Privacy Policy
- Data controller:
- Fabervant
- Effective:
1. Who we are
Astrolect is operated by Fabervant Teknoloji Anonim Şirketi (Fabervant), a joint stock company registered in Türkiye; in this policy “we” and “us” mean Fabervant. Fabervant is the data controller (veri sorumlusu) for the personal data described here. Our registered address is Cevizli Mahallesi, Zuhal Caddesi, Ritim İstanbul A Ticari Blok, No: 46, İç Kapı No: 50, Maltepe, İstanbul, Türkiye; MERSİS no. 0384101861600001. You may also apply by registered electronic mail (KEP) to [email protected].
You can reach us about anything in this policy at [email protected].
2. What Astrolect is
Astrolect calculates astronomical positions for moments in time and scores them against a rulebook drawn from classical and modern electional astrology. It is an interpretive tradition, presented transparently — not a predictive or advisory service.
This policy describes what we do with your data. It makes no claim about what the service can tell you.
3. What we collect: your account
Your email address, which identifies your account and is where we send verification and password-reset messages.
Your password, stored only as a cryptographic hash. We never store the password itself. If you sign in with Google we store no password at all; we store the identifier Google gives us for your account instead.
Whether your email address has been verified, how much of your scan allowance remains, the date your account was created and the language you signed up in, and a daily count of the day details you opened.
4. What we collect: the people you add
To personalize a scan, Astrolect reads a birth chart, and a birth chart needs birth data. For each person you add — up to two people per account — we store a name or label of your choosing (it need not be their real name), a date and time of birth, a place of birth with its coordinates and timezone, a gender if you give one, a photograph if you add one, and the time you confirmed you have their permission. Gender and the photograph are optional; the rest is not.
Birth time is required to personalize a scan, and we do not substitute a noon chart when it is missing. An assumed birth time produces an arbitrary result rather than an approximate one, so we would rather ask than guess.
Photographs are reduced in size by your own browser before they are sent to us and are capped at 256 KB. They are stored in our database alongside the rest of that person’s record, not as loose files in a public folder, and they take no part in any calculation.
5. A notice for people someone else has added
This section is written to you if someone with an Astrolect account added your birth details — a partner, a relative or a business partner, for example. They may have sent you this page: the “Add person” dialog links to it so that they can.
What we hold about you: the name or label they chose for you, which need not be your real name; your date, time and place of birth; and, only if they gave them, your gender and a photograph. We hold no contact details for you. That is why we cannot write to you ourselves, and why we publish this notice instead.
Why: to calculate the birth chart they asked Astrolect to take into account when choosing a date. The legal basis is our legitimate interest in providing the service they asked for, provided it does not harm your fundamental rights and freedoms (KVKK Art. 5(2)(f)), together with their declaration that you agreed. Your record is seen only by that account holder and by our small team (see section 10); it is used for nothing else and never sold.
Before we store your record, the account holder must confirm that you agreed and that you know how your data is used, and we will not save it until they do. If you are the account holder, please treat that confirmation as a real undertaking rather than a box to clear.
You have the rights described in section 13, and you do not need an Astrolect account to use them. To have your record deleted, write to [email protected], or send registered electronic mail (KEP) to [email protected]. So that we can find the record, give your date and place of birth and, if you know it, the email address of the account that added you. We delete the record and its photograph and tell you when it is done. A request for a copy of the record also needs proof that it is about you; we will tell you what to send.
6. What our servers record automatically
Web server access logs, which record the IP address a request came from, the time, the page requested and your browser’s user-agent string. These are ordinary web-server logs, kept for security and diagnosis.
Rate-limiting counters keyed on IP address, held in memory only and never written to the database. They exist so that one visitor cannot exhaust the service for everyone else.
Error logs. When something fails we record what failed. These can contain an email address — for example when a message to you could not be delivered — and an internal account number. They do not contain passwords or photographs.
Crash and timing reports. When the application fails — on our servers or in your browser — a report of what failed, and where in our code, is sent to Sentry (see section 10). Every report is stripped before it is sent of anything that identifies a person: it carries no email address, account number, IP address, cookie, birth data or text you typed. For about one page load or request in ten, a report of how long each step took is sent the same way. Each report also carries the address of the page it came from, without anything after the “?” and with account and record numbers removed, how long each step took, your browser’s name and version, and a short technical description of the largest part of the page shown and of the part you tap or click; it carries no IP address and no device identifier. Your browser never contacts Sentry itself: its reports pass through our own server, so Sentry does not see your IP address.
