Privacy Policy

At a Glance

This summary is provided for convenience and is not a substitute for the full policy below.

• Account-level data: your email address, used as your unique login identifier. We do not ask for your legal name when you sign up.
• Charts you create: you enter birth date, time, and place, along with a name or label of your choosing and optional biographical context. The name may be your own, someone else's, a public figure's, or anything fictional — we do not verify it and we do not attempt to attribute whose data a chart describes. The Service treats every chart as your private content.
• Other data: the chats and reports you create inside the product, your subscription and billing records, the consent choices you make, and standard technical data (device, browser, IP address, usage events).
• Why we collect it: to compute charts, generate AI-powered Vedic astrology insights, run subscriptions, prevent abuse, and improve the product. We do not sell your personal information.
• Where it lives: on AWS infrastructure in the United States, with payments handled by Stripe (Merchant of Record). Other sub-processors are listed below.
• What the Service is: a calculator and AI-based interpreter for values you enter. We do not verify them and cannot tell whose data a chart describes — creating multiple charts with varied inputs to study correlations is an ordinary use.
• Cookie and marketing consent: granular and revocable, managed via our cookie banner and account settings.
• Your control: from the Personal Data and Privacy button on your account page you can see everything we hold, category by category, export it, correct it, change your consent, and delete your account.

What We Don't Do

Important Notice for Existing Users

If you created your Lagna360 account before May 9, 2026, the version of this Privacy Policy in effect at the time of your signup governed our processing of your information until that date. From May 9, 2026 onward, your continued use of the Services is governed by this updated Privacy Policy, which provides additional clarity about what the Service does with the values you enter, the legal bases we rely on, and the controls available to you.

If you do not log in within 90 days of May 9, 2026, your continued use of the Services will be deemed to be governed by this updated Privacy Policy; we will not suspend or restrict your account on this basis. You may review what data we hold about you, change your settings, or delete your account at any time via app.lagna360.com.

Who We Are

This Privacy Policy is provided by Lagna360 Labs Inc., operating as Lagna360 from Ontario, Canada ("Company", "we", "us", or "our"). It explains how information about you is collected, used, and disclosed when you use and access our Vedic astrology web platform — the marketing site at lagna360.com (the "Site") and the signed-in account experience at app.lagna360.com — together with all related tools and services (collectively, the "Services"). Lagna360 is delivered as a web application; we do not publish a native desktop or mobile app.

Lagna360 Labs Inc.
100 King Street West, Suite 5700
Toronto, ON M5X 1C7, Canada

We may change this Privacy Policy from time to time. If we make material changes, we will notify you by revising the date at the top of the policy and, where appropriate, by additional notice (such as a banner on our homepage or an email notification). We encourage you to review the Privacy Policy whenever you access the Services to stay informed about our information practices.

The address above is our registered office, published to identify the legal controller of your personal data as required by privacy law. It is not a contact channel: letters posted there are not monitored or routed to our privacy team. See "How to Reach Us" below instead.

How to Reach Us

We keep this simple. The fastest and most secure way to exercise your rights — see what we hold, export it, correct it, change your consent, or delete your account — is the Personal Data and Privacy button on your account page, located directly below the Danger Zone (which contains the Delete Account control). Because you are already authenticated, we do not require additional identity verification; requests submitted from this page are typically processed within 24 hours.

From the Personal Data and Privacy page, you can:

• See the personal data we hold about you, broken down by category (account, birth data, charts, chat history, generated reports, events, marketing preferences);
• Read what each category is used for and which legal basis applies;
• Export your data in a structured, machine-readable format — JSON for chart and chat data, CSV for events;
• Correct account information and birth data;
• Withdraw cookie and marketing consent independently of your account.

Account deletion (which permanently removes all your personal data) is available from the Danger Zone immediately above the Personal Data and Privacy button.

These controls cover the requests most users need, but not every edge case or jurisdiction-specific right. For anything they do not handle — escalations, complaints, restriction or objection requests, requests on behalf of someone else (for example, a deceased user), or requests where you cannot access your account — see "Questions or Complaints" at the end of this policy. We may ask you to verify your identity for requests made outside your account, since we cannot rely on session authentication. We respond within the timeframes set out in the regional notices below — generally without undue delay and within 30 days, with a 45-day window for California requests.

Information We Collect

Account data. At the account level, we collect your email address, which serves as your unique identifier, along with account metadata: an internal account ID, sign-up and last-login timestamps, and which chart you have set as your default. We sign you in either via Google Sign-In or by sending a one-time code to your email; we do not collect or store passwords. When you sign in with Google, we discard the name and other profile fields Google returns and retain only your email and the Google subject identifier. When you contact support or send us an email, we receive whatever information you choose to include.

