Your data
Privacy policy
Last updated: 12 October 2026
Protecting your personal data is essential to Orbelune. This policy explains what data we collect, why, on what legal basis, how long we keep it, who we share it with and how to exercise your rights, in accordance with Regulation (EU) 2016/679 (“GDPR”) and French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, as amended (“Informatique et Libertés”).
1. Data controller
The data controller is Yoel Khalifa EI (trading name: Orbelune), a sole trader under French law (entrepreneur individuel (micro-entreprise)), whose business address is Apt B-304, chemin du Bois de Saget, 31240 Saint-Jean, France, registered with the Registre national des entreprises (RNE), SIRET number 131 065 120 00019.
For any question about your data or to exercise your rights, please contact our data protection officer: confidentialite@orbelune-astro.com.
2. Data collected
2.1 Account data
Email address and first name, needed to create and manage your account and to send you your content.
2.2 Birth data
Date of birth (required) and, optionally, time and place of birth. We regard this information as personal data in its own right and protect it accordingly. It is used solely to calculate your birth chart (sun sign, rising sign, planetary positions). It is never sent to our artificial intelligence provider: only the results of the calculation (signs, houses and aspects of the planets in your chart) are shared with it to write your personal content, without your name, your email or your birth data.
2.3 Preferences
Plan chosen, delivery channels (email, notification, SMS), preferred delivery time, interests and display settings.
2.4 Telephone number
Collected only if you choose to receive your content by SMS (Sun plan), and used exclusively for that purpose.
2.5 Payment data
Payments are processed by Stripe. Orbelune never stores your bank card numbers; we keep only the technical identifiers provided by Stripe, the status of your subscription and the link to your invoices. Card details (including the last four digits shown in the payment area) remain with Stripe.
2.6 Delivery history
Content sent, date, channel used and delivery status, in order to provide the service, let you find your horoscopes in your member area and detect delivery failures.
2.7 Newsletter and communications
Your consent to receive our newsletter is obtained explicitly and separately from your subscription to the service (box not pre-ticked), then confirmed by a validation email (double opt-in). We keep a record of the date and manner in which this consent was obtained.
2.8 Web notifications
If you turn on notifications, we record the technical subscription address (“endpoint”) and the encryption keys provided by your browser, which are needed to send the notifications.
2.9 Contact messages
Name or first name, email address and content of the messages you send us via the contact form or by email.
2.10 Questions for Orbelune
If your plan includes them, the text of the questions you ask and of the answers written, so that we can display them in your member area and take your previous exchanges into account. The text of the question and of your last three exchanges is sent to our artificial intelligence provider to write the answer: please avoid including any information that could identify you or a third party.
2.11 Technical data
Technical logs (IP address, date and time, pages requested, browser type, errors) needed for the security and proper functioning of the Service, as well as the cookies described in our cookie policy.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing the account, calculating the chart, generating and sending content, member area | Performance of the contract (Art. 6(1)(b) GDPR) |
| Managing the subscription, payments, the free trial and referrals | Performance of the contract |
| Sending content by SMS | Consent (Art. 6(1)(a)) and performance of the contract |
| Newsletter and marketing communications to prospective customers | Consent |
| Anonymous, cookie-free audience measurement | Legitimate interest (Art. 6(1)(f)), with a right to object |
| Emails to existing customers about similar services (for example an offer to return after cancellation), with the option to object with each email | Legitimate interest (Art. 6(1)(f)) and Article L34-5 of the French Postal and Electronic Communications Code |
| Security of the Service, prevention of fraud and abuse (including the single free trial) | Legitimate interest |
| Handling contact requests and complaints | Legitimate interest or performance of the contract |
| Invoicing, accounting, responding to requests from the authorities | Legal obligation (Art. 6(1)(c)) |
Orbelune carries out no automated decision-making and no profiling that produces legal effects concerning you or similarly significantly affects you. The personalisation of horoscopes is based solely on your sign and your rising sign. We do not sell or rent out your data, nor do we use it for targeted advertising.