We run no advertising service, and Astrolect shows no advertising. The only analytics is Google Analytics, and it runs only if you allow it (section 7). We check automatically against the live site, not against our own configuration, that no analytics or advertising tag loads before a yes.
7. Statistics and measuring our own advertising
Where statistics are offered, Astrolect asks you once, on a card with three equal answers - “Allow all”, “Statistics only” and “No” - and on the create-account form as an optional box that means “Statistics only”. Nothing is sent to Google and no Google cookie is set before a yes. You can change your choice at any time with the “Statistics choice” link at the foot of every page; choosing “No” stops the sending and deletes the Google cookies from this browser, and so does signing out.
With “Statistics only” or “Allow all”, Astrolect loads Google Analytics (Google LLC, United States). It counts visits, the pages viewed, the type of device and browser used, and the site or search a visit came from, using the cookies _ga and _ga_<id>, which last 13 months from your last visit. Google Analytics does not store your IP address; it uses it only to work out a country and city. Google signals, user-provided data collection and Google’s data-sharing settings are off, and Google keeps the data for 14 months after your last visit.
“Allow all” also lets Google use its cookies, including _gcl_* cookies that last up to 90 days, to measure whether a visit came from one of Fabervant’s own advertisements of Astrolect. Google is never allowed to use your visits to show you advertising, on Astrolect or anywhere else: personalised advertising is refused on every answer.
Where you first came from. When you first open Astrolect, your browser notes where the visit came from: the address of the referring site without its path or query, and any campaign tags (utm_…) in the link. This note stays in your browser and is deleted when you sign out. Only after a yes, when you create an account, is it kept with your account, together with, after “Allow all” only, the Google click identifier (gclid) of that first visit.
We keep your statistics answer, its time and the version of the text you answered with your account, or in your browser if you have no account, so that we can show which text a yes was given to.
In some countries Astrolect asks no statistics question, loads no Google Analytics and offers no launch list. From visits there, our own server counts only page loads per day and country, with no identifier of any kind.
8. The launch list
If you ask on our home page to be told when Astrolect opens, we keep your name and surname, your email address, the language of the page, and the time and wording of your consent. We use them only to send you one email when Astrolect opens. Before your address joins the list we send you a link to confirm it, and once you confirm, a second email confirming it with a link to withdraw. Unconfirmed requests are deleted after 7 days.
As Law No. 6563 requires, your consent is recorded in the İleti Yönetim Sistemi (İYS), Türkiye’s register of commercial-message consents, run by İleti Yönetim Sistemi A.Ş. in Türkiye; a withdrawal is recorded there too.
You can withdraw at any time, free of charge, with the link in every email we send you or by writing to [email protected]. Your name and address are then removed from the list at once; otherwise they are removed 30 days after the launch email is sent. The record of your consent and of its end - name, address, times and wording - is kept for three years after the consent ends, only as the proof the law requires, and then deleted.
9. Why we process it
Your email address, password hash and verification state, and a fingerprint of each session key that has ended (when you sign out or when we renew it): to create and secure your account, to let you sign in, and to make sure such a key cannot be used again. This is necessary to perform our contract with you (KVKK Art. 5(2)(c)).
Your scan allowance: to provide the service and to prevent abuse. This is necessary to perform our contract with you (KVKK Art. 5(2)(c)).
The birth data of the people you add: to calculate and score the charts you asked for. For your own data, this is necessary to perform our contract with you (KVKK Art. 5(2)(c)). For anyone else you add, it rests on our legitimate interest in providing the service you asked for, provided it does not harm that person’s fundamental rights and freedoms (KVKK Art. 5(2)(f)), and on your declaration that you have that person’s permission.
Photographs: so that you can tell the people on a scan apart. Entirely optional, and not analyzed. The legal basis is the same as for birth data: our contract with you for your own photograph, and for anyone else’s, our legitimate interest and your declaration that you have their permission.
Access logs, rate-limit counters and error logs: security, abuse prevention and diagnosis. The legal basis is our legitimate interest in keeping the service secure and working, provided it does not harm your fundamental rights and freedoms (KVKK Art. 5(2)(f)).
Crash and timing reports: finding and fixing faults, and keeping the service fast enough to use. The legal basis is our legitimate interest in keeping the service secure and working, provided it does not harm your fundamental rights and freedoms (KVKK Art. 5(2)(f)).
Statistics with Google Analytics, measuring Fabervant’s own advertising (“Allow all” only), and keeping the first-visit record with your account: your explicit consent (açık rıza, KVKK Art. 5(1)), given on the statistics card or the create-account box and withdrawn at any time with the “Statistics choice” link.
