SPHUṬA

Last updated: July 2026

Privacy Policy

Sphuṭa ("Sphuṭa", "we", "us", "our") operates a platform that connects people seeking guidance ("clients", "you") with independent Vedic astrologers, and gives astrologers the tools to run their own consultation practice online. This Privacy Policy explains, in plain language and with reference to the specific laws that apply, what personal data we collect, why and on what legal basis we process it, who we share it with, how long we keep it, where it is processed, and the rights available to you — including your rights under India's Digital Personal Data Protection Act, 2023 and, where applicable, under the EU General Data Protection Regulation (GDPR).

This document is written to be read by both our clients in India and our clients and astrologers in the EU/EEA. Some sections apply only to one group; each such section says so at the start.

1. Who we are — Data Fiduciary / Data Controller

Sphuṭa is the entity that determines the purposes and means of processing personal data on this platform. Under India's Digital Personal Data Protection Act, 2023 ("DPDPA") this makes us a "Data Fiduciary". Under the GDPR this makes us a "Data Controller" for the personal data of clients and astrologers who use the platform. This section, together with Sections 5, 8, 9, 10, 12, 13 and 17, is intended to satisfy the transparency and notice obligations under Articles 13 and 14 GDPR and Section 5 of the DPDPA.

Legal entity and registered office:

[Insert registered legal entity name, entity type, company/LLP registration (CIN/LLPIN) number, and registered office address in India]

EU representative (Article 27 GDPR):

Sphuṭa does not currently have an establishment in the EU/EEA. Where a controller outside the EU offers services to, or monitors the behaviour of, individuals in the EU, Article 27 GDPR requires that controller to designate a representative in the EU, unless the processing is occasional, does not include large-scale special category data, and is unlikely to result in a risk to individuals. Because the platform processes birth and consultation data (which we treat as special category data — see Section 4) of individuals in the EU, and does so as an ongoing rather than occasional activity, we consider that an Article 27 representative is likely required. [To be confirmed with counsel and, if required, appointed — insert EU representative's name, postal address, and contact details once appointed.]

Astrologers who offer consultations through Sphuṭa are independent professionals — not Sphuṭa employees or agents. The way responsibility for your data is divided between Sphuṭa and the astrologer you book is explained in Section 7.

2. Definitions

  • "Personal Data" / "Personal Information": any data about an individual who is identifiable by or in relation to that data.
  • "Sensitive Personal Data" (India) / "Special Category Data" (Article 9 GDPR): data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation — categories that require heightened protection under both Indian and EU law.
  • "Data Principal" (India) / "Data Subject" (EU): the individual to whom the personal data relates — that is, you, whether you are a client or an astrologer.
  • "Data Fiduciary" (India) / "Data Controller" (EU): the entity that decides why and how personal data is processed — here, Sphuṭa (and, for their own purposes, the astrologer — see Section 7).
  • "Data Processor" (India) / "Processor" (EU): a party that processes personal data on behalf of, and under the documented instructions of, a Data Fiduciary/Controller (for example, our hosting provider).
  • "Processing": any operation performed on personal data — including collection, recording, storage, use, disclosure, transfer, and deletion.
  • "Consent Manager" (India): a DPDPA-registered entity through which a Data Principal may give, manage, review, and withdraw consent. Sphuṭa does not currently route consent through a registered Consent Manager; consent is collected directly (see Section 5).

3. Personal data we collect

When you book a consultation as a client, we collect and store in our database the information you provide on the booking form:

  • Identity and contact data: your name, email address, and (optionally) phone number.
  • Birth data: your gender, date of birth, birth time (or a flag indicating the time is unknown, plus any approximate time you give), and birth place as free text.
  • Location data: your current place of residence, and the geographic coordinates (latitude/longitude) and timezone associated with your birth place and residence.
  • Consultation content: the topic/purpose you would like guidance on, any free-text notes or context you choose to share, and any "life events" you optionally add (each with a heading, description, and start/end year and month) to help the astrologer prepare.
  • Booking preferences: your preferred consultation mode (phone, video, or in person), date, and time slot, and the price of the consultation.
  • Consent records: your affirmative confirmation that you have read this policy and agree to your details being shared with the astrologer you book, together with the time this consent was recorded.

