PRIVACY POLICY
Last updated: September 1, 2026
Aperio, a French société par actions simplifiée (simplified joint-stock company) with share capital of EUR 2,300, operating under the trade name “Nostra,” with its registered office at 186 rue de la Convention, 75015 Paris, France, and registered with the Paris Trade and Companies Register under number 928 204 874 (the “Company,” “NOSTRA” or “We”), considers the protection of Personal Data a priority.
NOSTRA is committed to complying with French and European laws and regulations relating to the protection of Personal Data, in particular Regulation (EU) 2016/679 of April 27, 2016 (the “GDPR”) and the French Data Protection Act of January 6, 1978 (Loi Informatique et Libertés).
The purpose of this privacy policy (the “Policy”) is to explain how NOSTRA collects, uses, shares and retains the Personal Data of Users of its Site and Services as well as, where applicable, other Data Subjects whose data is Processed in connection with the Services.
This Policy supplements and forms an integral part of the Terms and Conditions of Sale and Use available at: https://hellonostra.com/fr/terms (the “Terms”). Use of the Site and/or Services requires the User’s acceptance of the Terms and this Policy.
For any questions regarding this Policy or the Processing of your Personal Data, you may contact NOSTRA at contact@hellonostra.com.
Article 1 – Definitions
Capitalized terms used in this Policy shall have the meanings assigned to them in Article 2 of the Terms and, for terms not defined in the Terms, the following meanings:
“Data Subject” has the meaning given to it under the GDPR.
“Data Controller” has the meaning given to it under the GDPR.
“Processor” has the meaning given to it under the GDPR.
“Processing” has the meaning given to it under the GDPR.
“Transfer” has the meaning given to it under the GDPR.
“Personal Data Breach” has the meaning given to it under the GDPR.
Article 2 – Collection of Personal Data
Users’ Personal Data may be collected directly by NOSTRA when they create or use their User Account, or through forms, free-text fields, interfaces and features they use in connection with the Services.
Such Personal Data may include, in particular, account and profile information provided by the User, birth data, information the User chooses to provide in order to personalize the Services, interactions with artificial intelligence, journaling content, and data generated through the Services based on information provided by the User.
Certain features, including compatibility analyses, may also result in the User providing information concerning another person. The User agrees to provide only information that the User is authorized to disclose and to limit such information to what is necessary to use the relevant Service.
Information concerning another person that is used in connection with compatibility features is provided to NOSTRA by the User and is not collected directly from that person. NOSTRA does not request contact information that would allow NOSTRA to contact such person. This Policy is publicly available in order to inform such person of the Processing that may involve their Personal Data and of the rights they may exercise by contacting NOSTRA at contact@hellonostra.com.
NOSTRA may also automatically collect certain Personal Data as well as non-personal data when the Services are used and when Users browse the Site, including technical, connection and usage data. Such automatic collection may be carried out through cookies or other tracking technologies. For more information, the User may review the Cookie Policy available at: https://hellonostra.com/fr/cookies.
NOSTRA may also receive certain information from its service providers, including payment, hosting, authentication and other technical service providers, where necessary to provide or secure the Services.
Article 3 – Processing of Personal Data
a/ Necessity of Collection
When using the Site and Services, the User may be required to provide NOSTRA with certain Personal Data necessary to provide the requested Services.
Certain information is optional. However, failure to provide such information may limit the level of personalization or certain features of the relevant Service.
If the User does not wish to provide information necessary for a Service, or objects to its Processing where such Processing is essential to providing the Service, NOSTRA may be unable to provide all or part of the requested Service.
b/ Sensitive Data and Free-Text Fields
NOSTRA does not intend to collect special categories of Personal Data within the meaning of Article 9 of the GDPR, such as information concerning health, sex life or sexual orientation, political opinions, religious or philosophical beliefs, trade union membership, or racial or ethnic origin.
The User therefore agrees not to provide such information through free-text fields, journaling features or interactions with artificial intelligence, unless such information is strictly necessary for a feature for which NOSTRA expressly requests it and, where applicable, implements the safeguards required by applicable law.
