Privacy Policy – Siddhanta (AstroMotion 3D)

**Last Updated:** September 20, 2026

**Effective Date:** September 20, 2026

1. Introduction & Scope

Welcome to **Siddhanta** (also known as **AstroMotion 3D**), accessible via our web and mobile applications (the "Platform", "Service", or "Application"). This Privacy Policy explains how Siddhanta ("we", "us", or "our") collects, uses, stores, shares, and protects your personal data when you access or use our platform, including our interactive 3D astronomical simulations, Vedic Janam Kundli charts, Krishnamurti Paddhati (KP) calculators, Ashtakoot Milan matchmaking, Astrologer CRM, and developer APIs.

We are committed to processing your personal data transparently, securely, and in strict compliance with applicable global data privacy regulations, including:

**The Digital Personal Data Protection Act, 2023 (DPDP Act, India)**

**The General Data Protection Regulation (GDPR - EU 2016/679) and UK GDPR**

**The California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA)**

**Children's Online Privacy Protection Act (COPPA, United States)**

**Google Play Data Safety and Apple App Store Privacy Nutrition guidelines**

Please read this policy carefully. By accessing or using Siddhanta, you acknowledge that you have read, understood, and consented to the practices described herein. If you do not agree with this policy, please refrain from using the Platform.

2. Data Fiduciary / Controller Information

For the purposes of applicable data protection laws, the Data Fiduciary / Data Controller is:

**Entity / Operator:** Siddhanta Ephemeris & Astrological Systems (Operated by Yeshwanth Dornala)

**Contact Email:** `privacy@astromotion.ai` / `support@siddhanta.app`

**Registered Address:** Hyderabad, Telangana, India

**Data Protection / Grievance Officer:** Grievance Officer, Data Governance Desk (`grievance@astromotion.ai`)

3. Data We Collect & Sources

We only collect data that is strictly necessary to calculate astronomical planetary motions, construct Vedic horoscopes, authenticate your session, process subscription upgrades, and manage astrologer consultation records.

A. Data You Provide Directly

**Account & Identity Data:**

- Name, display nickname, email address, profile avatar.

- User credentials (or OAuth identity tokens from Google).

**Natal & Astrological Data (Saved Kundli Profiles):**

- Exact Date of Birth (Day, Month, Year).

- Exact Time of Birth (Hour, Minute) or indication that birth time is unknown.

- Place of Birth (City name, State/Region, Country).

- Geographic Coordinates (Latitude and Longitude) and Timezone Offset from UTC.

- Relationship tag (e.g., "Self", "Spouse", "Child", "Parent", "Client", "Friend").

- Personal astrological notes or biographical chart annotations.

**Astrologer Studio & CRM Records (For Astrologers / Studio Users):**

- Practice name, tagline, branding logo URL, professional contact phone/email.

- Client consultation notes, session dates, audio memo URLs, fee records, and custom report disclaimers.

**Billing & Commercial Records:**

- Transaction records: Selected subscription tier (`Free`, `Plus`, `Studio`, `Enterprise`), order ID, payment timestamp, payment gateway reference ID (e.g., Razorpay payment ID, Stripe customer ID).

- *Note:* We **never** store, process, or transmit raw credit/debit card numbers, CVVs, or bank net-banking passwords. All payment transactions are handled directly by PCI-DSS Level 1 certified payment gateways (Razorpay and Stripe).

B. Data Collected Automatically

**Device Geolocation (When Explicitly Permitted):**

- If you click "Detect Device GPS" in the birth form, your browser prompts you for location permission. If granted, your browser provides high-precision device latitude and longitude (~11m accuracy) solely to populate the birth coordinates.

- *Note:* We do **not** track continuous or background real-time location.

**Technical & Telemetry Data:**

- IP address, browser type and version, operating system, preferred language, referring URL, time spent per session, and API request quotas.

