Privacy Policy

This Privacy Policy explains what information Sablestar (a service of Iterategy LLC, 901 H Street, STE 120 PMB 1059, Sacramento, CA 95814) collects, how we use it, and the choices you have. Iterategy LLC is the data controller for the personal data described here. Questions, deletion requests, and other privacy enquiries can be sent through our contact form.

1. What we collect

To produce your natal-chart report we collect:

• Birth data: the name you provide, date and time of birth, and birthplace (with the latitude, longitude, and IANA timezone derived from it). This is the minimum required to compute a natal chart.
• Email address and name as captured by Stripe at checkout, used for the purchase receipt, customer support, and re-sending your report link on request.
• Payment information is processed by Stripe and never reaches our servers — we do not see or store your card number or CVC. From the completed Checkout Session we receive only the order id, payment status, amount, currency, and the buyer email and name listed above. To fulfil and re-deliver your purchased report, we also store your birth details (name, date, time, and birthplace) and a record of the immediate-delivery consent you ticked at checkout in the Stripe Checkout Session metadata attached to your order.
• Operational logs: standard request logs (IP address, user agent, timestamps, and error traces) generated by our hosting and error-monitoring providers to keep the service running, detect abuse, and diagnose failures.

2. How we use it

• To compute and render your natal-chart report.
• To send your computed chart to a third-party AI language-model provider so it can write the interpretation attached to your report. The provider acts as a processor for that request; their handling of the data — including any retention for abuse-detection or model-improvement — is governed by their own policies, which we do not control.
• To process your payment via Stripe.
• To send transactional email via a transactional email delivery provider (your receipt + report link, and any report-recovery emails you request).
• To respond to support requests, prevent abuse, comply with legal obligations, and improve the service.

3. Retention & deletion

After your report is generated we store a copy on our servers for up to 60 days so you can re-open it from your emailed link or recover it later; after that it is automatically deleted. Sablestar does not maintain a long-term database of birth records beyond that 60-day report window and the Stripe Checkout Session metadata described below.

When you pay for a report, your birth details (name, date, time, and birthplace) and the text of the finality-consent you ticked are stored in the Stripe Checkout Session metadata so that we can fulfil your order, re-deliver the report if needed, and produce evidence in a payment dispute. Stripe retains purchase records — including that metadata — for tax, accounting, and fraud-prevention purposes per Stripe’s own privacy policy.

Standard request logs (including IP addresses) are retained by our hosting and error-monitoring providers for short, platform-controlled windows — typically up to 30 days — for security and abuse-prevention. Rate-limit counters expire automatically at the end of each limit window (a few minutes at most). You may request deletion of any personal data we hold about you using the contact below.

If you believe we are holding personal data about you and would like a copy or deletion, reach us through our contact form using the email address used at checkout. We may ask for additional information to verify your identity before responding so we don’t act on a request from someone other than you. We aim to respond within 30 days.

4. Your rights

Depending on where you live, you may have the right to access, correct, or delete the personal data we hold about you, to object to or restrict certain processing, to data portability, or to withdraw consent. These rights are available to you under the EU and UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and similar laws in other jurisdictions. California residents have the right not to be discriminated against for exercising these rights. We do not sell personal data, and we do not share it for cross-context behavioural advertising.

To exercise any of these rights, contact us through our contact form. If you are in the EU or UK and believe we have not handled your data properly, you also have the right to lodge a complaint with your local data-protection authority.

5. Subprocessors

We rely on the following third-party service providers to deliver the service. Each processes only the data needed for the role described:

• Vercel — cloud hosting, content delivery, and request logging.
• Stripe — payment processing and storage of the order metadata described in §3.
• OpenRouter — AI language-model API for the written interpretation in your report (automated processing). Your birth data is sent to OpenRouter as part of that request; their handling — including any retention for abuse-detection — is governed by their own policies.
• Upstash Redis — server-side storage of the generated report (up to 60 days) and short-lived rate-limit/abuse-prevention counters.
• Resend — transactional email delivery of your report link, receipt, and any report-recovery emails, which processes your email address.
• PostHog — product analytics (first-party cookie; data is not used for advertising).
• Cloudflare Turnstile — bot/abuse check on the free-preview endpoint; receives a challenge token and your IP address for verification, no profile is created.
• Sentry — error monitoring; receives error traces and request metadata (we strip request bodies so birth data is not attached).

Birthplace lookup is performed on our own servers using a bundled cities dataset; no third-party geocoding service is contacted with the place you enter.

6. Cookies & local storage

We use browser storage in two categories:

• Essential / functional (always on) — browser sessionStorage to remember your in-flight birth details between the form and the report screen (cleared when you close the tab), and localStorage for a pseudonymous identifier used to link your browser session to server-side processing of your report request. Neither contains personal data and neither is used for advertising.
• Analytics (requires your consent) — a first-party cookie that mirrors the pseudonymous identifier above, used solely to measure which steps of the purchase funnel are completed (e.g. how many visitors start the form vs complete checkout). This cookie does not track you across other websites and contains no personal data. It is only set after you click “Accept” on the cookie banner, and you can withdraw consent or block it at any time using the “Cookie preferences” link in the footer.

You can also block or delete any cookie through your browser settings. Blocking the analytics cookie has no effect on the service — your report will still be generated and delivered normally.

7. International data transfers

Sablestar is operated from the United States. If you access the service from the EU, UK, or another country, your personal data will be transferred to and processed in the United States and any other country where our subprocessors operate. Where required, our subprocessors rely on appropriate transfer mechanisms (such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum) for those transfers.

8. Children

Sablestar is not directed to children. We do not knowingly collect personal data from anyone under 16, and you must be 18 (or the age of legal majority in your jurisdiction) to purchase a report — see our Terms of Service.

9. Changes

We may update this policy from time to time; the "Effective" date at the top reflects the latest version. Material changes will be highlighted at the top of this page.