The birth data, location data, and consultation content described above (especially the free-text "notes" and "life events" fields) are given special treatment as sensitive / special category data — see Section 4.

When an astrologer registers and sets up a practice on Sphuṭa, we collect:

  • Identity and contact data: full name, email address, phone number, and city.
  • Account credentials: managed by our authentication provider (see below); we do not store passwords in plain text.
  • Practice profile: practice name, tagline, biography, specialties, languages, and years of experience.
  • A profile photo, if uploaded.
  • Service configuration: booking availability, consultation types, and pricing.
  • Links to the astrologer's own website or social profiles, if provided.

Please note that an astrologer's public-facing profile information — such as name, practice name, photo, biography, specialties, languages, and city — is published on the astrologer's public booking and discovery pages by design, so that clients can find and choose an astrologer. Astrologers should not include information in these fields that they do not wish to make public.

Authentication and technical data. To create and secure accounts we use Supabase Auth (with the PKCE flow) and, at the user's choice, Google sign-in (OAuth). Through this process we or our providers handle account identifiers, sign-in metadata, and, where you choose Google sign-in, the basic profile/email information Google returns to complete the sign-in. We do not currently operate Apple sign-in. We also process the limited technical data inherent in operating any web service (such as IP address and request metadata handled transiently by our hosting and email providers to deliver the service and keep it secure).

Payments. We do not currently collect, store, or transmit any payment-card or bank-account details. A payment button exists on the platform but is not yet connected to a payment processor. When payment processing is enabled, it will be handled directly by a licensed payment gateway under its own RBI / PCI-DSS obligations, and this policy will be updated before any payment data is collected.

4. Special category / sensitive personal data — the astrology question

This is the most important and most carefully considered part of this policy, and we want to be transparent about our reasoning. Raw birth details — a date, a time, and a place of birth — are, on their own, ordinary personal data. What makes them sensitive here is the context in which they are given: you provide them specifically in order to obtain a Vedic astrological consultation.

Article 9(1) GDPR prohibits (absent a specific exception) the processing of data "revealing … religious or philosophical beliefs". European regulators and the Court of Justice of the EU interpret the word "revealing" broadly, so that data can be special category not only when it states a belief directly but also when a belief or characteristic can be inferred from it. A reasonable view is that a person who submits their birth details to receive a Vedic astrological reading may thereby reveal a philosophical or belief-related interest in astrology. In addition, the free-text "notes" and optional "life events" fields are open-ended and can contain genuinely sensitive information in their own right — for example, references to health, relationships, sexual life, family or fertility matters, religious practice, or legal difficulties.

Our position (flagged for confirmation with counsel): rather than rely on the argument that raw birth data is not, by itself, special category data, we take the cautious and protective approach and treat all client birth data, location data, and consultation content — and in particular the notes and life-events fields — as special category data under Article 9 GDPR and as sensitive personal data under India's IT Act framework and the DPDPA. Practically, this means (a) we process this data only on the basis of your explicit, affirmative, opt-in consent, obtained via the consent checkbox on the booking form (Article 9(2)(a) GDPR; consent under the DPDPA), before it is shared with any astrologer; (b) we do not use it for any purpose other than arranging and delivering the consultation you booked; and (c) we do not use it for advertising, profiling, or model training.

Because the "notes" and "life events" fields are free text, we cannot control in advance what you type into them. Please share only what is relevant to your consultation, and avoid entering information about other identifiable people, or highly sensitive details you would prefer not to record, unless it is necessary for your reading. You can ask us to delete these fields at any time (see Sections 10 and 12).

5. Purpose and legal basis for processing

Under Indian law (DPDPA, 2023):

For clients, we process your personal data on the basis of the consent you give at the time of booking, and as necessary to provide the consultation service you have requested. Consent under the DPDPA is free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action, and you may withdraw it at any time (see Section 12). Where the DPDPA permits processing for "certain legitimate uses", we may also rely on those grounds where applicable. We currently collect consent directly on the booking form rather than through a registered Consent Manager.

