Preamble
This Privacy Policy describes how KAIROSAST LTD (“we”, “our”, the “Publisher”) collects, uses, retains and protects the personal data of users of the Llmastro platform available at https://llmastro.com (the “Platform”).
We are committed to respecting your privacy and to processing your personal data in compliance with the General Data Protection Regulation(Regulation (EU) 2016/679, the “GDPR”), the UK GDPR, the UK Data Protection Act 2018, and French Law No. 78-17 of 6 January 1978, known as the “Informatique et Libertés” Act.
1. Controller
The controller of your personal data is:
KAIROSAST LTD
- Registration number: 17247161
- Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
- Legal representative: KAIROSAST LTD
- Data protection contact: contact@llmastro.com
We have not appointed a Data Protection Officer (DPO), as such an appointment is not mandatory in view of our activity. For any question relating to your data, you may write to us at the address above.
2. Personal data collected
We collect and process the following categories of data:
2.1 Data provided directly by the User
| Category | Examples | Nature |
|---|---|---|
| Identification | Name or pseudonym, email address, password (encrypted) | Mandatory to create the Account |
| Birth data | Date, time and place of birth | Necessary to calculate astrological charts |
| Relationship data | Birth data of a third party (synastry) | Optional, provided by the User under their own responsibility |
| Conversational exchanges | Questions, messages and requests addressed to the AI | Necessary to provide the Service |
| Billing data | Billing address, purchase history | Mandatory in the event of a subscription |
| Communications | Emails exchanged with our support team | As required by the relationship |
2.2 Data collected automatically
| Category | Examples |
|---|---|
| Technical data | IP address, browser type, operating system, language, time zone |
| Usage data | Pages viewed, features used, session timestamps |
| Cookies and trackers | See Article 8 |
2.3 Payment data
Payment card data is collected and processed directly by our payment provider Stripe (Stripe Payments UK Limited / Stripe Payments Europe Limited, as applicable). We never have access to your full card number or to your security code. We only receive payment confirmations and a transaction identifier.
2.4 Data concerning minors
The Platform is reserved for adults (18 years of age or older). We do not knowingly collect data concerning minors. If you believe that a minor has provided us with data, please contact us at contact@llmastro.com for deletion.
3. Purposes and legal bases of processing
In accordance with Article 6 of the GDPR, each processing operation relies on an identified legal basis:
| Purpose | GDPR legal basis |
|---|---|
| Creation and management of your Account | Performance of a contract (art. 6.1.b) |
| Calculation of astrological charts and provision of the Content | Performance of a contract (art. 6.1.b) |
| Generation of content by AI in response to your requests | Performance of a contract (art. 6.1.b) |
| Management of Subscriptions and billing | Performance of a contract + legal obligation (art. 6.1.b and c) |
| Retention of accounting and tax records | Legal obligation (art. 6.1.c) |
| Security of the Service, prevention of fraud and abuse | Legitimate interests (art. 6.1.f) |
| Improvement of the Service, anonymized statistical analyses | Legitimate interests (art. 6.1.f) |
| Sending promotional communications | Consent (art. 6.1.a) |
| Anonymous audience measurement (cookie-free statistics) | Legitimate interests (art. 6.1.f) — solution exempt from consent |
You may at any time withdraw your consent for processing based on it, without affecting the lawfulness of prior processing.
4. Recipients of the data — Processors
We share some of your data with a limited number of technical providers, which act as processors within the meaning of Article 28 of the GDPR, on the basis of a compliant processing agreement.
4.1 Categories of processors
| Category | Provider | Purpose | Location |
|---|---|---|---|
| Hosting | Hostinger International Ltd. | Hosting of the Platform | Cyprus (EU) |
| Payment | Stripe Payments UK Ltd / Stripe Payments Europe Ltd | Payment processing | United Kingdom / Ireland |
| Artificial intelligence | xAI Corp (Grok) | Generation of astrological content | United States |
Each processor is selected for its security and GDPR compliance guarantees.