The launch list: your explicit consent (KVKK Art. 5(1)) and your consent to commercial email under Law No. 6563. Recording it in İYS and keeping the record of it for three years after it ends: our legal obligation (KVKK Art. 5(2)(ç)).
Your sign-up language: to write to you in your language, as part of our contract with you (KVKK Art. 5(2)(c)).
We collect this data electronically: partly by automated means, through our servers’ automatic records, and partly through the sign-up, add-person and launch-list forms and the statistics card you fill in.
Under Turkish law (KVKK), a name combined with a date and time of birth is personal data, and a photograph identifying a person is personal data. We treat the birth records you enter as sensitive in practice however they are classified, because they identify a specific person at a specific moment.
11. Where it is stored
On a server in Turin, Italy, inside the European Union, in a PostgreSQL database. Traffic between your browser and us is encrypted in transit. Backups are kept encrypted on a backup disk in Türkiye under Fabervant’s control; the two newest are kept. Crash and timing reports are stored by Sentry in Frankfurt, Germany, inside the European Union.
Google Analytics data is processed by Google in the United States. The İYS register is kept in Türkiye.
12. How long we keep it
Your account and everything in it: until you delete it. An account whose email address is never verified is deleted, with everyone in it, 30 days after it was created. We do not otherwise expire dormant accounts, so if you have abandoned a verified account holding someone else’s birth data, please delete it or ask us to.
A person you delete is deleted immediately, and their photograph is removed in the same operation. Deleting your account deletes every person in it and their photographs at once. Deleted data remains in our encrypted weekly backups for at most 15 days, after which it is gone from them entirely.
Verification and password-reset links are valid for a limited time. The records behind them remain after use and are purged regularly.
Crash and timing reports: up to 90 days at Sentry, after which they are deleted. Sentry deletes its own backups of them within 90 days.
Web server logs, which record the IP address a request came from: at most 14 days, after which they are deleted. Deleting your account does not remove them sooner.
Records of the emails we send to an account (which account, what for, when, how many), kept to limit how many we send: deleted within two days.
When a session key ends, because you signed out or because we renewed it (about once a day), we keep a fingerprint of it, never the key itself, so that it cannot be used again: until the key would have expired anyway, at most 32 days, then it is deleted.
A Google sign-in in progress (its security codes, the page to return you to, your language, whether Astrolect is offered where you are, your statistics answer and the first-visit note): valid for 10 minutes and deleted within a day.
Google Analytics: 14 months after your last visit; its cookies 13 months from your last visit (_ga) or up to 90 days (_gcl_*), or until you choose “No” or sign out. The first-visit record: with your account until you delete it or withdraw your statistics consent; in your browser until you sign out.
The launch list: as described in section 8.
13. Your rights
Under KVKK Article 11, you may ask us whether we hold data about you, what it is, that it be corrected, that it be deleted, and that we stop processing it.
Two of these you can do yourself, immediately, inside Astrolect: delete a person, using the button on that person’s row, which removes their record and photograph; and delete your account, which removes the account and everyone in it.
For anything else — including access to a copy of your data and correction of it — write to [email protected]. There is no automated export, so these requests are fulfilled by hand. We answer within 30 days.
If you are a person whose data someone else entered, you can reach us at the same address; you do not need an account to do so.
If we refuse your request, you find our answer insufficient, or we do not answer in time, you may complain to the Turkish Personal Data Protection Board within 30 days of learning our answer and in any case within 60 days of your request.
14. If something goes wrong
If personal data we hold is exposed, lost or accessed by someone who should not have it, we will notify the Turkish Personal Data Protection Board without delay and within 72 hours of becoming aware of it, and the people affected as soon as reasonably possible.
We will tell you what happened, what data was involved, and what we are doing about it — including where the answer is that we do not yet know.
16. Security
Passwords are stored only as hashes. The session cookie is httpOnly, so a script running on the page cannot read it. The site is served over HTTPS. Photographs are held in the database and served only to the account that owns them, never from a public folder.
The birth data and photographs described above are stored without encryption at rest. That means they are protected by the security of the server and the database rather than by a key, and a stolen copy of the database would be readable.
No system is perfectly secure. If you believe your account has been accessed by someone else, write to us at the address above.
17. Children
Astrolect is not intended for people under 18, and we do not knowingly create accounts for them.
18. Changes to this policy
If we change the Privacy Policy, we change the effective date at the top, and where the change is significant we also tell you in the application. The Privacy Policy is information about how we process your data, not a contract you accept.