Under the GDPR (for individuals in the EU/EEA):

  • Performance of a contract (Article 6(1)(b)) — to create your booking and enable the astrologer to deliver the consultation you have requested.
  • Explicit consent (Article 6(1)(a) and, for the special category birth and consultation data described in Section 4, Article 9(2)(a)) — obtained via the explicit consent checkbox on the booking form before your details are shared with an astrologer. This is our primary and required basis for the sensitive elements of the booking.
  • Legitimate interests (Article 6(1)(f)) — for the limited purposes of keeping the platform secure, preventing fraud and abuse, and maintaining and improving the reliability of the service. We have considered whether these interests are overridden by your rights and freedoms and have limited this basis to operational security and integrity; we do not rely on it for the sensitive elements of your booking. You may object to processing based on legitimate interests (see Section 13).
  • Legal obligation (Article 6(1)(c)) — where we must retain records to comply with tax, accounting, or other legal obligations.

Provision of the core booking information (name, email, birth details, and topic) is necessary to enter into and perform the consultation booking; if you do not provide it, we cannot arrange your consultation. Provision of optional fields (phone number, notes, life events) is not required and is entirely at your discretion.

6. How we use your information

We use the information described above to: create and manage your booking; enable the astrologer you chose to prepare for and conduct your consultation; send you a booking-confirmation email and, for astrologers, account and go-live emails; operate, secure, and troubleshoot the platform; and comply with our legal obligations. We do not use your personal or birth details for advertising, behavioural profiling, automated decision-making (see Section 16), or for training any machine-learning or artificial-intelligence model.

7. The role of astrologers — who is responsible for your data

Sphuṭa and the astrologers on the platform are separate, independent professionals, and it is important to understand how responsibility for your data is divided. When you book, Sphuṭa is the Data Fiduciary / Controller that collects, stores, and transmits your booking on the platform, and decides how the platform handles it. The astrologer you book does not process your data on Sphuṭa's behalf or under Sphuṭa's instructions — the astrologer uses your details for their own professional purpose: preparing and delivering their own consultation, within their own client relationship with you.

For that reason, the astrologer is best characterised not as our "processor" (Article 28 GDPR) but as an independent (separate) Data Controller — and, under the DPDPA, as a Data Fiduciary in their own right — in respect of the data once it is provided to them for the consultation. Each of Sphuṭa and the astrologer is responsible for its own compliance with data-protection law for the processing it carries out. Depending on the facts, aspects of the collection-and-transmission stage could also be viewed as joint controllership; this characterisation is flagged for confirmation with counsel.

Because astrologers act as independent controllers, we put (or are putting) in place written terms with astrologers on the platform requiring them, at a minimum, to: use client data solely to prepare for and deliver the booked consultation; keep it confidential and secure; not disclose or re-use it for unrelated purposes, marketing, or model training; honour data-subject / data-principal rights and cooperate on any request or complaint; and delete or return data when it is no longer needed. [Flag for counsel: finalise and execute a controller-to-controller data-sharing arrangement and confidentiality terms with all astrologers.] If you wish to exercise your rights specifically in relation to what an astrologer holds after your consultation, you can contact us and we will help route your request to the relevant astrologer.

8. Who we share it with — recipients and sub-processors

We share your booking and birth details with the specific astrologer you book — only for that consultation, and only after you have given your explicit consent on the booking form (see Sections 4 and 7). Beyond that, we rely on a small number of service providers that process personal data on our behalf, as processors under our instructions, strictly to operate the platform:

  • Supabase — hosts our database, authentication, and file storage (including the profile photos astrologers upload).
  • Google (Gmail / SMTP) — used, via nodemailer, to send transactional emails such as booking confirmations and account emails; the recipient's name, email address, and booking details necessarily pass through this email delivery.
  • Geoapify — used to look up city / location suggestions when you type a place name. Only the place-name text you type is sent to Geoapify to return matching suggestions with coordinates and timezone; your name, birth details, and other booking data are never sent to Geoapify.
  • Google (OAuth) — where you choose to sign in with Google, Google processes the sign-in and returns basic profile/email information to complete authentication.

We do not sell your personal information to anyone, ever. We do not share it with advertisers, data brokers, or social-media platforms for their own purposes, and we do not disclose it to any party other than as described in this policy or as required by law (for example, a valid legal or regulatory demand).

