Privacy Policy
Version 1.1 · Updated 8 October 2026 · Prepared with India's DPDP Act 2023 in mind
1. Who We Are
Graha Life is an AI-assisted Vedic astrology and spiritual guidance service, on the web at graha.life and on Telegram. Contact: nav@graha.life
2. What Data We Collect
Data You Provide
| Data Type | Fields | Purpose |
|---|---|---|
| Identity | The name you type (a first name is enough). On Telegram, your Telegram ID and first name. | Addressing you; delivering readings |
| Birth Data | Date, time and place of birth (we derive coordinates and time zone from the place) | Chart computation |
| Language | Preferred language | Delivering readings in your language |
| Communication | Your questions and our answers; voice messages sent to the Telegram bot (transcribed to text) | Generating readings |
| Other people | Anything you type about someone else, such as a partner's birth details for a compatibility reading | Answering your question. Please share only what you are comfortable sharing. |
| Contact | Your email, only if you write to us or send a partner enquiry | Replying to you |
Data Generated by the Service
Your natal chart (computed planetary positions), conversation history, payment references (transaction ID, amount and status), and anonymized usage data.
What We Do NOT Collect
Biometric data, your device's location, contacts, photos, Aadhaar/PAN, or card and UPI credentials (those go straight to our payment processor).
3. How We Use Your Data
Computing your chart, generating readings and answers with AI models, delivering the daily horoscope to Telegram users, processing payments, running the service and watching it for problems, preventing abuse of the free trial, and improving service quality (anonymized, aggregated only).
We will NEVER: sell your data, use it for advertising, or knowingly profile minors.
4. Data Storage & Security
- Database: Supabase (PostgreSQL). It is reachable only by our own server; direct public access to the database is blocked.
- Your details and chats are stored in our database on infrastructure that encrypts its disks at rest, and are sent to your browser over TLS. Only our system can read them. Web consultations on graha.life are not additionally encrypted field by field. Birth details you give our Telegram bot are additionally encrypted field by field (AES-256-GCM).
- Payments are handled by our payment processor, PayU. We never see or store your card or UPI credentials.
- You can delete your birth details and conversation at any time (see Your Rights).
5. Data Sharing
We do not sell your data. We share it only with the service providers below, and only for the purpose shown.
| Provider | Data Shared | Purpose |
|---|---|---|
| AI model providers: Anthropic (Claude), Google (Gemini), Cloudflare Workers AI, Groq, Mistral, Sarvam | Your questions and the conversation, your first name, your birth details and chart, and any details of other people you type | Writing your reading and answers, and translation |
| OpenStreetMap (Nominatim) | The place name you type | Finding coordinates for your birth place |
| PayU | Payment details you enter at PayU's checkout, and the amount and transaction ID | Payment processing |
| Supabase | All stored data | Database hosting |
| Cloudflare | Request metadata such as IP address; the Turnstile bot check | Hosting, security, bot protection |
| Upstash | A hashed form of your IP address | Rate limiting |
| Resend | Your email address and the message | Sending email |
| Telegram (our private operations chat) | When a new free trial starts: first name, place and birth year. Payment notices. | Operational alerts to the owner |
| Google Fonts | Your IP address when a page loads | Page fonts |
Your first name and birth details are sent to AI model providers so they can write your reading. Each provider handles that data under its own terms.
6. Your Rights (DPDP Act)
- Access: Request a summary of your data — contact nav@graha.life
- Correction: Update inaccurate data by starting a new consultation, or ask us by email
- Erasure: On the web, tap “Delete my data” on your consultation screen to remove your birth details and conversation. On Telegram, type
/delete_my_datain the bot. Or email nav@graha.life. What remains is the payment record (transaction ID and amount), which we must keep for accounting. - Withdraw consent: As easy as giving it — through the consultation screen, the bot or email
- Nominate: Register a nominee for your data rights
7. Data Retention
| Data Type | Retention |
|---|---|
| Conversation history | Messages are deleted automatically 12 months after they were sent |
| Web consultation (birth details and chart) | Until you delete it, or automatically once 12 months pass with no chat activity or payment on it |
| “Past events” cards and their lines | Deleted automatically after 12 months |
| Telegram bot account data | Until you delete it |
| Payment records (transaction ID, amount) | 8 years (legal requirement); kept even if you delete your other data |
| Anonymous page-view counts | 40 days, then deleted automatically |
| Trial abuse-prevention hashes | 30 days, then deleted automatically |
8. Children's Privacy
Graha Life is for adults (18 and over). We do not ask for or check your age. A parent or guardian may enter a child's birth details at their own discretion and responsibility. We do not use anyone's data for advertising and do not knowingly profile minors.
9. Cookies and Anonymous Analytics
We do not set cookies. Your browser's local storage keeps your session link and language choice on your own device. We run no advertising cookies, no third-party analytics scripts and no tracking pixels. Our pages do load fonts from Google Fonts and the Cloudflare Turnstile bot check on the consultation page, so those providers can see your IP address when a page loads.
To understand how many real people read our pages, our own server keeps an anonymous count. For each page view we combine your network address truncated to a /24 block (IPv6: /48), your browser type, and the current date, and store only an irreversible hash of that combination. We never store your IP address or your browser string, the hash changes every day so it cannot follow you from one day to the next, it is not linked to your account, birth details or payments, and it is automatically deleted after 40 days. The only thing it can tell us is how many distinct visitors a page had on a given day.
We apply the same technique — a truncated, hashed network prefix with a 30-day expiry — to limit abuse of the free consultation trial.
10. Contact
Privacy inquiries & data deletion: nav@graha.life
General support: nav@graha.life