Privacy
Privacy Policy
Last updated: 31 Oct 2026
Who is responsible for your data
The controller of your personal data is JOAO VINICIUS CARVALHO LAMARCA VITRAL, sole proprietor (empresário individual) registered in Brazil, trading as Birth Time Lab (tax ID CNPJ 48.731.226/0001-99), Rio de Janeiro, Brazil, the company behind Birth Time Lab. Because we are based in Brazil, Brazil's data protection law (LGPD) applies to us. We also treat the UK GDPR and Canada's PIPEDA as our standard for customers in those countries.
Contact: [email protected]
What we collect, why, and for how long
We collect the minimum needed to calculate and deliver your report. We do not ask for health information.
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Email, name on the report | Deliver your report and give support | Performing our contract with you | 12 months after delivery |
| Birth date, place and time range | Calculate your report | Performing our contract with you | 12 months after delivery |
| Life events you add | Calculate your report | Performing our contract with you | 12 months after delivery |
| Order amount, date and market | Accounting and tax | Legal obligation | The period tax law requires |
| Email for “Get notified” (UK, Canada) | Tell you once when ordering opens in your country | Your consent | Deleted after that email, or when you ask |
| Free range check inputs | Show you the result | — | Not stored |
| Site usage (Google Analytics 4) | Measure how the site is used | Your consent | As set in our Google Analytics account |
Birth date and time are personal data. We handle all of it as sensitive: access is limited to the astrologer who reviews your report, and backups are encrypted.
Who processes your data and where
We use the providers below to run the service. All of them operate outside Brazil, so your data is transferred internationally. We choose providers that commit to protecting it, and we share only what each one needs.
- Stripe: Payments
- Brevo (Sendinblue): Sending email
- Sentry: Error monitoring (we configure it not to send personal data by default)
- Google Analytics 4: Site measurement, only if you accept cookies
- Cloudflare: Network, security and tunnel
- Hostinger: Server hosting
- Cloudflare R2: Encrypted backups
We do not sell your data and we do not use it for advertising.
How long we keep it
We keep your birth details, events and report for 12 months after delivery, then delete them automatically. You can ask us to delete them sooner, and we will do it within 30 days. Order records needed for accounting and tax are kept for as long as the law requires.
Security
Connections use HTTPS. Report links are private and unguessable, and we store only a hash of each link. Payments are handled by Stripe, so we never see your card number. Backups are encrypted.
Your rights
You can ask us to access, correct, delete or export your data, and to withdraw consent at any time. Write to [email protected]. We reply within 15 days. If you are not satisfied, you can complain to your local data protection authority, or in Brazil to the ANPD.
Children
Birth Time Lab is for people aged 18 or older. We do not knowingly collect data from anyone under 18.
Changes to this policy
If we change this policy in a way that matters, we will update the date at the top of this page. See also our Terms of Service and Refund Policy.