Astrique

Privacy Policy

Last updated: 2026-10-01 · Version: 2.3

1. Controller

The controller responsible for data processing on this website under the General Data Protection Regulation (GDPR) is:

Dominik Bullo
Düsternstr. 24
20355 Hamburg
Germany
Email: info@humandesign-rechner.de

2. Overview

We only process the data needed for each purpose. We do not use tracking or marketing cookies, we do not use analytics tools and we do not show ads. We do not sell data.

3. Visiting the website (hosting)

This website is hosted by Vercel Inc. (USA). The servers that render our pages are located in Frankfurt am Main; pages are delivered through Vercel's global network.

On every page request, Vercel processes technically necessary data, in particular your IP address, the time, the requested address and information about your browser and device (user agent). Without this data the page cannot be delivered or protected against attacks. We only use these logs for troubleshooting and to prevent abuse, and we do not combine them with other data.

To keep the calculator and the contact form from being overwhelmed or abused by automated mass requests, we count how often they are used from an IP address. For this we only keep a hash of the IP address briefly in memory; it is not stored.

The legal basis is our legitimate interest in a secure and working service (Art. 6(1)(f) GDPR).

4. User account

You can create an account with an email address and password or with your Google account.

  • Email and password: We store your email address and your password, the password only as a non-reversible hash. To confirm your email address we send you an email through Supabase's email service.
  • Sign in with Google: Google sends us your email address, your name, the address of your profile picture and an identifier of your Google account. Google itself is responsible for the sign-in process on its side; for users in the EU this is Google Ireland Limited.
  • Profile: You can optionally enter a display name. We also store your preferred language and when your account was created and last changed.

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

5. Birth data and chart calculation

To calculate a Human Design chart we need the date, time and place of birth. We convert the place of birth into coordinates and a time zone. For this, our server sends only the place name you entered to the Photon service of komoot GmbH (Germany), not your IP address and no other information.

Calculator without an account: What you enter goes to our server, which calculates the chart and sends the result back to your browser. We do not store what you entered, neither in a database nor in cookies or logs. The legal basis is carrying out the calculation you requested (Art. 6(1)(b) GDPR). If you calculate another person's chart, we process their birth data on the basis of our legitimate interest in delivering the calculation you requested (Art. 6(1)(f) GDPR); we do not store this data either.

In your account: If you save birth data in your profile, we store the date, time and place of birth encrypted (AES-256-GCM). Encryption happens on our server before the data is written to the database; the key is kept separately from the database. We store the coordinates and time zone of the place of birth and the calculated chart unencrypted because we need them for calculation and display. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

6. Contact form and e-mail

If you write to us using the contact form, we process your e-mail address, your message and, if given, your name in order to reply to you. The form sends the message as an e-mail to our mailbox; your browser only receives a confirmation. The same applies to e-mails you send us. The legal basis is Art. 6(1)(b) GDPR where your request concerns our service, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

Our mailboxes and the sending are provided by ALL-INKL.COM – Neue Medien Münnich (Germany), which processes the messages on our behalf (Art. 28 GDPR).

7. Cookies and local storage

We only store cookies and entries in your browser's local storage that are strictly necessary for running the site (§ 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act). They do not require consent.

  • sb-* (Supabase): keeps you signed in. Only set when you sign in and deleted when you sign out, otherwise after 400 days at the latest.
  • NEXT_LOCALE (next-intl): remembers the language you chose. Deleted when you close your browser.
  • astrique-cookie-notice-ack (local storage, not a cookie): remembers that you have seen the cookie notice. Kept until you clear the site data in your browser.

8. Recipients

  • Vercel Inc. (USA): hosting of the website, see section 3. Vercel processes the data on our behalf (Art. 28 GDPR).
  • Supabase Inc. (USA): database, sign-in service and sending of account emails. The data is stored in Frankfurt am Main (region eu-central-1). Supabase processes it on our behalf (Art. 28 GDPR).
  • komoot GmbH (Germany): place search with Photon; receives only the place name you entered.
  • ALL-INKL.COM – Neue Medien Münnich (Germany): mailboxes and sending of the contact form, see section 6.
  • Google Ireland Limited (Ireland): only if you sign in with Google, see section 4.

9. Transfers to third countries

Vercel and Supabase are based in the USA. Vercel is certified under the EU-U.S. Data Privacy Framework; transfers to Vercel are based on the European Commission's adequacy decision for it (Art. 45 GDPR). With Supabase, the European Commission's Standard Contractual Clauses apply (Art. 46(2)(c) GDPR). If you sign in with Google, data may also go to Google LLC in the USA, which is also certified under the Data Privacy Framework.

10. Retention

  • Calculator input without an account: not stored.
  • Account, birth data and charts: as long as your account exists. If you delete your account in your profile, we delete this data from the database immediately and permanently. Any backups at the database provider are overwritten according to its retention periods.
  • Logs of page requests: available to us only briefly, currently for one day at most.
  • Contact form messages and emails to us: until your request has been handled, unless statutory retention obligations require longer.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can do much of this directly in your profile: view and change your data, export it as a file and delete your account. For anything else, an email to info@humandesign-rechner.de is enough.

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information.

12. Obligation to provide data and automated decisions

You are not obliged to give us any data. Without an email address, however, we cannot create an account, and without birth data we cannot calculate a chart. We do not make automated decisions that have legal effects on you or similarly significantly affect you (Art. 22 GDPR).

13. Security

All connections to this website are encrypted (HTTPS). In the database, each account can only access its own data; birth data is additionally encrypted (see section 5).

14. Changes

We update this policy when our service or the law changes. The version published here applies, with the date stated above.