Privacy Policy

Updated October 28, 2026.

Who is responsible for your data

Astrilu runs this service, from Brazil, and is responsible for the personal information handled on it.

For any privacy question, request or complaint, write to suporte@astrilu.com.

In short

The free calculator does the math on your device: your birth date never reaches us.
In your account, we keep your email and only the numbers of your guide, never your birth date.
As Brazilian law requires, we keep a 6-month access log for every page of the site (IP, date and time and, when needed, the source port), separate from your account.
We do not sell your information or use it for ads, we use no ad pixels or ad cookies, and we send no marketing emails.
Anytime, you can ask us by email for a copy of your data or to delete your account.

The free calculator

The Personal Year math runs in your browser. The birth date you type is not sent to our server and is not stored.

If you tap "Unlock my 2027 guide", the date is kept in that browser tab’s memory until the payment screen, so you do not have to type it again. The payment screen reads it and clears that memory; closing the tab clears it too.

To know whether the site works, your browser sends the name of a few steps, such as "result viewed", and the page language. We keep only how many times each step happened each day, with no date, no number and no way to know who it was.

Access log, on the whole site

On every Astrilu page, including the free calculator and without an account, we keep the access log that Brazilian law requires, because Astrilu is run by a Brazilian company (Marco Civil da Internet, Law 12,965/2014, art. 15): the network address (IP), the source port when it is needed to identify the device, and the date and time of each page opened. The log does not record the page, what you typed or your account.

We keep it for 6 months in a controlled environment, separate from account data, and every look at it is recorded. It is handed over only under a court order, and it is kept longer only if a police or administrative authority, the public prosecutor’s office or a court order asks for it (Marco Civil, art. 15, §§ 2 and 3).

What we keep when you create an account and buy

Your email address, to send your sign-in code, your guide and the guide emails.
Your account language and the country of purchase (Brazil, the United States or Mexico), to show the right currency and deadlines.
The date and time you accepted the Terms and confirmed you are 18 or older.
The numbers of your guide: your 2027 Personal Year, with the master number when the sum goes through 11 or 22, and your Life Path. Your birth date passes through our server only to do the math and confirm you are 18 or older, and is discarded right after: it is not stored.
Your purchases: what you bought, amount, currency, payment method, payment status, the Stripe reference, the dates, the source of the link that led to the purchase, if any, and, if a payment was declined, the reason Stripe gave.
If you answer, how you heard about Astrilu.
Which months the monthly email was sent and, if you stopped it, since when; if you joined the weekly reading waitlist, since when.
The compatibility links you create, with the short name you chose.
Your messages to support: your email address, what you wrote, any attachments and our replies.

Your card number is typed into Stripe’s form and never reaches our server. Apart from the short name on compatibility links, we do not ask for your name, phone, address or gender, and we never ask about beliefs, religion or health.

Compatibility by link

Whoever creates a link chooses the short name they show. The person who receives the link enters their own birth date and, if they want, a short name. From that person, we keep only the Personal Year and the Life Path, never the date, and the name they chose, tied to the link, to show the compatibility to both people. We do not ask for their email.

Both people see each other’s Personal Year and, with the compatibility purchase, each other’s Life Path. The person who receives the link can delete their numbers and name anytime from the link itself. The creator can delete the link, and everything in it goes with it. The link address is stored only in encrypted form.

How we use it

To create your account, let you sign in, charge you, deliver your guide, send the monthly email and process cancellations.
To keep the purchase, refund and access records the law requires, and proof that you accepted the Terms and confirmed your age.
To limit sign-in attempts and prevent abuse and fraud, with as little data as possible.
To learn how people find Astrilu, from your optional answer.
To run the weekly reading waitlist and the compatibility links, with your consent.
To answer your messages.

We do not sell personal information or share it for targeted advertising, and we do not use it for profiling or automated decisions about you. We do not use your information to train AI models.

Beliefs

Using Astrilu says nothing about your faith or your beliefs, and we do not treat it that way: we do not ask about, infer or record anyone’s religion, beliefs or philosophical views, and nothing from your account goes to advertising platforms.

Emails

We only send service emails:

your sign-in code;
your receipt and the delivery of your guide, with the PDF;
the new month, on the 1st of each month in 2027, which you can stop in 1 click from the email;
the confirmation when you cancel a purchase;
if you created a link, a note when the compatibility is ready, once per link;
if you are on the waitlist, a single email when the weekly reading opens;
if you write to support, an automatic confirmation that your message arrived.

We send no marketing emails, and we never sell or share your email address.