Note: no third-party transactional email provider is used to date. Service emails are sent directly from our hosted infrastructure. This list will be updated if the situation changes.
4.2 Other recipients
Your data may also be disclosed:
- To administrative or judicial authorities upon a lawful and duly justified request;
- To our accountant and our legal counsel strictly within the scope of their engagements;
- To a potential acquirer in the event of a transfer, merger or restructuring, with an undertaking to comply with this Policy.
We never sell your personal data to third parties.
5. Transfers of data outside the European Union
Some of our processors (in particular the artificial intelligence service provider xAI) may process your data from the United States or other countries outside the European Economic Area.
Where this is the case, we ensure that at least one of the following safeguards is in place:
- An adequacy decision of the European Commission (for example, the EU-US Data Privacy Framework for certified US companies);
- Standard Contractual Clauses (SCCs) adopted by the European Commission;
- Additional technical measures (encryption, pseudonymization) where necessary.
You may contact us at contact@llmastro.com to obtain a copy of, or information on, the safeguards applicable to a specific transfer.
6. Retention periods
Your data is retained for the period strictly necessary for the purposes pursued:
| Category | Retention period |
|---|---|
| Account data | As long as the Account is active, then 2 years after the last login in the event of inactivity, unless deletion is requested |
| Natal chart data and AI conversations | For the life of the Account; permanent deletion after closure |
| Billing data and accounting records | 10 years from the transaction (legal obligation) |
| Prospecting and marketing data | 3 years from the last contact, or until consent is withdrawn |
| Technical security logs | 12 months maximum |
| Cookies | See Article 8 |
Upon expiry of these periods, your data is irreversibly deleted or anonymized.
7. Your rights
In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your personal data:
7.1 Right of access (art. 15)
You may request confirmation that your data is being processed and obtain a copy of the data concerning you.
7.2 Right to rectification (art. 16)
You may request the correction of inaccurate or incomplete data.
7.3 Right to erasure / “right to be forgotten” (art. 17)
You may request the deletion of your data, subject to our legal retention obligations.
7.4 Right to restriction of processing (art. 18)
You may request the temporary suspension of the processing of your data in certain cases.
7.5 Right to data portability (art. 20)
You may request to receive your data in a structured, commonly used and machine-readable format, or request its direct transmission to another controller.
7.6 Right to object (art. 21)
You may object, at any time and on grounds relating to your particular situation, to the processing of your data based on our legitimate interests. You may object without giving reasons to processing for prospecting purposes.
7.7 Right to withdraw your consent
Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of prior processing.
7.8 Right to set post-mortem directives
You may set directives concerning the fate of your data after your death (Article 85 of French Law No. 78-17).
7.9 How to exercise your rights
From your account, you can exercise the following on a self-service basis:
- Right of access and data portability— the “Download my data” button in the “Your data” section of your My account page. You obtain a complete JSON export of all the data concerning you (natal profiles, readings, conversations, notifications, subscription).
- Right to erasure— the “Delete my account” button in the “Danger zone” section of your My account page. Deletion becomes permanent after a 30-day grace period during which you can cancel it by logging back in.
For any other request (rectification, objection, restriction, post-mortem directives, etc.), contact us at contact@llmastro.com, specifying your request and providing proof of your identity if necessary.
We respond to your request within one (1) month, extendable by two (2) months in the event of complexity or a large volume of requests.
7.10 Complaint to a supervisory authority
If you believe that the processing of your data infringes the applicable rules, you have the right to lodge a complaint with a supervisory authority, in particular:
- CNIL(France) — Commission Nationale de l'Informatique et des Libertés
3 place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07
https://www.cnil.fr - ICO(United Kingdom) — Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
https://ico.org.uk - or the supervisory authority of the Member State of your habitual residence.