9. International data transfers

Some of our service providers may process or store data on infrastructure located outside your home country. Under the DPDPA (Section 16), the Central Government may restrict transfers of personal data to certain notified countries or territories; we will comply with any such restrictions once in force, in addition to any sector-specific rules that apply to us.

Where personal data of individuals in the EU/EEA is transferred to a country outside the EU/EEA that has not received an adequacy decision, we rely on an appropriate transfer mechanism under Chapter V GDPR (Articles 44–49) — typically the European Commission's Standard Contractual Clauses, together with any supplementary measures indicated by a transfer impact assessment. [To confirm with counsel: the specific hosting/processing region(s) used by each of our providers (Supabase, Google/Gmail, Geoapify), the applicable adequacy decisions or Standard Contractual Clauses in place, and whether a transfer impact assessment and supplementary measures are required.]

10. Data retention

We keep personal data only for as long as necessary for the purposes described in this policy, or for as long as required by law, whichever is longer, and then delete or irreversibly anonymise it. The default periods below are our current proposals; each is flagged for confirmation with counsel and may be adjusted to reflect final legal advice and operational needs:

  • Booking records, including birth data, location data, and consultation content (notes and life events): retained for the duration of the consultation and, by default, for up to 12 months afterwards to handle follow-ups, queries, and disputes — then deleted or anonymised, unless you ask us to delete it sooner (which we will do, subject to any overriding legal-retention need).
  • Notes and life-events fields specifically: because these are the most sensitive free-text fields, we will delete them on request at any time, and in any event no later than the booking-record period above.
  • Consent records: retained for the duration of processing and for a limitation period afterwards (proposed: up to 3 years from withdrawal or last processing) so we can demonstrate that valid consent was obtained, as required under Article 7(1) GDPR and the DPDPA.
  • Astrologer account and profile data: retained for the life of the account and, after account closure, for a short wind-down period (proposed: up to 90 days) before deletion, excluding data we must keep for legal reasons.
  • Financial, tax, and accounting records (once payments are enabled): retained for the period required by Indian law (proposed: up to 8 years, to align with the Companies Act, 2013 and income-tax record-keeping requirements).
  • Email delivery logs and security/operational logs: retained for a limited period for security and troubleshooting (proposed: up to 12 months).
  • Backups: personal data persisting in routine backups is overwritten on our providers' standard backup cycle (proposed target: within 90 days) after deletion from the live system.

[Flag for counsel: confirm each retention period above against final tax, accounting, and sector-specific requirements applicable to the entity.]

11. Data security and breach notification

We apply reasonable technical and organisational security safeguards appropriate to the sensitivity of the data we hold — consistent with the "reasonable security practices and procedures" expected under India's Information Technology Act, 2000 and the SPDI Rules, 2011, the security obligations of the DPDPA, and Article 32 GDPR. These include access controls, use of a reputable managed infrastructure provider, encryption in transit, and limiting access to personal data to those who need it. No system can be guaranteed perfectly secure. In the event of a personal data breach that is likely to result in a risk to affected individuals, we will notify the affected individuals and the competent authority as required by applicable law — including, under the GDPR, notification to the relevant supervisory authority (generally within 72 hours where feasible under Article 33) and to affected individuals where the risk is high (Article 34); and, under the Indian framework, to the Data Protection Board of India and affected Data Principals as required.

12. Your rights — India (DPDPA, 2023)

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the right to:

  • Access — obtain a summary of the personal data we process about you and of our processing activities, and the identities of other Data Fiduciaries and Processors with whom we have shared it.
  • Correction and completion — have inaccurate or misleading data corrected, and incomplete data completed and updated.
  • Erasure — have your personal data erased where it is no longer necessary for the purpose for which it was processed, subject to our legal-retention obligations.
  • Withdraw consent — withdraw your consent at any time, as easily as you gave it; withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may mean we can no longer provide certain services.
  • Grievance redressal — readily register a grievance with our Grievance Officer (Section 17) regarding any act or omission in our processing.
  • Nominate — nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.
  • Escalate — if your grievance is not satisfactorily resolved, make a complaint to the Data Protection Board of India.