Chart data. Each chart you create holds the values you enter: a first and last name (or any label of your choosing), gender, birth date, birth time with its timezone offset, the city you typed, and the coordinates we resolved it to — plus, if you have rectified a chart, the original birth time alongside the corrected one. You may optionally add biographical context to a chart: your relationship to the person, profession, education, marital status, children, and dated life events, together with your answers to our zodiac calibration questions.

We do not verify these values, and we do not attempt to attribute whose data a chart describes — they may be your own, someone else's, a public figure's, or entirely fictional. The legal bases on which we process chart data are set out in the "Legal Bases for Processing" section below, along with an explanation of your role and ours. We use chart data solely to compute charts and generate the interpretations you request; we do not use it for any other purpose. Regardless of how it is classified, we protect it with encryption at rest and in transit, role-based access controls, and architectural separation between identifying data and analytics records.

Chats and reports. The questions you ask our AI features and the answers we return, and the PDF birth-chart and compatibility reports you generate.

Consent records. For each consent or attestation you give — including your region and your cookie and marketing choices — we record the timestamp, the IP address and IP-derived country we observed, your browser user-agent, and the version of the text you were shown. We keep these as the audit trail privacy law expects us to be able to produce for the data they authorize.

Subscription and billing data. Your plan, billing cycle dates, renewal and cancellation status, your Stripe customer reference, the amounts you have paid (amount, currency, date), short text records of significant billing events, and a ledger of every quota grant with its grant date, expiry, and how much you have consumed. Payment card details are collected and held by Stripe and never reach our systems.

Information we collect automatically. When you access or use the Services, we may automatically collect:

• Log information: how you interact with the Services, browser type and language, access times, pages viewed, time spent, your IP address, and the page you visited before navigating to the Services.
• Device information: hardware model, operating system and version, unique device identifiers, and mobile network information.
• Cookies and similar technologies: see the "Cookies and Tracking Technologies" section below for full detail.

Pseudonymous analytics events. A separate analytics database records product events — such as creating a chart or completing a purchase — against a one-way hash of your account ID rather than against your identity. Alongside each event we keep a few coarse attributes: for charts, the relationship type (for example "myself" or "spouse"), gender, and year of birth only, never the month or day; for your account, the country resolved from your IP address and whether you arrived from an ad click. See "Data Retention" below for how these records are treated after you delete your account.

How We Use Information

We use the information we collect to:

• Provide, maintain, analyze, test, and improve the Services and our technology;
• Deliver the Services you request — including chart computation, AI-generated interpretations, subscriptions, and one-time reports — and process related transactions, confirmations, and invoices;
• Send technical notices, updates, security alerts, and administrative messages;
• Respond to your comments, questions, and requests, and provide customer service;
• Where permitted, send you marketing communications about products, services, offers, and events (you can opt out at any time);
• Monitor and analyze usage, performance, and product activity;
• Detect, investigate, and prevent fraud, abuse, and other illegal activity;
• Personalize the Services and conduct research and development;
• Carry out the purposes for which the information was specifically collected.

Note on the use of Chart information. We treat the information contained in the charts you create using the Services ("Charts") as Confidential Information, with use limited in accordance with the confidentiality obligations set forth in our Terms of Service. Processing does not involve human access to your Charts unless (1) you provide your consent (for example, to enable customer support); or (2) we are required to do so by law. How charts are computed, and where artificial intelligence is and is not involved, is described in "Automated Processing and Artificial Intelligence" below.

Legal Bases for Processing

We process your personal data on a small number of well-established legal bases. The categories below describe what we rely on and when. Where applicable, we have noted the corresponding provisions of the UK and EU General Data Protection Regulations (GDPR) for users in those jurisdictions; users in California, India, Canada, and elsewhere have analogous rights and protections under their local privacy laws, described in the regional notices later in this policy.

