Privacy Policy

This Privacy Policy explains how Andromeda Enclave LLC, doing business as Star Phlux ("Star Phlux," "we," "us," or "our"), collects, uses, discloses, and retains personal information through starphlux.com, the Star Phlux portal, Ask PHLUX, our readings and related offerings, and communications connected with those services (collectively, the "Services").

Andromeda Enclave LLC is a California limited liability company located at 8932 Hollywood Hills Rd, Los Angeles, California 90046, United States. For privacy questions or requests, contact admin@starphlux.com.

1. The short version

• We use personal information to create accounts, calculate astrology charts, provide AI-assisted conversations and readings, remember relevant context you choose to share, process purchases, communicate with you, protect the Services, and audit the accuracy of readings.
• The core information used by the Services includes names, email addresses, birth details, calculated chart data, conversations, private memory profiles, and purchase and usage records.
• Ask PHLUX and written readings use Anthropic's commercial API. Information sent to Anthropic may include questions, recent messages, memory profiles, birth information, chart data, and compiled briefs.
• Your conversations are private from other customers and are never sold. They are not private from Star Phlux: they are processed by Star Phlux, by Anthropic to generate answers, and by the infrastructure providers named in Section 8, and PHLUX and people or tools specifically authorized to operate and maintain the Services can read them when necessary.
• This Policy contains our [Consumer Health Data Privacy Policy](#13-consumer-health-data-privacy-policy) in Section 13.
• We do not sell personal information, share it for cross-context behavioral advertising, serve personalized ads, or use analytics pixels or session-replay tools.
• The Services are only for adults aged 18 or older. Do not submit information about a minor.

2. Personal information we collect

Depending on how you use the Services, we collect the following categories of information.

Account and contact information

We collect your name and email address. If you opt in to text messages for the morning letters or Your Sky Today, we also collect your mobile number and the time and wording of your consent. We may also process a first-name sign-in identifier, a cryptographically protected password credential if you use a password, magic-link and password-reset records, authentication status, and active-session information. Passwords are not stored in readable form.

Birth and astrology information

We collect the name, birth date, birth time and its reported accuracy, and birthplace of each adult whose chart you ask us to calculate. We derive or obtain geographic coordinates, historical time-zone information, and full calculated chart data from those details. We also store chart briefs, interpretations, reports, and other material generated from the chart.

The same birth and chart information may be stored both in the portal and on company-controlled equipment in the United States that calculates charts and generates briefs and readings. That equipment also stores cached briefs and accuracy-audit logs containing writing requests and the prompts used to produce them.

Ask PHLUX conversations and memory

We store the questions you ask and the answers generated through Ask PHLUX. To maintain continuity, the Services create and periodically update a private memory for each person, which may include a short profile, a conversation summary, and dated or other facts the person has shared. The memory is instructed to leave out health, mental-health, sexual, reproductive, religious, and financial details even when a conversation contains them, so that such details are not carried forward and re-sent with every later question; the original conversation text is still stored as described in Section 11. We also record operational information such as the number of questions used, first and last activity, and token and cost counts for generated answers.

Information about relationships and other adults

You may provide birth details and relationship context about a partner, former partner, family member, or another adult who does not have a Star Phlux account. We may calculate that person's chart and create inferences about the person or relationship. Section 4 explains this indirect collection in more detail.

Information you choose to include in conversations

We do not ask for health, sexual, religious, financial, family, or similarly sensitive information as structured profile fields. However, the content you choose to type may contain such information, and it may appear in conversation history or a private memory summary. Please do not provide highly sensitive information unless it is relevant to your request and you are comfortable with it being processed as described in this Policy. By intentionally submitting such information, you ask us to process it to provide and maintain the requested Services. Where applicable law requires separate consent, we request it separately: the first time you raise a health-related matter in a conversation, Ask PHLUX pauses and asks whether you consent to Star Phlux processing health-related details you share, as described in Section 13. This Policy is not itself a request for consent, and you can withdraw that consent at any time from your account settings or by emailing admin@starphlux.com.

Purchase information

We store what you purchased, the amount, date, credit balance, and Stripe session and customer identifiers. Stripe processes card numbers and other payment credentials; Star Phlux does not receive or store complete card details. If you subscribe to Your Sky Today, Stripe processes your payment; we store the Stripe customer and subscription identifiers and the renewal date, never your card number.

