Privacy Policy
Effective Date: March 2026 • Status: Draft Version Pending Formal Legal Counsel Review • Committed to 100% Confidentiality & Zero Commercial Data Monetization
This policy document outlines the architectural data flows, storage practices, and third-party data processors utilized by Aapka Astro (www.aapkaastro.com). This document is marked as Pending Lawyer Review while undergoing final regulatory sign-off in accordance with the Digital Personal Data Protection Act (DPDPA), 2023, and applicable Indian IT laws.
1. Our Sacred Pledge: 100% Confidentiality & Zero Data Selling
Unlike mass-market astrological platforms that harvest seekers' birth coordinates, relationship queries, and contact lists to monetize on behavioral ad networks, Aapka Astro NEVER sells, rents, leases, trades, or commercializes your personal information or birth charts with third-party advertisers, data aggregators, or brokers.
Every consultation with Acharya Niraj Kumar concerning marital harmony, career crossroads, family concerns, and energy corrections is treated as a sacred trust held in strict confidence between the seeker and the Acharya.
2. Third-Party Data Processors & Specific Processing Purposes
To provide secure, scalable, and mathematically precise services, we partner with specialized enterprise infrastructure providers acting solely as data processors under strict contractual confidentiality:
Purpose: Web application hosting, serverless compute runtime, Content Delivery Network (CDN) edge routing, and DDoS mitigation.
Data Handled: Ephemeral HTTP request headers, IP address for request routing and edge security.
Purpose: Serverless PostgreSQL relational database hosting with automated backups and encryption at rest.
Data Handled: User profiles, consultation booking records, UTR submission IDs, astrological lead coordinates, and knowledge base records.
Purpose: User authentication, passwordless login tokens, Google OAuth Single Sign-On (SSO), and session security.
Data Handled: Email address, mobile telephone number, name, and cryptographically verified JWT session tokens.
Purpose: Transactional email delivery for consultation booking confirmations, receipts, calendar invites, and platform owner security alerts.
Data Handled: Recipient email address, name, booking date/time, and transaction summary.
Purpose: Generating natural language answers to visitors' website questions via the floating assistant widget.
Data Handled: Chat messages are sent to generate answers. Used solely on paid enterprise API tiers with data training on customer inputs contractually disabled.
Purpose: Private encrypted object storage for optional manual payment confirmation screenshots.
Data Handled: EXIF-scrubbed image files accessible exclusively via short-lived 15-minute signed URLs by the platform Owner, subject to automatic 90-day retention deletion.
Purpose: Direct, 1-on-1 user-initiated communication channel for appointment scheduling, audio/video consultation sessions, Kundli inquiries, and manual payment verification.
Data Handled: Only activated when a visitor or client explicitly taps a WhatsApp link or initiates contact. Communication is governed by WhatsApp's end-to-end encryption protocols.
3. AI Assistant Interaction & 30-Day Query Quality Logging
When visitors use our floating AI Assistant, the conversation is processed under strict privacy controls:
- Privacy-Preserving Rate Limiting: Visitor IP addresses are one-way hashed using salted cryptographic SHA-256 algorithms. Raw IP addresses are never saved, stored, or logged in our database.
- PII Masking & Stripping: Any sensitive personal information entered into chat—such as email addresses, 10-digit mobile phone numbers, or bank identifiers—is automatically scrubbed and replaced with generic masked tokens (
[MASKED_EMAIL],[MASKED_PHONE]) prior to any logging. - 30-Day Strict Retention: Unanswered queries or low-confidence questions recorded in our 30-Day Query Quality Logging pipeline are stored without personal identifiers. All logged records are automatically and permanently purged from the database after 30 days via our scheduled retention job (
/api/cron/cleanup-unanswered). - No Third-Party AI Model Training: Chat messages are sent to the AI provider solely to generate real-time answers. We use enterprise API tiers where customer inputs are contractually excluded from third-party model training or public dataset inclusion.
- Fail-Closed Circuit Breaker: In the event of provider outages, quota limits, or authentication failures, the assistant automatically surfaces a direct WhatsApp fallback to visitors and temporarily hides the widget upon repeated failures.
4. Direct UPI Payments & Booking Data Security
We operate a transparent, zero-wallet, flat-fee consultation booking architecture:
- Direct UPI Routing: Payments are transacted directly to our verified merchant UPI ID (
9310709233m@pnb, Payee: AAPKA ASTRO). We never process, store, or view your bank account passwords, credit/debit card numbers, or UPI PINs. - Zero Base64 Image Storage: Payment screenshots are never converted to base64 or stored inside our application database, ensuring database integrity and preventing storage bloat.
- Private Bucket & EXIF Metadata Stripping: If screenshot uploads are active via Cloudflare R2, image files are stripped of camera, device, and GPS EXIF metadata, assigned random UUID keys, and protected by short-lived 15-minute presigned URLs visible solely to the platform Owner.
- 90-Day Payment Screenshot Retention: Payment verification screenshots are permanently purged from private storage after 90 days via our automated retention job.
5. Free Kundli Leads & Astrological Birth Coordinates
When you generate a Janam Kundli, Kundli Milan, or astrological report, we collect your birth details to run our high-precision astronomical ephemeris calculations:
- Data Collected: Name, WhatsApp telephone number, gender, date of birth, exact time of birth, and birth place coordinates (city, latitude, longitude, and timezone).
- Strict Purpose Limitation: Collected solely to calculate your Nirayana planetary positions, divisional charts (D1 to D12), and Ashtakoot guna scores, and to allow Acharya Ji's desk to coordinate scheduled consultations.
- Zero Automated Marketing Guarantee: We maintain a strict prohibition against automated robocalls, blast SMS campaigns, and third-party promotional syndication.
- Consent & Revocation: Lead submissions record explicit user consent with timestamp. You may withdraw your consent at any time to request immediate data erasure.
6. Cookie Policy: Strictly Essential Cookies Only & Traffic Analytics Disclosure
Aapka Astro adheres to a minimal, privacy-preserving digital architecture in compliance with the Digital Personal Data Protection Act (DPDPA), 2023:
Essential session tokens (via Clerk for user sign-in and CSRF defense), cookieless web vitals (via Vercel Analytics for page speed), and aggregate traffic metrics (via Google Analytics 4, only when you give explicit consent).
To verify bookings, optimize consultation checkout speeds, and understand which spiritual and astrology guides help seekers most. We never sell data to advertising brokers or run commercial behavioral retargeting.
Cookieless performance metrics are retained for 24 hours. Google Analytics 4 retains event data for 2 months (user-level default) up to a maximum of 14 months, after which it is automatically deleted by Google servers.
Processed securely by Vercel Inc. (cookieless infrastructure), Google LLC (GA4, only upon consent), and Clerk Inc. (authentication).
You can withdraw or update your cookie preferences at any time by visiting our dedicated Cookie Notice Page and clicking "Change Cookie Preferences". If rejected, no analytics cookies are stored and no analytics requests are dispatched.
• Strict Guardrail: We NEVER put personal names, phone numbers, email addresses, UTR numbers, or birth charts into analytics events or URLs.
7. Your Legal Rights (DPDPA 2023)
Under the Digital Personal Data Protection Act, 2023, you have clear rights regarding your personal data:
8. Physical Sanctum Address & Privacy Grievance Officer
To exercise your data protection rights, request data erasure, or submit questions regarding this policy, please contact our designated Privacy Grievance Officer:
Unit No. A-1212 D, Tower A, Spectrum@Metro Phase 1, Sector 75, Noida, G.B. Nagar - U.P. 201301