General Bases

• Performance of a contract: to compute the Charts you ask us to compute from the values you enter, generate the interpretations you request, deliver subscriptions and one-time reports, and provide the Services you have requested. This is the basis on which we process chart inputs: you have asked us to run a calculation on data you supplied, and the Service cannot function without doing so. (Corresponds to Article 6(1)(b) GDPR for EU/UK users.)
• Legitimate interests: to send operational communications, secure our Services against fraud and abuse (including via bot prevention), measure advertising effectiveness on an aggregated basis, analyze usage patterns to improve the Services, and respond to your support correspondence. You may object to processing based on legitimate interests at any time. (Corresponds to Article 6(1)(f) GDPR for EU/UK users.)
• Compliance with legal obligations: to meet regulatory obligations such as financial recordkeeping and breach notification. (Corresponds to Article 6(1)(c) GDPR for EU/UK users.)
• Consent (cookies, advertising, marketing): we ask for this consent only for non-essential cookies, cross-context behavioral advertising, and marketing communications — nothing else. You may withdraw it at any time via our cookie banner or marketing settings, and doing so will not affect your access to the Service. We do not rely on consent to compute your charts — that is contract performance, described above. (Corresponds to Article 6(1)(a) GDPR for EU/UK users.)

Chart Inputs and Your Role

Lagna360 is a calculation and interpretation tool. You enter values — birth date, time, and place, a name or label, and any optional context you choose to add — and the Service computes a chart from them and generates an interpretation. It works the same way on any values it is given. We do not verify them, we do not check them against any outside source, and we have no way to determine whether a given chart describes you, another living person, a historical or public figure, or nothing real at all.

Students and practitioners of astrology routinely create many charts and vary the inputs deliberately in order to study correlations. That is an ordinary and intended use of the Service. Because of it, chart contents cannot be read as assertions of fact about any identifiable person.

Charts about other people. When you enter data describing someone other than yourself, you decide what to enter and why; we simply compute what you asked for. You are responsible for having an appropriate basis for entering that information, as set out in our Terms of Service. If a third party contacts us about a chart they believe describes them, we will act on it as described in "Questions or Complaints" below, though we may be unable to identify which chart is at issue.

Optional context fields. Bio and life-event fields are free-form, optional, and unverified. Please do not enter information about other people that they would not expect you to share, and note that anything you type into a free-text field is stored as you wrote it. You can clear these fields, delete the chart, or delete your account at any time.

Automated Processing and Artificial Intelligence

Our Services involve two distinct kinds of automated processing, and it is useful to distinguish them clearly:

Deterministic computation. Chart generation — including planetary positions, divisional charts, dasha periods, and all astronomical calculations — is performed by deterministic software (Swiss Ephemeris). The output is mathematically determined by the inputs you provide; the same inputs always produce the same output. This processing does not involve artificial intelligence and is not "automated decision-making" within the meaning of Article 22 of the UK GDPR or EU GDPR.

AI inference. Artificial intelligence is used only in our AI chat feature, where you submit questions and receive AI-generated responses. AI inference runs on AWS Bedrock under contractual terms that prohibit the model provider from using your data to train foundation models, prohibit sharing your data with the underlying model provider, and limit retention of your prompts and responses to the request lifecycle.

Neither of these processes makes decisions that have legal or similarly significant effects on you, and the content they produce is informational and entertainment in nature. If you have concerns about an interpretation or AI response, contact us as described in "Questions or Complaints" below — we will review your concern, examine the inputs and outputs of the process, and respond.

Cookies and Tracking Technologies

Cookies are small data files stored on your device. We use cookies and similar technologies (including web beacons and server-side event tracking) to operate the Services, understand usage, and — with your consent — measure advertising effectiveness.

Categories of cookies and trackers we use:

• Strictly necessary (always on): required for the Services to function — session management, security features, and user authentication. These cannot be disabled.
• Analytics: Google Analytics 4 (GA4), used to understand aggregate usage. Set only with your consent.
• Advertising and marketing: Meta Pixel (Facebook/Instagram) and Google Ads, used to measure advertising effectiveness and deliver relevant advertisements. Set only with your consent. We use server-side event tracking for some advertising platforms, sending hashed or anonymized identifiers and conversion events directly from our servers.
• Bot prevention: Google reCAPTCHA, used on signin, signup, and other sensitive endpoints to detect and block automated abuse. reCAPTCHA collects device and application data and sends it to Google for analysis. Use of reCAPTCHA is subject to Google's Privacy Policy and Terms of Service.

Cookie banner — granular control. Our cookie banner offers three options:

• Essential only — sets only strictly-necessary cookies; no analytics or advertising;
• Accept all — enables all categories;
• Customize — independently toggle analytics and advertising categories.

For users in the UK and EEA, no non-essential cookies are set until you make an affirmative selection. You may re-open the banner and change your selection at any time using the "Cookie Preferences" link in the footer of every page. We honor Global Privacy Control (GPC) signals as a valid request to opt out of the sale or sharing of personal information for cross-context behavioral advertising.