Technical and usage information

Our systems and service providers may process IP address, browser and device information, session and authentication records, timestamps, pages or features requested, security and error information, questions used against an allowance or credit balance, and email-delivery logs. Cloudflare and our hosting providers may receive ordinary request and security logs when they deliver the Services.

Communications and live-service information

If you contact us, arrange a live session, or otherwise communicate outside the portal, we may retain your message and related metadata in the email, scheduling, or communication service used. The portal does not currently store support messages or session recordings. We do not record a live session unless we notify you and obtain any consent required by law.

Cookies and local browser storage

We use a session cookie or similar storage to keep you signed in and a browser setting that remembers when you dismiss the chart-casting banner. Our infrastructure providers may use strictly necessary security or delivery technologies. We do not currently use advertising cookies, analytics pixels, or session-replay technology.

3. Where information comes from

We obtain personal information:

• directly from you when you create an account, enter birth details, ask questions, buy an offering, or contact us;
• from another adult user who enters your information for a relationship or other reading;
• automatically from your browser, device, and use of the Services;
• from service providers involved in authentication, payments, email delivery, hosting, security, and location lookup; and
• by deriving it from other information, such as calculating coordinates, time zones, charts, chart-based inferences, briefs, conversation summaries, and memory facts.

4. When another user provides your information

A user may submit information about another adult even if that person never creates an account. The information may include a name, relationship context, birth date, birth time, birthplace, coordinates and time zone, calculated chart data, and chart-based or relationship inferences. We receive it from the submitting user and process it only for the requested chart, conversation, reading, related memory, service administration, security, and accuracy auditing.

Our Terms require the submitting user to represent that they have the legal right to provide the information. We also ask users to share this Privacy Policy with the other adult when appropriate. If you believe someone submitted information about you, you may ask us to confirm, access, correct, or delete it by emailing admin@starphlux.com. We will verify requests and apply any legal exceptions and the rights of other people involved. Deleting one person's information may require us to remove or limit access to a linked chart, conversation, or reading.

If applicable law requires us to give the other adult a direct privacy notice and we have a way to contact them, we will provide that notice within the period required by law. If an exception applies because direct notice is impossible or would involve disproportionate effort, we will document the basis for that conclusion and take any measures the law requires to protect the person's rights.

Never submit birth details or other personal information about anyone under 18.

5. How we use personal information

We use personal information to:

• create, authenticate, and administer accounts;
• calculate and verify individual, relationship, synastry, composite, transit, and other astrology charts;
• generate, deliver, store, and make available Ask PHLUX answers, chart briefs, written readings, and related materials;
• maintain private conversation history and memory so the Services can respond with relevant context;
• connect adult accounts and administer separate or shared question credits at the users' direction;
• process purchases, maintain transaction records, and provide purchased credits or readings;
• send welcome, login, password-reset, purchase, invitation, reading-ready, security, and service-announcement messages;
• answer requests and provide support;
• review selected content, audit chart and writing accuracy, troubleshoot, secure, maintain, and improve the Services without training an AI model on customer conversations;
• detect fraud, abuse, unlawful activity, and violations of our Terms;
• establish, exercise, or defend legal claims and comply with legal obligations; and
• complete a financing, reorganization, sale, merger, or transfer of all or part of the business, subject to appropriate protections.

6. AI processing and human access

Ask PHLUX is an AI system, not a human astrologer. Star Phlux also uses AI to help generate chart briefs and written readings.

For Ask PHLUX, Anthropic receives the question, a compiled chart brief, the person's private memory profile and facts, and recent conversation messages. For chart briefs and written readings, Anthropic receives birth details, chart data, prompts, and related instructions. Separate Anthropic calls update memory summaries and extract dated facts. Star Phlux stores the resulting content as described above.

Star Phlux uses Anthropic's commercial API. Under Anthropic's commercial terms in effect on this Policy's effective date, Anthropic does not use commercial API customer inputs or outputs to train its models. Anthropic states that standard API inputs and outputs are normally deleted from its systems within 30 days. Anthropic also states that inputs and outputs flagged for usage-policy review may be retained for up to two years, associated trust-and-safety classification scores may be retained for up to seven years, and information may be retained longer when legally required. These periods and exceptions are controlled by Anthropic and may change. Anthropic's current terms and explanations are available through its Commercial Terms and data-retention notice.

