← Back to Astro Berries

Privacy Policy of the Astro Berries Service

Document version V3.0 | effective from 24.09.2026

Definitions

1. Controller / We – Colours of Samadhi Sp. z o.o. with its registered office in Warsaw, ul. Lanciego 12/97, 02-792 Warsaw, Poland, NIP: 9512597744, REGON: 528808348, KRS 0001109196, entered into the National Court Register by the District Court for the Capital City of Warsaw in Warsaw, XIII Commercial Division of the National Court Register, e-mail address: help@coloursofsamadhi.com.
2. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
3. Service – the Astro Berries website, available at `astroberries.com` and `astro.coloursofsamadhi.com`.
4. User / You – any natural person visiting the Service or using its functionalities.
5. AI Astrologer – a virtual conversation partner (chatbot) based on artificial intelligence models, available within the Service, appearing in four personas: Richard, Elizabeth, Tom and Apa. To generate replies, the Controller uses models of the providers indicated in the "Recipients of data" section: Anthropic, Google and OpenAI. The assignment of personas to providers may change among these three providers without a change to this Policy; as of the date of this version of the Policy, the Richard and Apa personas use Anthropic models, the Elizabeth and Tom personas use Google models, and no persona uses OpenAI models. The Controller may make available additional AI Astrologer personas (including test personas with a limited circle of access) using models from the same providers — this does not involve transferring data to any new external entities; adding a new model provider requires an update of this Policy. The AI Astrologer's replies may optionally be listened to in audio form — the rules for processing data within that function are described in section 2a.

This Privacy Policy applies exclusively to the Astro Berries Service. The rules for processing personal data in connection with the yoga services provided at coloursofsamadhi.pl are set out in a separate Privacy Policy available on that website.

Contact

Contact with the Controller on matters concerning the protection of personal data is possible at the e-mail address: help@coloursofsamadhi.com or in writing to the Controller's registered office.

What data we process and for what purpose

1. Data provided to generate a Horoscope

Data on the date, time, and place of birth of the subject of the Horoscope are not special category personal data within the meaning of Art. 9 GDPR (they do not reveal racial or ethnic origin, religious beliefs, health, sexual orientation, etc.) — they are processed on general terms.

Note on third-party data (Relationship Portrait / Synastry). If the User enters the birth data of another person in order to generate a comparison of two charts, the User declares that they are authorized to provide such data. The scope of this data is limited to the first name and the date, time, and place of birth and does not include special category data. The Controller processes it solely to generate the Relationship Portrait, including the optional relationship forecast and the Vedic compatibility analysis (Guna Milan / Ashtakoot, Mangal Dosha, comparison of Dasha periods), computed solely from the same birth data — without extending the scope of the data processed.

Note on determining place coordinates (geocoding). The geographic coordinates of the place of birth (and, if provided, the place of residence) are as a rule determined from a place-name database operating locally within the Administrator's infrastructure — in which case the data does not leave that infrastructure and is not transferred to any external entity. Only where the locality provided was not found in that database is an auxiliary query sent to an external geocoding service (Photon), whereby only the name of the locality is transferred, the query is sent from the Administrator's server rather than from the User's device, and it does not include the User's IP address. Details in the "Data recipients" section.

Note on the moon calendar, Moment Selection and Places. The optional moon calendar, Moment Selection (election) and Places (astrogeography) are computed within the Controller's infrastructure solely from data already provided by the User (birth data and, if provided, place of residence; for Moment Selection – also the date range, type of matter and place indicated by the User). Generating them does not involve processing any new categories of personal data or transferring data to external entities. Queries sent to the place-name search are logged in order to improve the quality of the database (the query text and the source of the result) with no link to the User, the Account or an IP address.

1a. Use without a Customer Account

1. Generating a Horoscope, its views, the moon calendar and a Moment Selection, as well as a conversation with the AI Astrologer within the free scope, are possible without creating an Account. The data provided for this purpose (table in section 1) and the content of conversations are processed on the same terms as for a User with an Account, with the difference that a Horoscope not linked to an Account is permanently deleted 24 hours after its generation, together with the associated conversations, unless the User assigns it to an Account before that time. The legal basis is performance of a contract (Art. 6(1)(b) GDPR).
2. The free message limit and the daily limit of Moment Selection calculations for a User without an Account are enforced on the basis of the Horoscope identifier and the IP address respectively (section 7).

Note on calendar subscription (iCal). The User may optionally enable a subscription to their moon calendar in an external calendar app (Google Calendar, Apple, Outlook). For this purpose the Controller provides an individual, tokenized URL that serves a calendar file (`.ics`) containing astrological data relating to the User's Horoscope (the day's rating and aspects to the Horoscope). This feature does not involve transferring data to any new external entities (the file is served from the Controller's infrastructure) — however, the calendar app chosen by the User (e.g. Google) will poll this address on its own. The subscription URL should be treated as personal data: anyone who knows the address can access the calendar's contents, so it should not be shared with anyone. The User may at any time generate a new address (which invalidates the previous one) or disable the subscription in the Account panel.