13. Your rights — EU / EEA (GDPR)

If you are located in the EU or EEA, you have the following rights as a Data Subject under the GDPR:

  • Right of access to your personal data and to the information in this notice (Article 15).
  • Right to rectification of inaccurate or incomplete data (Article 16).
  • Right to erasure — the "right to be forgotten" (Article 17).
  • Right to restriction of processing in certain circumstances (Article 18).
  • Right to data portability — to receive data you provided in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible (Article 20).
  • Right to object to processing based on our legitimate interests (Article 21).
  • Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Article 7(3)).
  • Rights in relation to automated decision-making and profiling (Article 22) — noting that we do not carry out such processing (see Section 16).
  • Right to lodge a complaint with a supervisory authority (Article 77) — you may complain to the authority in your country of residence or place of the alleged infringement. For the German context, this is the competent Landesdatenschutzbehörde for the relevant federal state (for an astrologer established in Baden-Württemberg, the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg).

To exercise any of these rights, contact us using the details in Sections 17 and 20. We will respond within the timeframes required by law (generally one month under Article 12(3) GDPR, extendable for complex requests). We may need to verify your identity before acting on a request. Exercising your rights is free of charge, except where a request is manifestly unfounded or excessive.

14. Children's privacy

Sphuṭa is intended for adults and is not directed at children. We do not knowingly allow anyone under 18 to create an astrologer account. Under the DPDPA, processing the personal data of a child (a person under 18 in India) generally requires verifiable consent from a parent or lawful guardian, and behavioural monitoring or targeted advertising directed at children is not permitted; under the GDPR, additional protections apply to children. If you book a consultation that involves a minor's birth details (for example, your child's birth chart), you confirm that you are that child's parent or legal guardian and that you consent, on the child's behalf, to the processing of their birth data for the consultation. If you believe a child's data has been provided to us without appropriate authorisation, please contact us (Section 20) and we will delete it promptly.

15. Cookies and tracking

Sphuṭa does not currently use tracking cookies, third-party analytics, advertising pixels, or similar tracking technologies. The only third-party network connection made by our public pages is a preconnect to Google Fonts to load typography. We may use strictly necessary, first-party mechanisms required to keep you signed in and to operate core features. If we introduce analytics or non-essential cookies in future, we will update this policy and, where the law requires (including under the EU ePrivacy rules), request your prior consent through a cookie banner before any non-essential cookie is set.

16. Automated decision-making and profiling

We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you (within the meaning of Article 22 GDPR). The astrological reading itself is carried out by a human astrologer, not by an automated system, and any matching between you and an astrologer results from your own choice on the platform rather than from automated evaluation of your personal data.

17. Grievance Officer / Data Protection contact

In accordance with the Information Technology Act, 2000 and the SPDI Rules, 2011, and the Digital Personal Data Protection Act, 2023, we have designated a Grievance Officer to receive and address complaints and requests relating to the processing of your personal data. [Flag for counsel: assess whether the entity qualifies as a Significant Data Fiduciary under the DPDPA and whether appointment of a Data Protection Officer based in India is separately required.]

[Insert Grievance Officer's name and designation]

[Insert Grievance Officer's dedicated email address and postal address]

We aim to acknowledge grievances promptly and to resolve them within the timeline required by applicable law. If you are in the EU/EEA, you may also contact us at the address in Section 20 for GDPR requests, and — until an Article 27 representative is appointed — direct EU-specific queries to the same contact.

18. Changes to this policy

We may update this policy from time to time as the platform evolves (for example, when payments are enabled) or as legal requirements change. We will revise the "last updated" date above whenever we do, and where the changes are material we will take reasonable steps to notify you — for example, by a notice on the platform or by email — before the changes take effect, where required.

19. Governing law

This policy and our processing of personal data collected in India are governed by the laws of India, and the courts at [Insert city/jurisdiction of the registered office] shall have jurisdiction, subject to any mandatory consumer-protection rules. Where the GDPR applies to your personal data because you are in the EU/EEA, the rights and protections in Sections 4, 9, 11, and 13 apply in addition to, and do not limit, your rights under Indian law, and nothing in this policy deprives you of the protection of mandatory provisions of the law of your country of residence.

20. Contact us

If you have any questions about this policy, or wish to exercise your rights, contact us at privacy@sphuta.com.