Cookies and tracking

After you sign in, we use a single cookie, astrilu_sessao, which keeps you signed in for up to 90 days or until you sign out. The account needs it to work. The public pages set no Astrilu cookies; Cloudflare, which protects the site, may set a short-lived technical security cookie to tell people from bots.

When a visit comes through one of our links marked with its source, such as the one on our social media profile, we add up only the source, the campaign and the day, with no cookie and without knowing who opened it; if a purchase starts from that link, the source is noted on it.

On the payment screen, Stripe’s form runs inside our page and uses Stripe’s own cookies and device signals to process the payment and prevent fraud, under Stripe’s privacy policy; this may include activity on other sites that use Stripe. Apart from that, no other company collects information about your activity on Astrilu over time or across websites.

No Astrilu page has social media pixels, ad cookies or analytics from other companies, and none are added to your account area (sign-in, payment, guide, compatibility and cancellation). If we ever measure ads on the public pages, we will update this policy first, saying what is collected.

Do Not Track and Global Privacy Control: because we do not track you across websites and do not sell your information or share it for targeted advertising, these browser signals have nothing to turn off, and the site works the same with them on.

Who receives it

Only the companies that run the service for us, each with as little as needed:

Hetzner: the server that runs Astrilu and stores the database, in the United States.
Cloudflare: network and security for the site, and receipt of the messages you send to support. It receives your IP address and what travels between your browser and our server.
Resend: sends our emails. It receives your email address and the message, including the PDF.
Stripe: payments and refunds. It receives your email address, the amount, what you bought and our purchase reference, plus what you type into its form. Stripe also uses this information for its own purposes, such as preventing fraud and meeting its legal obligations, under its own privacy policy.
Anthropic, which provides Claude, the artificial intelligence we use to run Astrilu and to help answer your messages. It receives what is needed for that, such as the message you write, and also handles it under its own privacy policy.
The mailbox service where messages to support arrive, and the storage of our encrypted backups, in the United States and on administration computers in Brazil.

We also disclose information to authorities when the law or a valid legal order requires it. We do not sell personal information.

Where your information is

Our server is in the United States, and Astrilu is run from Brazil, so your information is also accessed from there, always under this policy.

How long we keep it

Account, guide numbers and links: while the account exists. You can ask us to delete it anytime.
Numbers and name of someone who received a link: until that person deletes them, the creator deletes the link or the creator’s account is deleted.
Purchase and refund records: for as long as tax law requires, even if you delete your account, without your email address.
Access log: 6 months, then deleted in the daily cleanup, unless a police or administrative authority, the public prosecutor’s office or a court order asks us to keep it longer (Marco Civil, art. 15, § 2).
Sign-in codes work for 10 minutes, and a session lasts up to 90 days. Expired ones are deleted within 2 days.
Attempt counts, for security: stored only as a scrambled code, with no email address or IP, and deleted within 2 days after their window ends, which lasts from 1 to 24 hours.
Messages to support: up to 12 months after the last contact.
Encrypted backups: deleted on a rolling basis within 45 days.

Your choices and rights

Wherever you live, you can ask us to confirm whether we handle your information and give you access to it, correct it, delete it, give you a copy in a portable format, and stop anything that depends on your consent.

How: write to suporte@astrilu.com from your account email. For a copy, we send a file with your account, guide numbers, purchases and links. To delete your account, we delete everything that is yours, except what the law requires us to keep. We may ask you to confirm it is you. It is free, and we reply within 15 days. If we decline a request, you can reply to our answer to ask us to review it.

The access log is not part of your copy or of a deletion: the law requires us to keep it for 6 months and hand it over only under a court order, and it is not linked to your account.

You can leave the waitlist or stop the monthly email in 1 click, from the email or in your account.

Nevada residents can send a verified request not to sell their information to suporte@astrilu.com; we do not sell personal information, and we reply within 60 days. California residents: we do not share personal information with third parties for their direct marketing.

Using these rights never changes the price or the service you get.

Security

The site uses an encrypted connection. Sign-in codes, sessions and links are stored only as one-way hashes, and your card number never reaches our server. Backups are encrypted, and only the people who run Astrilu, and the AI tools they use, can access your information.

If a security incident affects your information, we tell you by email without undue delay and within the time the law sets.

Children

Astrilu is for adults 18 and over and is not directed to children. When the date entered belongs to someone under 18, the date and the numbers are not saved. If we learn that we hold information from someone under 18, we delete it.

Changes to this policy

We publish the new version on this page, with its date at the top; that date is the effective date of this policy. If a change is material, such as new information, new uses or a new company responsible, we email account holders before it applies.