Other ways to manage preferences:

• Your browser settings;
• Platform-specific opt-outs available through Google's Ad Settings, Meta's Ad Preferences, and industry opt-out programs (Digital Advertising Alliance and European Interactive Digital Advertising Alliance).

Sharing of Information

As a general rule, we limit the circumstances in which we disclose your information to third parties. We share information only as described in this policy, to run our business, provide and improve the Services, and comply with legal requirements. There is no human access to your Charts except as explicitly described above, and any sharing is subject to the confidentiality obligations set forth in our Terms of Service.

Sub-processors and service providers. We engage the following providers, each bound by a written Data Processing Agreement (DPA) requiring confidentiality, security, and processing only on our documented instructions:

• Amazon Web Services (AWS): primary cloud infrastructure, operating in US data center regions. Hosts our application, databases, AI inference (AWS Bedrock), authentication (AWS Cognito), email delivery (AWS SES), and content delivery (AWS CloudFront). Processing is governed by AWS's GDPR Data Processing Addendum, which incorporates the EU Standard Contractual Clauses for cross-border transfers.
• Stripe: payment processing and Merchant of Record for all subscription billing and one-time purchases, operating on US infrastructure. Stripe collects and holds your payment method information and transaction history; Lagna360 does not receive or store payment card details.
• Google: Google Analytics 4 (website analytics), Google reCAPTCHA (bot prevention), Google Maps Platform APIs (server-side geocoding and time zone lookups for chart computation, called from our servers without exposing your end-user identity to Google), and Google Sign-In (when used for authentication). Operates on US infrastructure.
• Meta: Meta Pixel and Conversions API for advertising measurement, operating on US infrastructure. Meta receives page view and conversion events; we hash personally identifying fields where applicable.
• Zoho: email infrastructure for our support inbox, used for support correspondence and operational communications. Operates on US infrastructure.

Other circumstances in which we may share information:

• In response to a request for information if we believe disclosure is in accordance with any applicable law, regulation, or legal process, or as otherwise required by law;
• If we believe your actions are inconsistent with the spirit or language of our user agreements or policies, or to protect the rights, property, and safety of us or others;
• In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition (provided that your Charts will remain subject to the confidentiality obligations);
• With your consent or at your direction.

We may also share aggregated or de-identified information that does not directly identify you.

International Data Transfers

Lagna360 is incorporated in Ontario, Canada. Your personal data is processed and stored in the United States via our cloud infrastructure providers, primarily Amazon Web Services (AWS) operating in US data center regions. Our other material sub-processors (Stripe, Meta, Google, Zoho) also operate primarily on US infrastructure. If you are located outside Canada or the United States, your information will be transferred internationally to the United States.

To make these international transfers lawful, we rely on the certifications and contractual safeguards our sub-processors have established. Each of our material sub-processors — AWS, Stripe, Google, Meta, and Zoho — is contracted under an industry-standard Data Processing Agreement that covers the transfer mechanisms required by the privacy laws applicable to you. These include, where relevant, the EU and UK Standard Contractual Clauses, the EU-US Data Privacy Framework certifications (AWS, Stripe, Google), and equivalent safeguards under PIPEDA, the DPDP Act, and other regional laws.

We do not maintain our own transfer agreements with individual data subjects; the protections you benefit from flow through these sub-processor Data Processing Agreements.

Data Retention

We retain your personal information for as long as necessary to maintain your account and provide the Services, comply with legal obligations, and resolve disputes and enforce agreements.

Specific retention periods:

• Account, chart, and chat data: retained for the duration of your account; erased from primary storage within 30 days of account deletion, and typically within 24 hours. Backup copies are overwritten by normal backup rotation within 35 days; during that window, backups are access-restricted, used solely for disaster recovery, and not used to re-personalize analytics or marketing.
• Generated reports (PDF), consent records, and subscription records: same as above, except for a minimal transaction record we are required to retain for accounting and tax purposes (see "Payment records" below).
• Operational analytics records: stored separately from your identifying data, keyed only by an internal opaque token. After your account is deleted and the token-to-identity mapping is destroyed, these records persist as pseudonymized analytics data used for aggregate cohort analysis. Where feasible, we further generalize fields (for example, IP-derived geolocation to country, timestamps to date) to reduce re-identification risk.
• Website analytics (Google Analytics): user-level data retained for 2 months.
• Marketing preferences: until you opt out.
• Payment records (held by Stripe): 7 years (financial regulatory requirement; outside Lagna360's control).
• Support correspondence (held by Zoho): 3 years from last message in thread.
• Operational and security logs: 30 days for application logs; 7 years for audit logs (with personal data minimized).

