RoxyAPI is an astrology, human design and forecast API operated as a GDPR data processor for EU products. Everything it stores sits in Germany, inside the European Union, on every plan and for every customer. API request payloads, birth data included, are processed in memory and never written to disk. The Article 28 Data Processing Addendum, EU Standard Contractual Clauses included, and the dated subprocessor register have been published on every plan since July 2026: the free tier too, with no signature to wait for, no sales call and no price tier that unlocks them. The one third-country element, remote administration from India, is stated in the addendum and covered by those Clauses rather than left out; what that access can reach is account and usage records and operational logs, never the content of an API request, which is stored nowhere.
If you are evaluating RoxyAPI as a data processor, the three documents linked below are the authoritative ones and this page only routes you to them.
This page deliberately carries no figures, clause text, or contract terms. Retention windows, technical measures, transfer bases, and breach commitments live in the documents themselves so there is exactly one authoritative copy of each. Quote those pages, never this one.
Cache-Control: no-store header, committed in the addendum.Everything you submit to the API, together with your account, subscription, and usage records, is stored in Germany by our infrastructure provider, whose data centre holds its own ISO/IEC 27001 certification. That data at rest never leaves the European Union. Transactional email and optional social sign-in use providers outside the EU, each named with its role on the subprocessor register. This applies to every customer on every plan, not to EU customers only, so if you are an EU buyer you get EU residency by default and there is no regional tier to buy.
The content of an API request is processed in memory and never written to any database, log, or file. That includes birth date, birth time, name, coordinates, and any free-text question. When a request fails validation we record the error code and the names of the invalid fields, never the values you sent.
Our processor terms are published and included on every plan, with no signature required to rely on them:
It carries the Article 28(3) obligations, the processing description, the technical and organisational measures, the subprocessor terms, EU Standard Contractual Clauses, and the transfer information an EU controller needs for its own transfer impact assessment. If your procurement process needs a counter-signed copy carrying our full registered address and signatory, ask through the contact page.
The register is dated and names every provider with its legal entity, purpose, location, and transfer basis. It is published separately from the addendum on purpose, so a routine change to the list never edits the contract document you assessed. Only infrastructure providers are ever in the path of an API request; everything else on that page supports the website, email, or abuse handling and never receives a customer API request or response.
The addendum is written to the EU framework, and covers the UK and Swiss equivalents. Some countries outside it require their own transfer contract instead, in a fixed form published by the regulator that the receiving party signs and that cannot be edited. Where your law works that way, the addendum does not replace that contract.
Türkiye is the clearest example. Transfers out of Türkiye run on the standard contract published by the Personal Data Protection Authority (KVKK) under Board Decision 2024/959, and we sign it as the receiving party at no charge on any plan. Notifying the authority is a step we do not carry out, so tell us the signature date your own deadline needs and we will work to it.
If your regime prescribes something similar, ask through the contact page and name the instrument, and we will tell you whether we are able to sign it.
Because calculations are deterministic, computed responses are cached briefly on many endpoints. A cache entry is addressed by a cryptographic digest of the request and carries no account, name, or email.
You can switch that off per request. Send the standard Cache-Control: no-store header and the cache is skipped entirely, read and write:
curl -X POST https://roxyapi.com/api/v2/astrology/natal-chart \
-H "X-API-Key: YOUR_KEY" \
-H "Content-Type: application/json" \
-H "Cache-Control: no-store" \
-d '{"date":"1990-05-15","time":"14:30:00","latitude":40.7128,"longitude":-74.006,"timezone":"America/New_York"}'The response carries X-Cache: BYPASS so you can assert it in your own tests. Available on every plan and committed in the addendum.
It covers what we collect for your account, what the usage logs contain, retention, and how to exercise data subject rights. Because we hold no identifier linking an API request to a named individual, an access or erasure request about an end user is normally a no-op on our side.
RoxyAPI operates as a data processor under the GDPR: its servers, database and cache are in Germany, API payloads are never written to disk, and the Article 28 Data Processing Addendum with the EU Standard Contractual Clauses applies on every plan. The remote administrative access from India is disclosed in the addendum as a restricted transfer and covered by those Clauses; it reaches operational logs and account and usage records, never the content of a request.
In Germany, inside the European Union, on every plan and for every customer. Account, subscription and usage records are stored there; the content of an API request is processed in memory and stored nowhere. Transactional email and optional social sign-in use providers outside the EU, each named with its role on the subprocessor register.
Yes. The Article 28 Data Processing Addendum has applied on every plan, including the free tier, since July 2026. There is no signature to wait for and no tier that unlocks it; a counter-signed copy is available on request.
Birth data is processed in memory in Germany and never written to disk, so there is nothing at rest to move. The infrastructure is administered from India under the EU Standard Contractual Clauses. That access reaches account and usage records (endpoint, status, timing, IP address, error code and the names of invalid fields) and operational logs, never a request body.
Yes. Send the standard Cache-Control: no-store header and the cache is skipped for that request, read and write; the response carries X-Cache: BYPASS. Available on every plan and committed in the addendum.
The Data Processing Addendum, the subprocessor register and the privacy policy. Each is dated and published separately, so a routine change to one never edits the others.
Hi, I am Rosie, your guide to the RoxyAPI insight tools.
Ask me to read your birth chart, pull a card, or map your numbers, and I will interpret what it means for you. Unlike most AIs, I never make the numbers up: every reading runs on real, verified calculations. Curious about the API, pricing, or docs instead? Ask me that too.