The User also agrees not to provide sensitive, excessive or unnecessarily identifying information concerning third parties.
c/ Retention Periods
Personal Data is retained only for as long as necessary for the purposes for which it was collected, subject to any retention periods required or permitted by applicable law.
Where certain Personal Data must be retained after being removed from the Services in order to comply with a legal obligation or to allow NOSTRA to establish, exercise or defend its legal rights, only the data strictly necessary for that purpose will be retained in intermediate archives, with restricted access, for the applicable period.
Upon expiration of the applicable retention periods, Personal Data is deleted or anonymized.
d/ Description of Processing Activities
In connection with the operation of the Site and provision of the Services, NOSTRA acts as Data Controller within the meaning of the GDPR and determines the purposes and means of the Processing activities described below.
| Why is Personal Data used? | What Personal Data is used? | Legal Basis | Retention Period |
|---|---|---|---|
| Creation and management of the User Account and profile | First name or pseudonym; email address; date of birth; time and place of birth where provided; gender where provided; level of knowledge of astrology; personal, relationship or professional circumstances and other profile information where provided; account creation and deletion dates; technical data necessary for authentication, security and operation of the account. | Performance of the Agreement or steps taken prior to entering into the Agreement for data necessary to create and manage the Account and provide the requested Services.NOSTRA’s legitimate interests in security, fraud prevention and the proper operation of the Site. | Until deletion of the User Account. Data necessary to establish the contractual relationship or defend NOSTRA’s rights may subsequently be archived for the applicable limitation period. |
| Calculation and provision of personalized astrological features, including natal charts, analyses, daily and monthly guidance and other features based on the User’s astrological data | Date, time and place of birth; profile information relevant to the requested Service; astrological data calculated or derived from such information, including planetary positions, houses, aspects, natal chart, transits and other astrological elements; personalized content generated through the Services. | Performance of the Agreement and provision of the Service requested by the User. | Until deletion of the User Account or earlier deletion of the relevant content where such functionality is available, subject to any data temporarily retained for security, support or defense of NOSTRA’s rights during the applicable limitation period and in accordance with applicable law. |
| Generation or assistance in the generation of content using artificial intelligence, including analyses, guidance, responses from the AI astrologer and other personalized content | Profile data and astrological data necessary for the Service; questions, messages or context provided by the User; conversation history where necessary; generated content; date and time of interactions; ratings or feedback provided by the User, where applicable. | Performance of the Agreement and provision of the requested Service. | Until deletion of the User Account or earlier deletion of the relevant content where such functionality is available, subject to any data temporarily retained for security, support or defense of NOSTRA’s rights during the applicable limitation period and in accordance with applicable law. |
| Journaling features and storage of content entered by the User | Text, notes and other content voluntarily saved by the User, as well as the dates on which such content is created or modified. | Performance of the Agreement and provision of the functionality requested by the User. | Until deletion of the relevant content where such functionality is available or, otherwise, until deletion of the User Account, subject to any data temporarily retained for security, support or defense of NOSTRA’s rights during the applicable limitation period and in accordance with applicable law. |
| Compatibility analyses involving the User and another person | Regarding the User: profile data and astrological data necessary to perform the analysis.Regarding the other person: first name or nickname, without a last name; date of birth; type of relationship with the User; time and place of birth where provided; astrological data calculated or derived from such information; generated compatibility results. | Regarding the User’s data: performance of the Agreement and provision of the requested Service.Regarding data concerning the other person: NOSTRA’s legitimate interest in enabling the compatibility functionality requested by the User, taking into account the limited nature of the information collected and the data minimization measures implemented. | Until deletion by the User of the relevant profile or analysis, or at the latest until deletion of the User Account, subject to any data temporarily retained for security, support or defense of NOSTRA’s rights during the applicable limitation period and in accordance with applicable law.When the User deletes the other person’s profile, the information associated with that profile is deleted. |