2. Content of the conversation with the AI Astrologer

1. The content of messages entered by the User in a conversation with the AI Astrologer is transferred to the provider of the artificial intelligence model corresponding to the selected persona (Definitions, point 5) in order to generate a response. Together with the message content, the Horoscope's computed data (including planetary positions, aspects, transits, computed numerology values), the birth data of the subject of the Horoscope (date, time and place) and the first name of the subject of the Horoscope are transferred to the model provider. The Controller applies data minimization to the data transferred to model providers: a person's last name is not transferred — the last name of the subject of the Horoscope is removed from the data sheet transferred to the provider (including in a Relationship Portrait and a comparison of Horoscopes), and numerology is computed within the Controller's infrastructure so that the provider receives only its result. The following are not transferred: the e-mail address, password, payment data or Account identifiers. The minimization reservation does not cover the names of companies and events (transferred in full) or free-text content typed by the User in the conversation, which may contain further data. In a conversation with two AI Astrologer personas at once, each of the providers receives the whole conversation, including the other persona's replies.
2. Conversation content is stored by the Controller in the Service's database, in encrypted form, in order to enable the User to resume and continue conversations, maintain continuity between conversations (concise summaries of earlier conversations), and download a record of a conversation in PDF format. The concise summary of a conversation is prepared automatically by a model of one of the providers indicated in the "Recipients of data" section (as of the date of this version of the Policy: Anthropic), regardless of the persona with which the conversation was held; for this purpose the record of the conversation is transferred to that provider. The legal basis is the necessity to perform the service (Art. 6(1)(b) GDPR).
3. The User may at any time delete a generated Horoscope together with its associated conversations in the Customer Account panel. Conversation content is also subject to anonymization or deletion in accordance with the "Data retention period" section.
4. Within a given conversation, the AI Astrologer uses only the data of the Horoscope to which the conversation relates and a concise summary of the User's earlier conversations concerning the same Horoscope. The AI Astrologer has no access to the internet or to other Users' data.

2a. Listening to the astrologer's replies (the astrologer's voice)

1. If the User uses the optional Listening function, the content of the AI Astrologer's reply is transferred to the Google Cloud Text-to-Speech speech synthesis service in order to generate an audio recording. Google is already a data processor for the Controller (the AI Astrologer models) — Listening therefore does not introduce a new external entity or a new direction of data transfer, but a new service of the same entity.
2. The scope of data transferred is narrower than in a conversation. Only the text of the AI Astrologer's reply, prepared for reading aloud and divided into parts, is transferred to the speech synthesis service. The following are not transferred: the User's questions, their first name or other Account data, birth data, Horoscope calculation data, or identifiers of the User, the Horoscope or the conversation. The content of the reply may, however, refer to the User's Horoscope, since it was generated on its basis.
3. Storage of recordings. The generated recording is stored in the Service database in encrypted form (using the same mechanism as the content of conversations) for a period no longer than 30 days, solely so that listening again to the same reply is free of charge and does not require the text to be transferred to the speech synthesis service again. Recordings are deleted upon the lapse of that period and also — regardless of it — upon deletion of the associated conversation or Horoscope by the User, and in the event of Account anonymization.
4. Consent to the cost. Before using Listening for the first time, the User confirms that they acknowledge its paid character. The Controller records the date of that confirmation in the User's Account so that it is not repeated for subsequent Listening. The legal basis for processing within this function is performance of the contract (Art. 6(1)(b) GDPR).
5. Listening is available only to a logged-in User and only in relation to the AI Astrologer's replies in conversations concerning the User's own Horoscopes. Messages written by the User are never transferred to the speech synthesis service.

3. Billing unit counter (Tokens / "berries")

The Controller records the number of billing units (Tokens, presented in the interface as "berries") used in a conversation with the AI Astrologer solely for the purpose of managing the Service's cost limits and settlements. This data is not used for analytical or marketing purposes. The legal basis is performance of a contract and the Controller's legitimate interest (Art. 6(1)(b) and (f) GDPR) in managing the Service's operating costs.

4. Payment data

In the event of a payment, data necessary for its execution is processed (first name, last name, e-mail address, amount). Payment card data is not processed by the Controller — it is transferred directly to the payment operator applicable to the selected currency: for payments in Polish zloty to the bank (ING Bank Śląski S.A.) via the ING Pay payment gateway (formerly imoje), and for payments in other currencies to Stripe Payments Europe, Limited (Ireland). The legal basis is performance of a contract (Art. 6(1)(b) GDPR) and, with respect to accounting documents, the Controller's legal obligation (Art. 6(1)(c) GDPR).