We do not use your conversations to train an AI model. We do use conversations and outputs to provide memory, investigate problems, review flagged material, audit accuracy, secure the Services, and improve how the Services operate.

Ask PHLUX is designed to recognise language suggesting a risk of suicide or self-harm and to respond with crisis resources instead of an astrological reading; the protocol is published at starphlux.com/safety. Detection is automated, is not monitored by a person in real time, and is not used for any purpose other than showing those resources and, where the law requires, keeping counts of how often it happened without identifying anyone.

Heather Anderson can access account data, charts, conversations, memories, and audit logs through administrative systems. Developers, contractors, and AI-assisted administrative or development tools specifically authorized by us may also access information when reasonably necessary for support, security, maintenance, legal compliance, or accuracy auditing. We direct them to use the information only for the authorized purpose. Apart from Anthropic, no other AI provider is used to generate the customer-facing answers, briefs, or readings described in this Policy.

7. Legal bases for processing

Where laws such as the European Economic Area or United Kingdom data-protection rules require a legal basis, we rely on one or more of the following:

• Contract: processing necessary to create and administer your account, calculate requested charts, provide conversations and readings, process purchases, manage credits, and otherwise provide the Services you request.
• Legitimate interests: operating, securing, troubleshooting, auditing, and improving the Services; preventing misuse; communicating about the Services; maintaining business records; and providing a user-requested relationship reading using information about another adult, where those interests are not overridden by the person's rights.
• Consent: optional promotional communications and voluntary sensitive information where consent is required and has been separately requested. Legitimate interests do not serve as our legal basis for processing special-category data when Article 9 of the GDPR or the corresponding United Kingdom rule applies. You may withdraw consent at any time, without affecting earlier lawful processing.
• Legal obligation and legal claims: complying with law, responding to valid legal process, maintaining required financial records, and establishing, exercising, or defending claims.

We do not use Star Phlux outputs to make decisions that produce legal or similarly significant effects about you.

8. How we disclose personal information

We disclose personal information only as described below:

• Hosting, database, authentication, and email: Lovable Cloud and Supabase host the application and database, provide account authentication, and support email delivery. See Lovable's Privacy Policy and Supabase's Privacy Policy.
• Network delivery and security: Cloudflare delivers and protects starphlux.com and may process network and device data. See Cloudflare's Privacy Policy.
• AI generation: Anthropic processes the information described in Section 6 to generate answers, memories, briefs, and readings.
• Payments: Stripe processes checkout, payment credentials, fraud-prevention information, and customer records, and returns transaction identifiers and status to us. See Stripe's Privacy Policy.
• Text messages: Twilio delivers the optional morning text messages for the morning letters or Your Sky Today and processes the mobile number, message content, and delivery status needed to send them. See Twilio's Privacy Notice.
• Place and time-zone lookup: birthplace suggestions come from a copy of the GeoNames geographical database held on our own servers, so the place name you type is not sent to a third party for lookup. GeoNames data is used under the Creative Commons Attribution 4.0 licence (geonames.org).
• Authorized operations and professional advisers: Heather Anderson, authorized maintainers, contractors, and professional advisers may receive information when needed for the purposes in this Policy.
• Legal, safety, and rights protection: We may disclose information when we reasonably believe disclosure is required by law or valid legal process, or necessary to protect the Services, our users, another person, or our rights.
• Business transfers: Information may be reviewed or transferred as part of a proposed or completed merger, financing, acquisition, reorganization, bankruptcy, or sale of assets. A recipient will be required to handle personal information consistently with applicable law.
• At your direction: We disclose information when you ask us to, including by connecting accounts, sharing credits, or making a reading available to another person. A shared reading or AI answer may reveal chart-based information about another adult even though private conversations remain separated.

Some providers act as our processors or service providers, while others may process limited information as independent businesses under their own terms. They may use subprocessors to provide their services.

9. No sale, behavioral advertising, or third-party analytics

We do not sell personal information for money or other valuable consideration. We do not share personal information for cross-context behavioral advertising or use it for targeted advertising. We do not use third-party analytics, advertising pixels, or session-replay tools, and we do not permit advertisers to track you through the Services.

