: (1) the EU-US Data Privacy Framework (DPF) for certified US sub-processors, and (2) the Standard Contractual Clauses adopted by the European Commission. Your data is neither resold to third parties nor used for advertising purposes.
6. Your rights
In accordance with Articles 15 to 22 of the GDPR, you have the following rights:
- Right of access (Art. 15): obtain confirmation that your data is being processed and receive a copy.
- Right of rectification (Art. 16): have inaccurate data concerning you corrected.
- Right to erasure (Art. 17): request the deletion of your data, subject to legal retention obligations (in particular accounting).
- Right to restriction of processing (Art. 18): request the temporary suspension of processing.
- Right to portability (Art. 20): receive your data in a structured, commonly used and machine-readable format.
- Right to object (Art. 21): object to processing on legitimate grounds.
- Right to withdraw consent at any time (Art. 7), without affecting the lawfulness of processing carried out before such withdrawal.
To exercise these rights, contact [email protected] specifying your request and providing proof of identity. A response will be provided within a maximum period of 30 days (extendable to 90 days for complex requests, with prior notice).
You also have the right to lodge a complaint with the competent supervisory authority. In France, this is the CNIL (French Data Protection Authority):
- Website: www.cnil.fr
- Address: 3 Place de Fontenoy, 75007 Paris, France
- Phone: +33 1 53 73 22 22
In your country of residence, you may also contact your local data protection authority.
7. Security measures
AstralPro implements the following technical and organizational measures to protect your data:
- Encrypted HTTPS connection (TLS 1.3) on the entire site
- Postgres database hosted at Railway with strong authentication and restricted access
- Stripe webhooks verified by HMAC signature (anti-forgery)
- Systematic validation and sanitization of incoming data (anti-XSS, anti-SQL injection)
- Rate-limiting per IP address (anti-DDoS and anti-brute-force)
- Administrator access protected by strong API key (HTTP header X-Admin-Key)
- Automatic daily purge of expired data (GDPR purge script)
- No banking data stored (managed exclusively by Stripe, PCI DSS Level 1 certified)
- No customer password stored (the service does not require account creation)
8. Breach notification
In the event of a personal data breach likely to result in a high risk to your rights and freedoms, AstralPro undertakes to:
- Notify the CNIL within 72 hours in accordance with Article 33 GDPR
- Directly inform the persons concerned as soon as possible in accordance with Article 34 GDPR
9. Minors
The AstralPro service is not intended for persons under 15 years of age. No personal data is knowingly collected from minors under 15 years of age. If you are a parent or guardian and notice that your child has transmitted personal data to AstralPro, please contact [email protected] to request its immediate deletion.
10. Modifications to this policy
AstralPro reserves the right to modify this Privacy Policy at any time to reflect changes in the service, applicable legislation or data protection practices. The date of the last update appears at the top of this document. In case of substantial modification, customers will be informed by email when their contact details are available.
11. Multilingual version
This Privacy Policy is drafted in French. Translations into other languages (English, Spanish, German, Italian, Portuguese) are provided for informational purposes only. In the event of any discrepancy between versions, the French version prevails.
12. Contact
For any question regarding this Privacy Policy or your rights:
Data controller: GRIMAULT Dorian
Email: [email protected]
Postal address: 173 Rue de Courcelles, 75017 Paris, France
You may also contact the CNIL directly: www.cnil.fr