Privacy Policy

Data controller

The data controller is ROCKETDEV, 14160 Dives-sur-Mer, France. Email: [email protected].

Guest purchase and optional account linking

When a user starts an iOS DIGITAL purchase without signing in, the app creates an anonymous Better Auth principal just in time to bind the selected card and purchase to an opaque owner. Linking that guest purchase to an email account later by magic link is optional and supports recovery across devices.

Data collected

Depending on the feature and product used, we process the following data:

• Email address: when provided for account linking, order confirmation, recovery or delivery.
• Name: when provided for an account, order or physical delivery.
• Phone number: only when supplied for delivery of a physical product such as a poster or phone case.
• Physical address: only for an order and delivery of a physical product such as a poster or phone case.
• User ID: an opaque anonymous or linked Better Auth identifier used to secure ownership and access.
• Purchase history: order, transaction, fulfillment, refund and access status needed to provide and reconcile a purchase.
• Other user content: the star-map location, date, time, style, selected options and custom text needed to create the product.
• Payment processing: Apple StoreKit processes iOS DIGITAL In-App Purchases; Stripe processes physical product payments in the app and website payments. OwnStarMap keeps provider and order references, not a full card number or security code.
• In the aggregated iOS privacy manifests, Stripe payment information is declared linked to the user, used for app functionality, and not used for tracking.
• In the aggregated iOS privacy manifests, Stripe product interaction is declared linked to the user, used for analytics and app functionality, and not used for tracking.
• Network and technical data such as an IP address may be processed by the website or API for security, rate limiting and troubleshooting.
• Location search: only when you explicitly start a search, the text you enter and the selected app language are sent to OwnStarMap and to the OpenStreetMap Foundation's public Nominatim service to return matching places. The response may be held in a shared, time-limited cache; OwnStarMap does not maintain a person-specific location-search history.
• Locale and network context: we process the language selected by your device or browser. Cloudflare processes the IP address and, for website requests, provides a country code used only to localize currency and presentation.
• Apple App Privacy categories for the iOS app are Contact Info (email, name, phone number and physical address), Identifiers (User ID), Purchases, User Content, Search History, Diagnostics, Other Data Types, Financial Info (Payment Info) and Usage Data (Product Interaction). They are declared as linked to the user for the stated functionality, analytics, personalization or developer advertising purposes, and none is used to track you.

A loved one's data (“dual” reading)

If you order the “Le dialogue de deux ciels” option, you provide us with the first name and date of birth of the person you associate with your reading. This information is used solely to write this symbolic reading: the first name is used to address the person and is not included in any calculation. We do not collect either the birth time or the birth place. The legal basis is legitimate interest (article 6.1.f of the GDPR), with you confirming that you have the consent of the person concerned. Recipient: our in-house astrologer. This data is never included in the payment information; it is deleted upon the deletion of your account, in the event of a refund, and at the latest 6 months after delivery. The person concerned may object to this processing or request its erasure at any time at [email protected].

Post-purchase review invitations

After an eligible order, OwnStarMap may send a generic post-purchase review invitation through Resend with a public Trustpilot review link. It does not include a private order-access link; Trustpilot processes information you voluntarily provide there under its own policy.

Duo customer reviews

After a Duo purchase, we may send you a transactional invitation to share your experience. If you respond, we retain the public name, rating, comment, purchase verification linked to the order, and the date and version of your consent. A review is published only with your agreement and after moderation. You may withdraw that agreement and request deletion at any time at [email protected]. Duo reviews are deleted three years after submission and their immutable consent record; data associated with their invitations is deleted three years after creation, or earlier on request.

Purposes of processing

Your data is used for:

• Processing and managing your order.
• Delivering the product (digital or physical).
• Sending transactional emails (order confirmation, download link).
• Measuring and improving the website only when the corresponding consent has been given.

Legal basis

Order and access data is processed to perform the contract; accounting records are retained to meet legal obligations; optional website analytics and review publication rely on consent; security and strictly necessary service protection rely on legitimate interests. A specific section above explains the basis for a loved one's data.