We maintain a detailed Data Retention Policy as part of our internal compliance documentation.

Security

We take reasonable and appropriate measures to protect information about you from loss, theft, misuse, and unauthorized access, disclosure, alteration, and destruction. Measures include encryption of sensitive data at rest and in transit, role-based access controls, network isolation, audit logging, and regular security assessments. No system is perfectly secure; if you have reason to believe your interaction with us is no longer secure, please contact us immediately as described in "Questions or Complaints" below.

Your Rights and Choices

You have meaningful control over your data. Many of these rights are available to all users; some are specific to particular jurisdictions and are detailed in the regional notices below. To exercise any of these rights, see "How to Reach Us" above — the Personal Data and Privacy page in your account is the primary, fastest, and most secure channel.

Access, correction, and portability. You may see what we hold, correct your account information and birth data, and export a copy of your data in a structured, commonly-used, machine-readable format — all from the Personal Data and Privacy page described in "How to Reach Us" above.

Account deletion. You may delete your account at any time from the Danger Zone on your account page, immediately above the Personal Data and Privacy button. To prevent confusion about ongoing subscription charges, our self-service flow asks you to first cancel any active subscription via the Stripe Customer Portal; once your current billing period ends, you can delete your account from your settings. Account deletion permanently removes your account profile, Charts, chat history, and generated reports from our systems.

Erasure timing. Self-service deletion completes within 30 days, and typically within 24 hours. If you cannot complete self-service deletion — for example, because you cannot access your account, or your request requires manual handling — see "Questions or Complaints" at the end of this policy. We will process the request without undue delay and in any event within 30 days, including coordinating subscription cancellation on your behalf where relevant.

What persists after deletion. Stripe retains transaction records as required by financial regulations. Meta and Google retain advertising and analytics data per their own retention schedules. We retain pseudonymized analytics records (with no link back to your identity after deletion is complete) for longitudinal product analysis. Cached and backup copies are overwritten by normal rotation within 35 days, after which all traces are removed from our systems.

Cookie preferences. Manage non-essential cookies as described in the "Cookies and Tracking Technologies" section above. We honor Global Privacy Control (GPC) signals.

Marketing communications. You may opt out of marketing emails at any time using the unsubscribe link in any marketing message or from the Personal Data and Privacy page in your account. If you opt out, we may still send non-marketing communications, such as account, billing, security, and service notices.

Children's Privacy

Our Services are intended for a general adult audience. We do not knowingly collect personal information from:

• Children under 13 years of age in the United States;
• Children under 16 years of age in jurisdictions where that is the applicable threshold (including parts of the European Union);
• Children under 18 years of age in India, where the Digital Personal Data Protection Act, 2023 defines a "child" as anyone under 18.

How we apply this in practice. We do not perform active age verification. Doing so would require us to collect additional personal information — such as government-issued ID, credit card details, or biometric age estimation — which would run counter to the data-minimization posture of this policy and to the requirements of the same laws cited above. Instead, we rely on the age eligibility requirement in our Terms of Service and on prompt reactive deletion when an under-age account is brought to our attention. The account-level data we do collect (an email address) is not sufficient on its own to determine a user's age.

If you are a parent or guardian and believe a child under the applicable threshold has created an account or provided information through the Service, contact us as described in "Questions or Complaints" below and we will delete the account and associated data promptly. If you are a minor under the age of majority in your jurisdiction, please obtain parental or guardian consent before using our Services.

Data Breach Notification

In the event of a personal data breach that affects your information, we will:

• Notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms (or equivalent local-law standard);
• Notify the relevant supervisory authorities as required by law (within 72 hours under the UK GDPR/EU GDPR, and in accordance with PIPEDA, Quebec Law 25, the DPDP Act, and applicable US state laws);
• Provide information about the nature of the breach, the categories of data involved, the likely consequences, and the steps you can take to protect yourself.

Questions or Complaints

Most requests are handled fastest through the Personal Data and Privacy page in your account, as described in "How to Reach Us" above. For questions, concerns, or complaints about this Privacy Policy that those controls do not cover, our support address is support [at] lagna360.com. We may ask you to verify your identity first. We aim to respond within 30 days.

If you are in the UK or EEA and have a concern we are unable to resolve, you have the right to lodge a complaint with the UK Information Commissioner's Office or your local Data Protection Authority. Residents of Canada, California, and India have equivalent escalation routes, set out in the regional notices above.