5. Login data (Customer Account)

1. In order to create a Customer Account and log in, the Controller processes the e-mail address, first name, last name, and password. The password is stored only as a cryptographic hash (bcrypt) — the Controller does not know and does not store the password in plain text.
2. Alternatively, the User may log in without a password using a one-time link (Magic Link) sent to the e-mail address, valid for 15 minutes (except for an Account with two-factor login enabled). The Controller also provides a password reset mechanism carried out by e-mail.
3. To confirm the e-mail address, the Controller may send a verification message. The legal basis is performance of a contract (Art. 6(1)(b) GDPR).
4. The User may enable two-factor login: on login, a one-time code is sent to the Account's e-mail address. The code is stored solely as a cryptographic hash for the duration of its validity, together with the number of attempts to use it.
5. The Controller records in the Account the versions of the Terms and the Privacy Policy accepted by the User and the date of the last acceptance (proof of conclusion of the contract; Art. 6(1)(b) and (f) GDPR).

6. Newsletter consent (marketing)

The User may voluntarily consent to receiving marketing information (newsletter). Consent is optional, does not condition the use of the Service, and may be withdrawn at any time. The Controller records the fact and time of granting consent. The legal basis is the User's consent (Art. 6(1)(a) GDPR). Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. Irrespective of newsletter consent, the Controller may send to the Account's e-mail address messages concerning the Service and the Account (e.g. about a change to the Terms, technical breaks or Account security); the legal basis is performance of a contract and the Controller's legitimate interest (Art. 6(1)(b) and (f) GDPR).

7. Technical data and system logs

The User's IP address and browser/operating system data are processed automatically for technical purposes, ensuring the security of the Service, and preventing abuse. The IP address is additionally stored in the Service's database in order to limit the number of requests (in particular login attempts to the administration panel and Moment Selection calculations without an Account) and is retained for this purpose for no longer than 30 days. System logs do not include the content of the User's conversations with the AI Astrologer. The legal basis is the Controller's legitimate interest (Art. 6(1)(f) GDPR).

8. Bug reports and suggestions

If the User submits a report via the form in the Service, the Controller stores the content of the report and – for a logged-in User – the Account identifier, in order to handle the report and improve the Service. The form does not collect the e-mail address, IP address or browser data. The legal basis is the Controller's legitimate interest (Art. 6(1)(f) GDPR). Anonymization of the Account detaches the report from the Account.

Data security

The Controller applies technical and organizational measures to protect Users' personal data, in particular: encryption of AI Astrologer conversation content and of recordings generated within the Listening function stored in the database, storage of passwords solely as cryptographic hashes (bcrypt), optional two-factor login (a one-time code sent to the e-mail address), access control restricting access to Horoscopes and conversations to the User who owns them (including logging of unauthorized access attempts in technical logs), transmission of data over an encrypted connection (HTTPS) together with appropriate security headers, and protection against cross-site request forgery (CSRF). Passwordless login (Magic Link) serves solely to log in to an existing Account and does not create a new Account.

Is providing data mandatory?

Providing personal data in the Service is always voluntary. However, providing data marked as "Required" in the table above is necessary to generate the Horoscope — without it, the service cannot be performed. Providing data marked as "Optional" is voluntary also in the sense that it does not affect the ability to use the basic functionality of the Service.

Recipients of data — third parties (subprocessors)

The Controller uses the following third parties to provide the Service. Each of them processes data only to the extent necessary to perform its function.

Transfer of data outside the European Economic Area

1. In connection with the use of services of entities established outside the European Economic Area (in particular Railway Corporation, USA; Anthropic PBC, USA; Google LLC, USA; OpenAI, L.L.C., USA; Resend / Plus Five Five, Inc., USA), Users' personal data may be transferred to the United States.
2. Such transfers take place on the basis of appropriate compliance mechanisms provided for in the GDPR — in particular the Standard Contractual Clauses approved by the European Commission, included in the data processing agreements with the respective entities, and for Anthropic, Google, and Resend — also on the basis of the certification of those entities under the EU-US Data Privacy Framework.
3. The User may obtain a copy of the appropriate safeguards by contacting the Controller at the address indicated in the "Contact" section.

Note on computational software (outside the scope of GDPR)

The Service uses the Swiss Ephemeris library (Astrodienst AG, Switzerland) for astronomical calculations, operating locally within the Controller's infrastructure. Use of this library does not involve the transfer of any of the User's personal data to Astrodienst AG — the data provided by the User does not leave the Controller's infrastructure for this purpose. This information is provided solely for transparency regarding the technical components used by the Service; details concerning the license of this software (AGPL v3) are described in the Terms and Conditions of the Service.