**Cookies & Local Storage:**

- Session identifiers (`jwt`, `next-auth`, or local session tokens), UI state (active ayanamsha, language preference, theme mode, 3D camera angles).

C. Data from Third Parties

**Google OAuth 2.0:** When you sign in via Google, we receive your Google user ID (`sub`), verified email address, full name, and profile picture.

**OpenStreetMap (Nominatim API):** When searching for a birth city, your search text is resolved against OpenStreetMap to obtain standardized latitude, longitude, and administrative district names.

4. Special Category & Sensitive Personal Data Notice

Under GDPR (Article 9) and DPDP Act 2023, data revealing religious, philosophical, or spiritual beliefs is considered **Special Category / Sensitive Data**.

Because Vedic Jyotish (astrology) is rooted in traditional philosophical and cultural traditions, your birth chart calculations and related queries may reflect personal, spiritual, or philosophical beliefs.

**Explicit Consent Notice:**

By creating an account and entering your birth details or consulting our AI/KP astrologer engines, you provide **explicit, voluntary, and unambiguous consent** for Siddhanta to process this data solely for generating astronomical ephemeris models, horoscope charts, and customized astrological interpretations. You retain the right to withdraw this consent and delete your data at any time.

5. Processing of Children's and Minors' Data (COPPA & DPDP Section 9)

**Age Requirement:** The Platform is intended for individuals aged 18 and older. Children under 18 may not create standalone accounts.

**Charts for Children Created by Parents/Guardians:**

In Vedic culture, parents routinely calculate horoscopes for newborn infants or children. Under **Section 9 of the DPDP Act (India)** and **COPPA (United States)**:

- Entering birth data for a minor under 18 is permitted **strictly when performed by the minor's lawful parent or legal guardian**.

- By creating a profile for a child or dependent, the parent/guardian expressly affirms legal authority to provide such birth information.

- We do not direct behavioral advertising or tracking toward children.

6. Purpose of Processing & Legal Bases

We process your data under the following legal bases recognized under GDPR and DPDP:

Purpose	Category of Data	Legal Basis
Calculating ephemeris, planetary positions, D1–D60 charts, KP cusps, and dashas	Birth date, time, latitude, longitude, timezone	Performance of Service / User Consent
Managing user account and synchronizing saved Kundli profiles across devices	Name, email, password/OAuth token, user ID	Performance of Contract (Terms of Service)
Processing premium subscriptions and API key quotas	Transaction IDs, subscription tier, payment status	Legal Obligation & Contract Performance
White-label Astrologer CRM and consultation notes	Client profile IDs, astrologer notes, consultation tags	Performance of Contract (Astrologer Studio)
Security monitoring, rate limiting, and DDoS prevention	IP address, user-agent, API request volume	Legitimate Interest
Customer support and resolving technical issues	Email, error traces, query metadata	Legitimate Interest / User Consent

7. Data Sharing & International Transfers

We do **not** sell, rent, or trade your personal data, birth details, or consultation notes to third-party data brokers, marketers, or advertisers.

We share data only with trusted service providers acting as Data Processors under strict Data Processing Agreements (DPAs):

**Database & Infrastructure Providers:**

- **Supabase Inc. (PostgreSQL Cloud)**: Managed cloud database storage (encrypted at rest with AES-256).

- **Vercel Inc.**: Next.js hosting, serverless edge functions, and CDN distribution.

**Payment Processors:**

- **Razorpay Software Private Limited** (India & International transactions).

- **Stripe Inc.** (Global recurring subscriptions and billing portal).

**Authentication & Identity:**

- **Google Identity Services (Google LLC)** for single sign-on authentication.

**Geocoding:**

- **OpenStreetMap Foundation (Nominatim API)** for public place-name coordinate lookups (no personal names or emails transmitted).

Cross-Border Data Transfers

Your information may be stored and processed on servers located in India, the United States, or the European Union depending on serverless edge deployment regions. When personal data is transferred from the EEA/UK to other jurisdictions, we rely on standard contractual clauses (SCCs) and adequacy decisions to ensure an equivalent level of protection.

