Privacy Policy

Last updated September 24, 2026. This policy explains what DashaHQ collects, why, and how you stay in control of it.

In short

• We collect only what the product needs: your email and your birth data.
• Your birth data is sensitive. It is used to compute your chart and for nothing else.
• We do not sell personal data, ever.
• You can ask us to delete everything at any time, and we will.
• Payments run through Dodo Payments as merchant of record; card data never reaches us.

What we collect

• Email address — to sign you in with a one-time code and to deliver your trial emails.
• Birth data — your birth date, and optionally your birth time and birth place. This is the raw material of your chart. Birth data is sensitive personal data under India’s DPDP Act and special-category adjacent under the GDPR: it describes you closely, so we treat it with corresponding care.
• Derived data — your computed chart, dasha periods, and the readings generated for you.
• One session cookie — dhq_session, HttpOnly, keeps you signed in. There are no advertising or tracking cookies.
• Server logs — minimal request logs for security and reliability.

How we use it — and what we never do

Your data is used to compute your chart, generate your daily readings, send trial emails, and keep the service secure. We do not sell your personal data. We do not share it with advertisers or data brokers, and we do not use your birth data to train models or to profile you beyond your own readings.

Processors we rely on

• Cloudflare — hosting and database (Workers, D1).
• DeepInfra — runs the language model that writes reading prose; your computed chart data is sent there to produce each day’s text.
• Resend — delivers our emails.
• Dodo Payments — merchant of record for payments. Payment card data goes directly to Dodo Payments; we never receive or store it.

Legal bases (EEA/UK — GDPR)

We process data to perform our contract with you (computing and delivering readings), with your consent (trial emails — withdrawable at any time), and in our legitimate interests (security and abuse prevention).

Your rights (India — DPDP Act, 2023)

You may access, correct, or erase your personal data, withdraw consent, nominate another individual to exercise your rights, and raise grievances with us or with the Data Protection Board of India.

Your rights (EEA/UK — GDPR)

You may request access, rectification, erasure, restriction, portability, and object to processing, and you can complain to your supervisory authority.

Deletion on request

Email privacy@dashahq.com from your account address and we delete your account, charts, readings, and email address within 30 days — except the minimum records we must keep for tax or fraud reasons, which we then anonymize.

Retention

Account data is kept while your account is active. Readings are kept so you can revisit them. When you close your account or ask for deletion, the data above is deleted or anonymized. Server logs are kept for a short, fixed window.

Security

Data travels over TLS, access is limited to what operations need, and secrets live outside the codebase. No system is perfectly secure, and we treat your birth data as the sensitive information it is.

International transfers

Data is processed in India and in the regions of the processors listed above. Cross-border transfers rely on recognized safeguards such as contractual clauses.

Children

DashaHQ is not for anyone under 18, and we do not knowingly collect data from children.

Contact

Privacy questions and deletion requests: privacy@dashahq.com.