Because we do not sell or share personal information for behavioral advertising, Global Privacy Control and browser "Do Not Track" signals do not change how the Services operate. We will honor such signals if our practices change in a way that makes them legally applicable.

10. Communications

We may send messages needed to provide and secure the Services, including welcome, login, password-reset, purchase, invitation, reading-ready, and important service-update messages. You generally cannot opt out of essential account messages while keeping an active account.

If you opt in to text messages for the morning letters or Your Sky Today, we send one text per morning (for the length of the letters, about 30 messages, or for as long as your subscription is active), a confirmation text when you opt in, and replies to STOP and HELP. Message and data rates may apply. Reply STOP to end the texts, HELP for help, or remove your number in your account settings. Stopping the texts does not affect the email letters. We keep a record of your consent (the wording you agreed to, the time, and the number) and of the texts we send, and we delete your number when you delete your account.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-message opt-in data and consent are not shared with any third party except the provider that delivers the messages on our behalf, for that purpose only.

We may send occasional product or promotional announcements where permitted by law. Where consent is required, we will request it. You can opt out of promotional messages by following the instructions in the message or emailing admin@starphlux.com. Opting out of promotional messages does not stop essential service messages.

11. Retention and deletion

We currently retain accounts, charts, conversations, memory, cached briefs, and accuracy-audit records until you clear the information through an available control or request deletion, unless a longer period is reasonably necessary for security, fraud prevention, legal compliance, dispute resolution, or enforcing agreements. We do not automatically delete this information merely because an account is inactive.

You may clear your own conversation history and memory through available portal controls and may remove individual remembered facts. You may also delete your whole account from your account settings. Account deletion removes your account, charts, conversations, memory, and briefs from the portal, and places a deletion instruction in a queue that the company-controlled chart engine carries out for its cached briefs and accuracy-audit copies. We complete both within 30 days of the request, usually within a day, and, where the law requires, forward the deletion to processors holding the covered data. You can also request deletion by emailing admin@starphlux.com. Provider backups may retain residual copies for a limited period until they are overwritten or deleted under the provider's backup schedule. Information retained for legal reasons will remain restricted to that purpose.

We generally retain purchase and accounting records for seven years. Authentication, security, email-delivery, and provider logs are kept for the period reasonably necessary for their operational purpose or according to the provider's applicable retention schedule. Anthropic retention is described in Section 6.

12. Your privacy rights and choices

Depending on where you live, you may have the right to:

• know whether we process your personal information and access a copy;
• obtain information about the categories, sources, purposes, and recipients of your information;
• correct inaccurate information;
• delete information, subject to legal exceptions;
• restrict or object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent;
• opt out of promotional communications;
• appeal our refusal of a privacy request; and
• receive equal service and pricing without unlawful discrimination for exercising a privacy right.

To make a request, email admin@starphlux.com and describe the request and the person or account involved. We may ask you to verify your identity or authority. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and direct identity verification. We aim to respond within 30 days, or within another period required by applicable law.

If we deny a request, you may appeal by replying to our decision with the words Privacy Appeal and explaining your concern. These rights are not absolute; for example, we may retain transaction information required by law or information needed to protect another person's rights.

Residents of California and other U.S. states may have statutory rights to know, access, correct, delete, or obtain a portable copy of personal information and, where applicable, to opt out of sale, targeted advertising, certain profiling, or uses of sensitive information. The categories collected during the preceding 12 months, their sources, purposes, and recipients are described in Sections 2, 3, 5, and 8. We have not sold or shared those categories for behavioral advertising, and we do not offer financial incentives for personal information.

People in the EEA, United Kingdom, or Switzerland may also complain to the data-protection authority where they live or work or where they believe a violation occurred. Nothing in this Policy limits rights that cannot lawfully be limited.

13. Consumer Health Data Privacy Policy

This section supplements the rest of this Policy and is our Consumer Health Data Privacy Policy where laws such as Washington's My Health My Data Act, Nevada's consumer health data law, or similar state laws apply. It is linked directly from every page footer under that name.