Data recipients

Only data needed for the relevant function is shared with these providers or partners:

• Apple: StoreKit processing, transaction status and App Store refund lifecycle for iOS DIGITAL purchases.
• Stripe: website payments and physical product payment, contact and shipping details in the mobile app.
• Hostinger (Hostinger International Ltd, Lithuania): website, API and backend hosting.
• Resend (Resend, Inc., United States): transactional email delivery.
• OpenStreetMap Foundation public Nominatim service: OwnStarMap sends only the place-search text and selected language after you explicitly request a location search.
• Cloudflare: edge delivery, security and country-code signal for website presentation; it processes request network information including IP address.
• Trustpilot: public review destination; it receives only data you choose to provide after leaving OwnStarMap.
• Online ordering intermediaries; sellers, printers or manufacturers; postal and delivery carriers. Depending on the fulfillment route, they receive only the personalized file, product specifications and options and/or the recipient name, email address, postal address, phone number and order reference needed to make and deliver the physical product, such as a poster or phone case.

Data retention

Account and gallery data is kept while the account is active and as needed to provide the service. A confirmed account deletion removes authentication artefacts and the server gallery, anonymizes the account identity and revokes account-based digital access; an active physical order or StoreKit-controlled purchase must be resolved first. Paid-order, transaction, shipping and billing records are retained for the applicable French accounting archive period, currently 10 years. The loved-one and Duo-review sections above state their shorter specific periods.

International transfers and equal protection

When personal data is transferred outside the EEA, every provider actually used must provide the same or equal protection required by applicable law. The verified mechanisms for the named providers are listed below. You may obtain a copy of the applicable transfer safeguards by writing to [email protected].

• Apple: EEA, UK and Swiss transfers rely on the European Commission Standard Contractual Clauses and Apple states that transferred data receives the same high standard of protection.https://www.apple.com/legal/privacy/
• Stripe: its DPA and Data Transfer Addendum form part of the services agreement and use the Data Privacy Framework where applicable, then the relevant Standard Contractual Clauses.https://stripe.com/legal/dpahttps://stripe.com/legal/dta
• Resend: its DPA is incorporated into the Terms, identifies United States processing and provides the EU Standard Contractual Clauses and Data Privacy Framework safeguards.https://resend.com/legal/dpa
• Hostinger: its DPA is annexed to the Terms and includes Standard Contractual Clause Modules 2 and 3 plus contractual subprocessor protections.https://www.hostinger.com/legal/dpa
• OpenStreetMap Foundation public Nominatim service: OSMF is an independent controller, not an OwnStarMap processor, and applies its own privacy policy to the explicit search request. The public service must not receive confidential material.https://operations.osmfoundation.org/policies/nominatim/https://osmfoundation.org/wiki/Privacy_Policy
• Cloudflare: its DPA provides the EU-US Data Privacy Framework for eligible transfers and EU Standard Contractual Clauses with supplementary measures where the Framework does not apply.https://www.cloudflare.com/cloudflare-customer-dpa/
• Trustpilot: Trustpilot A/S is established in Denmark (EEA). If you follow the public review link, its own privacy policy applies to the information you voluntarily provide.https://legal.trustpilot.com/for-businesses/business-privacy-policy/3

For each physical product order, including a poster or phone case, OwnStarMap records the actual recipients used, the data categories shared, the countries involved and the applicable transfer mechanism. You may request the identity of the actual recipients and the applicable safeguards by exercising your right of access at [email protected].

Account deletion and refunds

Account deletion is an identity and access deletion request; it does not automatically request or trigger a refund for a digital service already supplied or a physical product already delivered. App Store refunds and other support, correction, replacement or refund requests remain separate processes. Deletion does not remove mandatory rights of withdrawal, conformity or reimbursement that apply by law.

Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: obtain confirmation that your data is being processed and receive a copy.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request the deletion of your data under the conditions provided by law.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to the processing of your data on legitimate grounds.
• Right to restriction: request the limitation of processing of your data.

To exercise your rights, contact us by email at [email protected]. We respond within 30 days.

Website analytics and mobile tracking

On the website, analytics and marketing consent is denied by default; OwnStarMap analytics events are sent only after the visitor accepts the corresponding consent and that choice can be withdrawn. The iOS mobile app has no advertising, no advertising SDK and no cross-app tracking, and declares no tracking domains. This release sends no OwnStarMap product events to an external mobile analytics service; Apple and Stripe process payment interactions under their own policies.

Complaints

If you believe that the processing of your data does not comply with regulations, you may file a complaint with the French Data Protection Authority (CNIL): cnil.fr.