| Sending communications necessary for or directly related to the Services, including welcome messages, security communications, Account management, purchases and Subscriptions and, where the User activates such features, delivery of requested guidance or content | First name or pseudonym; email address; notification preferences; information relating to the Account, purchases or Subscription; personalized content to be sent where such feature has been requested. | Performance of the Agreement where the communication is necessary to provide the requested Service. NOSTRA’s legitimate interests with respect to certain non-promotional relationship or security communications. | For as long as necessary to provide the Service, or until the relevant feature is disabled, the User objects where the right to object applies, or the Account is deleted. |
| Optional surveys regarding the Services | Depending on the survey: first name or pseudonym; age; gender; region or city; occupation; family situation; frequency of use; survey responses; satisfaction ratings; comments and feedback regarding the Services. | Legitimate interest in sending a non-commercial survey. Consent where consent is collected for participation or certain related Processing activities. | Survey responses are retained for 12 months from receipt unless anonymized earlier. |
| Improvement of the Services, security, performance measurement and production of statistics | Site and Service usage data; frequency of use; technical and connection data; IP address; device and browser type; technical events; interactions with features; feedback and ratings; account data necessary for analysis. Data is aggregated or anonymized where possible. | NOSTRA’s legitimate interests in improving, securing and measuring its Services where the Processing does not require consent. Consent where the Processing relies on cookies or other tracking technologies requiring consent. | For as long as necessary for the relevant purpose and in accordance with the retention periods specified in the Cookie Policy for the relevant tracking technologies. Anonymized data may be retained indefinitely where it can no longer be used to identify an individual. |
| User Support | First name or pseudonym; email address; content of the request; Account or Service data necessary to resolve the request; first and last name and identity document only where necessary to verify the requester’s identity. | Performance of the Agreement and NOSTRA’s legitimate interest in providing support for its Services. | For the period necessary to process the request, followed by archiving of necessary information for the applicable limitation period. Identity documents are retained only for as long as necessary to verify identity. |
| Handling of data rights requests and complaints | Requester’s contact information; content of the request; information necessary to process the request; identity document only where there is reasonable doubt regarding the requester’s identity. | Legal obligation. | For the period necessary to process the request and thereafter for the period necessary to allow NOSTRA to demonstrate compliance with its legal obligations. Identity documents are deleted as soon as they are no longer necessary. |
| Marketing communications | First name or pseudonym; email address; language; Account or Subscription status; information necessary to segment communications; records of consent and objection choices. | Consent where required for the sending of electronic marketing communications. Where applicable legal requirements are met, legitimate interest in offering an existing customer products or services similar to those already purchased by that customer, with the right to object at any time. | Until the User withdraws consent or objects and, in any event, in accordance with applicable marketing retention periods, including during the commercial relationship and for three years after its end for customers, or for three years from collection or the most recent contact initiated by the prospect. Data strictly necessary to demonstrate consent or honor an objection may be retained for as long as necessary for that purpose. |
| Management of purchases, payments, billing and Subscriptions | Email address; Account identifier; purchase history; Credits purchased or used; Subscription plan and status; subscription, renewal and cancellation dates; currency; country or region used to determine the applicable price; billing information; receipts and invoices; transaction identifiers provided by payment service providers. NOSTRA does not directly process full payment card details. | Performance of the Agreement for management of purchases and Subscriptions. Legal obligation with respect to accounting, tax and invoicing requirements. Legitimate interest in fraud prevention and monitoring payment incidents. | During the contractual relationship for data necessary to operate the Account. Invoices and accounting records are retained for applicable statutory periods, including 10 years where such period is required. |
| Determination of the applicable currency, country or region and displayed prices | Country or region inferred from the IP address; language or location settings; billing country; information provided by the payment service provider. | Performance of the Agreement or steps taken at the User’s request prior to entering into the Agreement. | For as long as necessary to display the applicable price and complete the transaction and, for information associated with a transaction, for the retention periods applicable to billing data. |
Article 4 – Use and Sharing of Personal Data
NOSTRA may share certain Users’ Personal Data with third parties where such sharing is necessary to provide the Services, perform the Agreement, manage the Site, comply with a legal obligation, defend NOSTRA’s rights or pursue the purposes described in this Policy.
