Privacy policy

This is an English translation for information. The German Datenschutzerklärung is the legally binding version.

1. Controller

Anonyfox e. K., owner: Maximilian Stroh, Zehntland 2d, 21079 Hamburg, Germany
Email: [email protected]

This policy covers sterne.cosmolytic.com, stars.cosmolytic.com and sterren.cosmolytic.com. No data protection officer has been appointed, as there is no legal obligation to do so.

2. Hosting (DigitalOcean, Frankfurt)

This website runs on a server of DigitalOcean, LLC, 105 Edgewater Place, New York, NY 10014, USA, in its Frankfurt am Main data centre (Germany). A data processing agreement under Art. 28 GDPR is in place. Access from the USA cannot be ruled out; transfers rely on the EU-US Data Privacy Framework or EU Standard Contractual Clauses. Legal basis: Art. 6(1)(f) GDPR (secure, efficient operation).

3. Cloudflare (CDN, security)

Requests pass through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare terminates the HTTPS connection, protects against attacks and forwards requests to our server, processing IP addresses, request data and technical metadata. Cloudflare is certified under the EU-US Data Privacy Framework; Standard Contractual Clauses and a data processing agreement also apply. Legal basis: Art. 6(1)(f) GDPR (security and availability).

4. Server log files

For every request our web server automatically stores: the visitor's IP address (passed on by Cloudflare), date and time, requested URL, HTTP status, amount of data transferred, referrer and user agent. Purpose: operation, troubleshooting and abuse prevention. Legal basis: Art. 6(1)(f) GDPR. Logs are deleted after 14 days at the latest unless needed to investigate a security incident.

To measure reach we use Cloudflare Web Analytics (provider as in section 3), without cookies. Legal basis: Art. 6(1)(f) GDPR.

5. Personal astrology reports

When you order a personal report (e.g. Your Year 2027, Venus retrograde, Birth Chart Roast), we process the birth data you enter at Stripe checkout (date of birth, optionally time and place of birth), the first name you want on the cover and your contact details from checkout. Purpose: creating and sending the PDF report you ordered. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Birth data is deleted after delivery, at the latest 30 days after delivery, unless tax or commercial retention duties apply to order and invoice data (these are kept for up to 10 years under § 147 AO / § 257 HGB). Birth data is never passed on to third parties for advertising.

6. Payments via Stripe Checkout

For purchases we use Stripe Checkout by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Payment details are entered directly on Stripe's pages; we never receive full card or account numbers. Stripe processes name, email, billing address, payment data, IP address and device information for payment processing and fraud prevention and is partly an independent controller for this; transfers to Stripe, Inc. (USA) rely on the EU-US Data Privacy Framework or Standard Contractual Clauses. We receive order, contact and billing data from Stripe. Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (tax and commercial retention duties of up to 10 years under § 147 AO, § 257 HGB). Stripe's privacy notice: stripe.com/privacy.

7. Contact by email

If you write to us, we process your email address, the content and metadata to handle your request. Messages may be processed with automated or AI-assisted tools on behalf of the controller. Legal basis: Art. 6(1)(b) GDPR (contract-related requests) or Art. 6(1)(f) GDPR (other requests). Deletion once the request is settled and no retention duties apply.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), and the right to withdraw consent with effect for the future (Art. 7(3) GDPR). You may lodge a complaint with a supervisory authority, e.g. the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 20459 Hamburg, or the authority in your country of residence.

9. No automated decision-making

No automated decision-making, including profiling (Art. 22 GDPR), takes place.