Star Phlux is not a healthcare provider, and the Services are not medical or mental-health services. However, "consumer health data" can be defined broadly enough to include information a person voluntarily types about physical or mental health, symptoms, treatment, medication, reproductive or sexual health, or an AI-generated or astrology-based inference concerning past, present, or future health.

We may collect the following consumer health data:

• health, mental-health, reproductive-health, sexual-health, treatment, symptom, or medication information that a user voluntarily includes in a conversation;
• summaries or remembered facts generated from that content; and
• health- or wellness-related themes or inferences generated in a requested conversation or reading.

The categories above come from the person using the Services, from another user who submits information about an adult, or from inferences generated from User Content and chart data. We use voluntarily submitted health-related details to answer the requested question or prepare the requested reading; generated summaries and facts to preserve conversation continuity; and related content and inferences to deliver the requested output, audit accuracy, address safety or misuse, provide support, and comply with law.

Depending on what is required to provide the requested Service, the categories above may be collected or processed by Andromeda Enclave LLC and specifically authorized maintainers; Anthropic, for AI generation and memory processing; Lovable Cloud and Supabase, for application hosting, database storage, authentication, and email delivery; Cloudflare, for network delivery and security; and company-controlled chart-engine equipment, for chart calculation, generation, caching, and accuracy auditing. Stripe does not receive conversation or chart content from Star Phlux for payment processing. Consumer health data may appear in an answer or reading shared with a connected adult or other recipient at the requesting user's direction. We do not sell consumer health data or use it for advertising.

Processing may include collecting, storing, organizing, retrieving, transmitting to the providers above, analyzing, summarizing, inferring themes, generating content, displaying or delivering the requested output, and deleting data. No third party is permitted by Star Phlux to collect consumer health data through the Services over time and across unrelated websites or online services for advertising or profiling.

Where applicable law requires it, we collect or share consumer health data only with the person's separate consent or to the extent necessary to provide a product or service that person requested, as otherwise permitted by law. That consent is requested in the conversation the first time a health-related matter comes up, is recorded with the time and version, and can be withdrawn at any time from your account settings or by email. If you withdraw it, Ask PHLUX will still answer you, but you should not include health-related details in your questions, and you may ask us to delete any already held. Do not submit another person's health, mental-health, reproductive-health, sexual-health, treatment, or similarly sensitive information unless that person has expressly authorized it and you are legally permitted to do so.

Subject to applicable law, you may ask us to confirm whether we collect or share your consumer health data; access it; receive a list of applicable third parties; withdraw consent; or delete it. Submit a request to admin@starphlux.com. We may verify your identity, and deletion may be subject to limited legal exceptions. When required, we will also send a valid deletion request to processors, affiliates, or other parties holding the covered data. You may appeal a refusal by replying with Privacy Appeal.

14. International transfers

Star Phlux is based in the United States, and personal information is processed in the United States and in other countries where our providers or their subprocessors operate. Those countries may have different data-protection laws from your country.

Where applicable law requires an international-transfer mechanism, personal information must be transferred under an available lawful mechanism, such as an adequacy decision, standard contractual clauses, the United Kingdom addendum or international data transfer agreement, or another recognized safeguard. You may contact us for information about the mechanism relevant to your information.

15. Security

We use reasonable administrative, technical, and physical measures intended to protect personal information, including provider-managed authentication, restricted administrative access, authenticated engine connections, and non-readable password credentials. Complete payment-card details are handled by Stripe rather than stored by Star Phlux. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

Please use a strong, unique password if you choose password login, protect access to your email and devices, and contact us promptly if you suspect unauthorized account access.

16. Adults only

The Services are not intended for anyone under 18, and users may not submit personal information or birth details about a minor. If we learn that we have received a minor's information, we will take reasonable steps to delete it. Contact admin@starphlux.com if you believe a minor's information has been submitted.

17. Changes to this Policy

We may update this Policy to reflect changes to the Services, providers, or law. We will post the revised version with a new effective date. If a change materially affects how we use information already collected, we will provide additional notice or request consent where required.

18. Contact us

• Andromeda Enclave LLC, doing business as Star Phlux
• 8932 Hollywood Hills Rd, Los Angeles, CA 90046, United States
• Privacy and legal email: admin@starphlux.com
• General service email: hello@starphlux.com