The User’s Personal Data may be Processed by NOSTRA’s authorized directors, employees, service providers and contractors, within the scope of their respective responsibilities and solely for the purposes set out in this Policy.
NOSTRA may, in particular, share or make certain Personal Data available to the following categories of recipients where necessary:
- hosting, infrastructure, storage and Site security providers;
- payment, billing and Credits and Subscription management providers;
- providers used to send transactional emails, notifications, newsletters or marketing communications;
- User support providers and providers handling requests submitted to NOSTRA;
- audience analytics, performance measurement, statistics and Site and Services improvement providers;
- advertising providers, conversion measurement platforms, social networks and advertising retargeting tools, where such tools are used by NOSTRA;
- technical providers enabling the calculation, provision or personalization of astrological features;
- technical providers enabling the generation or assistance in the generation of content using artificial intelligence;
- internal tools used for communication, collaboration, development, maintenance, testing, technical monitoring and project management;
- NOSTRA’s external professional advisors, including attorneys, accountants, auditors, banks, insurers and other professional advisors, where necessary;
- administrative, judicial, tax or regulatory authorities, or any other third party authorized by law, where NOSTRA is required to comply with a legal obligation or legally binding request.
Where NOSTRA engages service providers acting as Processors within the meaning of the GDPR, such providers Process Personal Data solely on NOSTRA’s behalf, in accordance with NOSTRA’s documented instructions and pursuant to an agreement that complies with applicable data protection laws.
NOSTRA does not sell Users’ Personal Data to third parties.
Certain NOSTRA service providers may be located outside the European Union or European Economic Area, or may Process Personal Data from countries outside the European Union or European Economic Area. Where Personal Data is transferred to a country that is not covered by an adequacy decision issued by the European Commission, NOSTRA ensures that such Transfers are subject to appropriate safeguards, including the European Commission’s Standard Contractual Clauses or any other mechanism recognized under applicable law.
NOSTRA may also share or Transfer certain Personal Data in connection with a restructuring, merger, acquisition, asset sale, financing, universal transfer of assets and liabilities, transfer of business operations, or any other transaction involving all or part of its business. In such case, NOSTRA will ensure that the recipient of the Personal Data undertakes to Process such data in accordance with applicable law and, where necessary, this Policy.
NOSTRA may also share certain Personal Data with affiliates, subsidiaries, parent companies or entities under common control where necessary for the operation, development, management or provision of the Services. In such case, NOSTRA will ensure that such entities Process Personal Data in accordance with this Policy and applicable law.
NOSTRA may also share the User’s Personal Data with its business partners in order to offer certain products, services or promotions. In such case, NOSTRA will ensure that such entities Process Personal Data in accordance with this Policy and applicable law.
Article 5 – Your Data Protection Rights
In accordance with applicable law, every Data Subject has, in particular, the right to access, rectify, erase, object to and restrict the Processing of their Personal Data and, where the applicable requirements are met, the right to data portability.
Where Processing is based on the Data Subject’s consent, the Data Subject may withdraw such consent at any time, without affecting the lawfulness of Processing carried out before such withdrawal.
The Data Subject also has the right to provide instructions regarding the handling of their Personal Data after death, under the conditions set forth in the French Data Protection Act.
To exercise these rights, the Data Subject may contact NOSTRA at contact@hellonostra.com and specify the nature of the request.
NOSTRA may request additional information to verify the requester’s identity where NOSTRA has reasonable doubts regarding that identity. An identity document will be requested only where necessary for such verification and will be retained only for as long as necessary to complete the verification.
For additional information about their rights, Users may consult the website of the French Data Protection Authority (CNIL): https://www.cnil.fr.
Users also have the right to lodge a complaint with the CNIL or, where applicable, with the competent supervisory authority in their country of residence.
Article 6 – Changes to this Privacy Policy
NOSTRA reserves the right to amend, supplement or update this Policy, including to reflect changes to the Services, NOSTRA’s practices or applicable law.
The applicable version is the version published on the Site as of the date indicated at the beginning of this Policy.
Article 7 – Contact Us
If you have any questions or concerns regarding this Privacy Policy or the Processing of Personal Data, you may contact NOSTRA at: