Privacy Policy

Last updated: 5 October 2026

1. Who we are

Ostrol (ostrol.ai) is operated by Wenlarge LLC, a Wyoming (USA) limited liability company, registered address 30 N Gould St Ste N, Sheridan, WY 82801, United States. For anything in this policy, contact admin@wenlarge.com. Wenlarge LLC is the data controller for the personal data described below.

2. What we collect

Account data — your name, email address and a hashed password; or, if you sign in with Google or Microsoft, the account identifier and email those providers share with us. We never see your Google/Microsoft password.

Birth data — the birth date, time and place (including coordinates) you choose to provide. This is the input for every astrological computation Ostrol performs; without it the service cannot generate your chart. You provide it voluntarily and can delete it at any time by deleting your account.

Preferences — your interface language and your device's current timezone (used to deliver readings in your local morning).

Subscription data — if you subscribe on the web, our payment provider Stripe processes your payment details. If you subscribe inside the mobile app, Apple or Google processes the payment and only tells us that an entitlement is active. Either way we store only subscription status and period metadata — never card numbers.

Technical data — IP address and basic request metadata in short-lived server logs, used for security, abuse prevention and rate limiting.

3. What we use it for (and the legal bases)

• Computing your natal chart and generating personalized readings, alerts and emails — performance of our contract with you (GDPR Art. 6(1)(b)).
• Processing subscription payments — contract and legal obligations (Art. 6(1)(b), (c)).
• Securing the service (rate limiting, abuse and fraud prevention) — legitimate interests (Art. 6(1)(f)).
• Service emails (your readings, password resets) — contract. We do not send marketing email without a separate opt-in.

Birth data and astrological content are not treated as a special category of data under GDPR Art. 9; we nevertheless handle them as sensitive by design and never sell or rent personal data.

4. AI processing

Readings are generated by large language models. To do this we send astrological data — chart positions, transit aspects, your content language — to our AI providers (Google Gemini; xAI as fallback). We do not send your name, email or account identifiers with these requests. These providers may process data in the United States; transfers rely on the providers' EU transfer safeguards (standard contractual clauses). AI output is generated content for reflection and entertainment — see the Terms for the full disclaimer.

5. Who else processes data for us

• Netcup GmbH (Germany) — server hosting; our application database is hosted in the EU.
• Stripe — subscription payments on the web.
• Apple and Google — subscription payments inside the mobile apps.
• Mailgun — transactional email delivery.
• Google / Microsoft — only if you use their sign-in.
• Google (Gemini) and xAI — AI text generation as described above.
• Google (AdSense and AdMob) — advertising for free accounts, as described below.

To be precise about where this happens: the application database that holds your account, birth data and readings is hosted in the European Union, while the AI, payment, analytics and advertising providers listed above process data in the United States. See International transfers below for the safeguards that cover this.

6. Advertising

Free accounts see ads: Google AdSense on the website and Google AdMob in the Android app. Premium subscribers never see ads, and there is no advertising anywhere in the iOS app.

Ads are personalised only with your consent, given through the same cookie and consent banner described below. If you decline — or until you choose — Google serves non-personalised ads, which still use limited data such as coarse location and the content of the page for frequency capping and fraud prevention. You can change your choice at any time from the banner. How Google uses data from its advertising partners is explained at policies.google.com/technologies/ads.

7. Cookies

Ostrol uses strictly necessary cookies: an httpOnly session cookie that keeps you signed in on the web, and a companion flag that lets the app know a session exists.

We also use Google Analytics 4 to understand how the site is used. Its cookies (named _ga and _gid) are set only after you accept the consent banner shown in the app; until then — or if you decline — Google Analytics runs without cookies and without a persistent identifier. Accepting lets it give your browser a random identifier and record which pages you visit; that data is processed by Google. We do not use it to advertise to you. You can change your mind by clearing the site's browser storage, opt out with Google's browser add-on at tools.google.com/dlpage/gaoptout, or block cookies entirely — Ostrol works fully either way. The same consent choice governs the advertising cookies described in the Advertising section above.

8. International transfers

We are a United States company, and as set out above your personal data is processed in both regions: the application database sits in the European Union, and our AI, payment, analytics and advertising providers process data in the United States. Where data about users in the EU/EEA, the United Kingdom or Switzerland is transferred to the United States, the transfer relies on the European Commission's Standard Contractual Clauses (and the UK addendum where applicable), together with the technical and organisational measures described under Security below.

9. Retention and deletion

Your data is kept while your account exists. Deleting your account (Profile → Edit → Delete account) immediately anonymizes your identity in our systems and permanently purges your birth data, charts, readings and notifications across our services; active sessions are revoked. Server logs, including IP addresses, are retained for 30 days and then deleted. Nightly database backups are overwritten on a rolling basis. Invoicing records that the law requires us to keep (e.g. Stripe records) are retained for the statutory period.

10. Your rights

Under the GDPR (and equivalent laws such as Turkey's KVKK) you can request access, correction, deletion, restriction, portability, or object to processing. Most of these you can exercise directly in the app; for anything else email admin@wenlarge.com. You may also lodge a complaint with your local supervisory authority.

California residents: under the CCPA/CPRA you have the right to know what personal information we collect and why, to request its deletion or correction, and not to be discriminated against for exercising those rights; we never sell your personal information for money, and you can opt out of the personalised advertising that may count as "sharing" under the CCPA at any time from the consent banner. The same email address handles these requests.

11. Security

All traffic is encrypted in transit (TLS). Passwords are stored only as bcrypt hashes. Session credentials live in httpOnly cookies on the web and secure storage on mobile. Internal services are not reachable from the internet.

12. Children

Ostrol is not directed at children and requires users to be at least 16 years old.

13. Changes

We will post any changes to this policy here and update the date at the top; material changes will be announced in the product.