4. Retention periods
| Data | Period |
|---|---|
| Account data (profile, birth details, preferences, delivery history, personal horoscopes, questions and answers) | For as long as the account is active, then deleted within 30 days of the account being deleted |
| Inactive accounts | Deleted after 3 years of inactivity, following prior notice by email |
| Prospective customers and newsletter subscribers | 3 years from the last contact or the last interaction |
| Invoices and accounting records | 10 years (Article L123-22 of the French Commercial Code) |
| Technical logs | 12 months |
| Contact messages | 3 years from the last exchange |
| Cookies and consent choices | See the cookie policy (6 months for the consent choice) |
Some data may be kept for longer in intermediate archives, with restricted access, where this is necessary for the establishment, exercise or defence of legal claims, within the limits of the applicable limitation periods.
5. Recipients and processors
Your data is accessible only to authorised staff of Yoel Khalifa EI (trading name: Orbelune), within the limits of their duties, and to our processors, who act on our instructions and are bound by a contract that complies with Article 28 of the GDPR:
| Provider | Role | Location and safeguards |
|---|---|---|
| Supabase | Database and authentication | European Union (Frankfurt, Germany) |
| Vercel | Hosting of the Site | United States — EU-US Data Privacy Framework and standard contractual clauses |
| Stripe | Payment and invoicing | Ireland and United States — Data Privacy Framework and standard contractual clauses |
| Resend | Sending emails | United States — Data Privacy Framework and standard contractual clauses |
| Anthropic | Assisted writing of content (Claude API) | United States — standard contractual clauses. Receives the calculated positions of your chart and, for questions, their text; never your name, your email or your birth data. Data sent through the API is not used to train its models. |
| Twilio | Sending SMS messages (Sun plan) | United States — Data Privacy Framework and standard contractual clauses |
| Browser notification services (Google, Apple, Mozilla) | Delivery of web notifications | Depending on the browser used; the content of notifications is end-to-end encrypted |
Your data may also be disclosed to administrative or judicial authorities where required by law.
6. Transfers outside the European Union
Some of our providers are established in the United States. These transfers are covered by the European Commission’s adequacy decision on the EU-US Data Privacy Framework, for certified providers, and/or by the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures (in particular encryption). You can obtain a copy of these safeguards by writing to confidentialite@orbelune-astro.com.
7. Security
We implement appropriate technical and organisational measures to protect your data: encryption of communications (HTTPS), encryption of data at rest with our hosting providers, segregation of access through security rules at database level, secure authentication, access logging and the principle of data minimisation. In the event of a data breach likely to result in a high risk to your rights and freedoms, you will be informed under the conditions laid down by the GDPR.
8. Your rights
In accordance with the GDPR and the French “Informatique et Libertés” law, you have the following rights:
- Right of access: to obtain confirmation that your data is being processed and to receive a copy of it;
- Right to rectification: to correct inaccurate or incomplete data, directly from your “Profile” page;
- Right to erasure: to delete your account and your data, subject to legal retention obligations;
- Right to data portability: to receive your data in a structured, commonly used format;
- Right to object: to object to processing based on legitimate interest, and at any time to direct marketing;
- Right to restriction of processing in the cases provided for by law;
- Right to withdraw your consent at any time (newsletter, SMS), without affecting the lawfulness of processing carried out before its withdrawal;
- Right to set instructions regarding what happens to your data after your death.
Exercising your rights yourself
From your member area, on the “Profile” page, you can at any time export all your data in JSON format and permanently delete your account. Every marketing email and SMS includes a link or instructions to unsubscribe, and notifications can be turned off in your profile or in your browser settings.
Contacting us
You can also exercise your rights by writing to confidentialite@orbelune-astro.com or by post to Yoel Khalifa EI (trading name: Orbelune), Apt B-304, chemin du Bois de Saget, 31240 Saint-Jean, France. We respond within one month, which may be extended by two months depending on the complexity or number of requests. If we have reasonable doubts about your identity, we may ask you for proof of identity.
Complaints
If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.
You may also register free of charge on Bloctel, the French telephone marketing opt-out list (www.bloctel.gouv.fr).
9. Minors
The Service is reserved for persons aged at least 18. We do not knowingly collect data about minors. If you become aware that a minor has provided us with data, please contact us so that we can delete it.
10. Cookies
The use of cookies and trackers on the Site is described in detail in our cookie policy.
11. Changes to this policy
We may update this policy to reflect changes to our services or to the regulations. The date of the last update is shown at the top of the page. In the event of a material change, members are informed by email.