Privacy Policy

This policy explains what personal data Astral Frontiers collects, why we collect it, and what rights you have under the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act (1050/2018).

Who is the controller

The data controller for personal data described in this policy is Johannes Aarto, trading as Astral Frontiers, business ID 3656536-1, a sole trader established in Finland (“Astral Frontiers,” “we,” “us”). Contact is by email only.

For any questions about this policy or to exercise your rights, write to privacy@astralfrontiers.com. We are not required to appoint a Data Protection Officer under GDPR Art. 37, and we have not done so.

What we collect and why

Newsletter subscribers

When you sign up for The Astral Dispatch we collect your email address. We also record the date, time, and IP address of your signup and confirmation so we can demonstrate that you gave consent, as required by GDPR Art. 7. If you engage with our emails, our newsletter platform records opens and clicks against your subscriber record.

Legal basis: your consent under GDPR Art. 6(1)(a). You can withdraw it at any time via the one-click unsubscribe link in every email or by contacting us.

Retention: we keep your subscriber record while your subscription is active. When you unsubscribe or ask us to delete your data, we remove your record from our newsletter platform, unless we are required by law to retain it longer.

Processor: we use Kit (operated by ConvertKit LLC, United States) to store subscriber data and deliver the newsletter on our behalf. A Data Processing Agreement between Astral Frontiers and Kit is in effect, published at kit.com/dpa.

Site visitors

Our site is hosted by Vercel Inc. (United States). Vercel processes standard request logs on our behalf — IP address, request URL, user agent, timestamp, and response status — for security, abuse prevention, and performance debugging. We do not read these logs for analytics or build profiles from them. Vercel retains them for a short operational window (typically around 30 days).

Legal basis:our legitimate interest in operating and securing the site, GDPR Art. 6(1)(f). You can object to this processing (see “Your rights” below).

Analytics

We use Plausible Analytics (operated by Plausible Insights OÜ, Estonia) to understand aggregate traffic to the site — which pages are read, where visitors arrive from, and how many people complete key actions like a newsletter signup. Plausible is cookieless, does not use fingerprinting or cross-site tracking, and does not store or share any personal data or persistent identifiers. All metrics are aggregated; we cannot identify individual visitors from what Plausible reports to us. Plausible is hosted in the EU (Germany), so no international transfer is involved. See plausible.io/data-policy for their full data policy.

Legal basis: our legitimate interest in understanding how the site is used so we can improve it, GDPR Art. 6(1)(f). Because no personal data is processed, no consent is required under the ePrivacy Directive.

Editorial content

We author and store our editorial content in Sanity (Sanity AS, Norway/EU). Sanity is a processor for our published content and does not receive personal data about you as a site visitor.

Cookies and local storage

We do not use advertising or cross-site tracking cookies, and our analytics provider (Plausible, see above) is cookieless. Because no consent-requiring cookies are set, this site does not show a cookie banner.

The one functional exception: on our Tonight page, when you choose a city, we save that preference in your browser’s local storage so we can show you the correct sky on your next visit. You set this yourself, it is stored on your device only, and clearing your browser storage removes it. Under Section 205 of the Finnish Act on Electronic Communications Services (implementing the ePrivacy Directive), this qualifies as strictly necessary to provide a service you explicitly requested, so no prior consent is required.

International data transfers

Both Kit (ConvertKit LLC) and Vercel Inc. are certified under the EU–US Data Privacy Framework. The European Commission’s adequacy decision of 10 July 2023 recognises the DPF as providing an adequate level of protection for personal data transferred to certified US organisations under GDPR Art. 45. For transfers to Kit, we rely on the EU–US Data Privacy Framework and, where required, the Standard Contractual Clauses adopted by the European Commission under GDPR Art. 46(2)(c); Kit’s DPA at kit.com/dpa covers both mechanisms. You can verify each provider’s current DPF certification status at dataprivacyframework.gov.

Your rights

Under the GDPR you have the following rights in respect of personal data we hold about you:

• Access — ask what data we hold and receive a copy (Art. 15).
• Rectification — correct data that is inaccurate or incomplete (Art. 16).
• Erasure — ask us to delete your data, subject to any legal retention obligations (Art. 17).
• Restriction — ask us to limit how we process your data (Art. 18).
• Portability — receive your data in a structured, machine-readable format (Art. 20).
• Objection — object to processing based on our legitimate interests (Art. 21).
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of earlier processing (Art. 7(3)).

To exercise any of these rights, contact privacy@astralfrontiers.com. We respond within one month, as required by Art. 12(3). If you are not satisfied with our response, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi.

Security

Data in transit to and from this site is encrypted with TLS. Access to newsletter subscriber data is limited to the small editorial team on a need-to-know basis and protected by two-factor authentication. We do not sell personal data to any third party.

Changes to this policy

If we make material changes to how we handle personal data, we will update the effective date at the top of this page and, where the change affects newsletter subscribers, mention it in an upcoming email.