8. Data Security Measures

We implement industry-standard administrative, physical, and technical security safeguards:

**Encryption in Transit:** All traffic is encrypted using TLS 1.3 / HTTPS.

**Encryption at Rest:** Cloud database tables and volumes are encrypted with AES-256.

**Row-Level Security (RLS):** Supabase database tables enforce strict tenant isolation so users can only access their own profiles and consultation notes.

**API Key Security:** Developer API secret keys are hashed using SHA-256 before storage; raw keys cannot be retrieved once created.

**Token Security:** Authentication tokens (JWT) are signed cryptographically with strict expiration windows and secure cookies (`HttpOnly`, `Secure`, `SameSite=Lax`).

**No Card Storage:** PCI-DSS Level 1 compliance is offloaded directly to Stripe and Razorpay.

9. Data Retention & Deletion ("Right to Be Forgotten")

**Active Accounts:** We retain your account data and saved horoscopes as long as your account remains active.

**User-Initiated Profile Deletion:** You can delete individual saved Janam Kundali profiles at any time through the "Saved Charts" dashboard. Deletions are immediately cascaded through the database.

**Full Account Erasure:** You may request complete account deletion by clicking "Delete Account" in your profile settings or by emailing `privacy@astromotion.ai`. Upon receiving your request:

- All associated profiles, consultation notes, API keys, and query histories are permanently purged within thirty (30) days.

- Invoicing and financial transaction records may be retained for up to 7 years solely to satisfy statutory tax, accounting, and anti-fraud obligations.

10. Your Privacy Rights

Depending on your country or state of residence, you have the following legal rights regarding your personal data:

**Right to Access & Portability:** Request a copy of the personal data we hold about you in a structured, machine-readable format (JSON/PDF).

**Right to Rectification:** Correct inaccurate or incomplete birth details or profile settings.

**Right to Erasure / Deletion:** Request the permanent deletion of your personal data.

**Right to Withdraw Consent:** Revoke previously given consent at any time without affecting the lawfulness of prior processing.

**Right to Object / Restrict Processing:** Object to automated profiling or restrict processing under certain conditions.

**Right to Grievance Redressal (DPDP Act, India):** Submit complaints regarding data handling to our designated Grievance Officer, with escalation rights to the Data Protection Board of India.

**California Privacy Rights (CCPA/CPRA):**

- Right to know what personal information is collected, disclosed, or sold.

- Right to non-discrimination for exercising your privacy rights.

- Siddhanta **does not sell or share** your personal information for cross-context behavioral advertising.

To exercise any of these rights, contact our Data Governance Desk at `privacy@astromotion.ai`. Requests are fulfilled within 30 days free of charge.

11. Cookies & Tracking Technologies

Siddhanta uses only essential and functional cookies:

**Essential Cookies:** Maintain authenticated sessions, prevent cross-site request forgery (CSRF), and route traffic securely.

**Functional Preferences:** Store your preferred ayanamsha (Lahiri, KP, Raman), chart style (North Indian vs South Indian), UI theme, and language.

We do **not** employ third-party advertising cookies, cross-site trackers, or invasive analytics pixels.

12. Updates to this Privacy Policy

We may update this Privacy Policy periodically to reflect new features, security enhancements, or legal requirements. Material changes will be communicated via a prominent notification banner within the Platform or via email to registered users at least 14 days before taking effect.

13. Grievance Officer & Contact Information

If you have any questions, concerns, or grievances regarding this Privacy Policy or our data handling practices, please reach out to our designated officer:

**Data Protection & Grievance Officer:** Yeshwanth Dornala

**Email:** `grievance@astromotion.ai`

**Platform Inquiries:** `support@siddhanta.app`

**Jurisdiction:** Hyderabad, Telangana, India

*For European Union residents, you also have the right to lodge a complaint with your local Data Protection Supervisory Authority.*

Privacy Policy