The function of downloading a conversation with the AI Astrologer as a PDF file is carried out locally within the Controller's infrastructure and does not involve the transfer of the User's data to third parties in order to generate such a file.

Data retention period

1. The birth/inception data provided by the User and the generated Horoscope files (Natal File, Forecast File) saved in a Customer Account are stored until deleted by the User or an effective request for deletion of data is submitted — subject to the periods resulting from the Controller's accounting and tax obligations. A Horoscope generated without an Account and not assigned to an Account is deleted 24 hours after its generation, together with the associated conversations (section 1a); the record of billing units used is retained without a link to the Horoscope.
2. A Customer Account inactive continuously for a period longer than 3 years may be anonymized. Before anonymization, the Controller will make efforts to notify the User at the e-mail address assigned to the Account at least 30 days in advance. Anonymization consists in the permanent deletion or removal of features enabling the identification of the User; data subject to record-keeping obligations (accounting, tax) and the record of accepted document versions and the date of acceptance are retained for the period required by law.
3. Conversation content with the AI Astrologer is stored in encrypted form until the associated Horoscope is deleted by the User or the Customer Account is anonymized. Deleting a Horoscope results in the deletion of the associated conversations.
4. Recordings generated within the Listening function are stored in encrypted form for no longer than 30 days; they are also deleted earlier — upon deletion of the associated conversation or Horoscope, and in the event of Account anonymization.
5. Data for settlement and tax purposes (sales documents) is retained for the period required by law, generally 5 years from the end of the tax year in which the tax obligation arose.
6. Technical data (system logs) is retained for the period necessary to ensure the security of the Service, no longer than 12 months, unless a longer period is required in connection with establishing, pursuing, or defending against claims. IP addresses stored in order to limit the number of requests (section 7) are retained for no longer than 30 days.
7. The content of bug reports and suggestions (section 8) is retained until the report is handled and for the time needed to improve the Service; anonymization of the Account detaches the report from the Account.

Cookies

1. The Service uses only cookies necessary for its operation: the session identifier of a logged-in User, the selected interface language, the selected currency, and a token protecting forms against cross-site request forgery (CSRF). The banner displayed on first entry informs about their use.
2. The Service does not use third-party analytical, marketing or tracking cookies or scripts. Should the Controller intend to introduce such tools, their use will be made conditional on the User's prior consent and this Policy will be updated.
3. The User's browser may additionally store locally (browser local storage) interface preferences, such as the last selected AI Astrologer persona or the font size; this data is not transmitted to the Controller.
4. The User may manage cookie settings in their web browser. Disabling cookies necessary for the operation of the Service may limit its functionality.

Your rights

As a data subject, you have the right to:

1. access the content of your data and request its rectification,
2. request the deletion of data,
3. request restriction of processing,
4. data portability,
5. object to processing of data based on the Controller's legitimate interest,
6. lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

Submitting requests electronically. Requests concerning the processing of personal data — including requests for information about the data processed, access to it, its rectification, erasure, restriction of processing, portability, and objection — may be submitted electronically, by e-mail to the personal data Controller's address: pomoc@coloursofsamadhi.com. The Controller responds to the request without undue delay, within the time limits arising from the GDPR.

To the extent that data is processed on the basis of consent (e.g. place of residence data for a relocation chart, newsletter consent), you may withdraw it at any time by contacting the Controller or — in the case of the newsletter — using the opt-out option. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Automated decision-making and profiling

The Controller does not make decisions towards Users producing legal effects based solely on automated processing, including profiling. Content generated by the AI Astrologer is of an informational and entertainment character and is not used to make any decisions affecting the User's legal situation. The AI Astrologer is an artificial intelligence system within the meaning of Regulation (EU) 2024/1689; the automatic recognition of crisis signals in message content (Terms, §4) analyses text only, does not use biometric data, and does not serve to recognize emotions or to profile the User.

Age of users

The Service is intended for persons who are at least 18 years old. The Controller does not knowingly collect personal data of minors. If the Controller obtains credible information that the personal data of a minor has been provided to the Service, it will take steps to delete it.

Changes to the Policy

This Policy is continuously reviewed and updated as needed, in particular in connection with changes to the third parties indicated in the table above. A new version is published in the Service with an indication of the date from which it is effective; earlier versions remain available. A User holding an Account accepts the Policy when creating the Account and upon each purchase, and in the case of a material change (marked by a change of the first number of the version) — upon the first login after it comes into force, via an acceptance screen; these rules are described in §16 of the Terms. The current version of the Policy (V3.0) is effective from the date indicated at the beginning (24.09.2026).

Note on language versions: This Privacy Policy has also been prepared in an English version. In the event of any discrepancies between the Polish and English versions, the Polish version prevails.