8. Cookies and trackers
8.1 Definition
A cookie is a small file placed on your device when you visit a website, which stores information useful to your browsing.
8.2 Types of cookies used
| Type | Purpose | Consent required |
|---|---|---|
| Strictly necessary | Authentication, security, shopping cart | No (exempt under art. 82 of the French Data Protection Act) |
| Functional | Storing your preferences (language, theme) | Yes |
| Audience measurement | Anonymous traffic statistics, without cookies (self-hosted solution) | No — solution exempted by the CNIL (see 8.5) |
| Marketing | None to date | – |
8.3 Cookie management
The Platform only places strictly necessary cookies (authentication, security) and uses no advertising cookies or third-party trackers. Our audience measurement works without cookies (see 8.5). For this reason, no cookie consent banner is necessary.
You may at any time:
- configure your browser to block all or some cookies;
- use a blocking extension: since our audience measurement is anonymous and self-hosted, blocking it has no impact on your browsing.
Refusing strictly necessary cookies may prevent the normal use of the Platform.
8.4 Cookie lifetime
The cookies placed have a maximum lifetime of 13 monthsin accordance with the CNIL's recommendations. The data collected via cookies is retained for a maximum of 25 months.
8.5 Audience measurement of the Platform
To understand how the Platform is used and to improve it, we use Umami, an audience measurement solution self-hosted on our own servers (European Union). No data is transmitted to a third party, an advertising network or Google, and we never resell these statistics.
This measurement is cookie-free and anonymous: it places no file on your device, creates no advertising identifier and builds no profile concerning you. It falls within the audience measurement solutions exempt from consent by the CNIL; this is why no banner is presented to you to enable it.
We record only, in aggregate form:
- the page viewed and the originating page (referrer);
- general technical information: browser and operating system type, device type, language and country;
- the date and time of the visit.
Your IP address is used on an ephemeral basis to infer the country, and is then not retained. The count of unique visitors relies on a technical identifier that is hashed and renewed every day, which makes it possible neither to identify you nor to track you from one day or one site to another. These statistics are retained in aggregate form and are used exclusively to improve the Platform.
9. Artificial intelligence and automated decisions
9.1 Transparency information
In accordance with Regulation (EU) 2024/1689 on artificial intelligence (the “AI Act”), we inform you that the Platform uses generative artificial intelligence systems to produce the astrological observations.
9.2 Data transmitted to AI providers
In order to provide the Service, some of your data (in particular your natal chart data and your messages) is transmitted to our AI provider (xAI). We implement measures to limit the data transmitted to what is strictly necessary and, where possible, to pseudonymize this data before transmission.
9.3 No automated decision with legal effect
The Content generated by the AI does not constitute automated individual decisions producing legal effects or significantly affecting your situation within the meaning of Article 22 of the GDPR. It is provided for informational, symbolic and entertainment purposes.
9.4 Your data is not used to train the AI
We ensure contractually, to the extent of our processors' undertakings, that your data is not used to train or improve third-party AI models.
10. Security of your data
We implement appropriate technical and organizational measures to protect your data against loss, alteration or unauthorized access, in particular:
- encryption of data in transit (TLS/HTTPS);
- encryption of passwords at rest (salted hashing);
- strict access control to the databases;
- regular backups;
- regular security updates;
- regular audits and tests of our infrastructure.
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours, and will inform you without undue delay where the law so requires.
11. Changes to the Privacy Policy
We may amend this Policy to reflect legal or technical developments or changes to our Service.
In the event of a substantial change, we will inform you by email or by a visible notification on the Platform at least 30 days before it takes effect. The date of the last update is indicated at the top of the document.
12. Contact
For any question relating to your personal data or to this Policy:
- Email: contact@llmastro.com
- Post: KAIROSAST LTD, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
We undertake to reply to you as soon as possible and at the latest within one (1) month.
See also: Terms of Use and Sale · Legal Notice