Privacy Policy & Data Protection Statement

1. Introduction & Corporate Identity

This Privacy Policy explains how Astrya ("Astrya Technologies", "we", "us", or "our") collects, processes, stores, protects, and discloses personal data and business information when you use our websites, web applications, APIs, and customer relationship management (CRM) software services (collectively, the "Service").

We are committed to operating with complete transparency, preserving customer confidentiality, and respecting individual privacy rights across all jurisdictions in which we operate, including Bangladesh, the European Economic Area (EEA), the United Kingdom, and the United States.

2. Roles: Data Controller vs. Data Processor

Under international data protection frameworks, including the EU/UK GDPR:

• Astrya as a Data Controller: We act as a Data Controller for personal data that you provide directly to us to create, authenticate, administer, and bill your account (such as your full name, business email address, phone number, workspace settings, login security logs, and subscription invoices).
• Astrya as a Data Processor (Service Provider): For all customer inquiries, prospective client records, sales leads, campaign performance data, conversations, and custom pipeline records that you or your authorized users upload, import, or synchronize into Astrya from third-party advertising networks (including Google Ads and Meta Lead Ads), you (our Customer) are the Data Controller, and Astrya acts strictly as a Data Processor on your documented instructions.

3. Categories of Information We Collect

We only collect data necessary to provide and continuously safeguard our advertising attribution and CRM services:

• Account & Workspace Identification: Your full name, work email address, telephone number, business name, physical address, industry, time zone, workspace profile, and team role assignments.
• Client & Lead Management Data (Customer Data): Prospective lead contact details (names, verified phone numbers, email addresses, cities/locations), lead source channels (Google Search, Meta Ads, WhatsApp, CSV import, website forms), custom qualification answers (e.g. project preferences, budgets, timelines), pipeline stages, deal values, and team communication notes.
• Advertising Network Telemetry & Metrics: Aggregated and campaign-level metrics retrieved via authorized APIs, including campaign IDs, names, cost/spend, impressions, clicks, daily conversion counts, customer lifetime spend totals, and currency codes.
• Security, Technical & Audit Logs: IP addresses, device identifiers, user-agent strings, timestamps of account access, and a tamper-proof audit trail of administrative modifications to maintain tenant integrity and detect abuse.
• Authentication Credentials: Time-sensitive, one-time verification tokens sent via email or SMS. These tokens are stored solely in cryptographically hashed format (never plaintext) and expire automatically.
• Marketing Attribution for Our Own Website: When you arrive at Astrya's public website from an advertisement, a search result or a link, we record the campaign parameters in that link (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the advertising click identifier where one is present (Google's gclid, Meta's fbclid), the referring website and the first page you landed on. This is held in your own browser for up to 90 days and is attached to your record only if you submit an enquiry or create an account. We keep the first such visit rather than the most recent one, so that the source which actually introduced you is the one credited. This tells us which of our own advertisements bring us customers; it is not used to build a profile of you, is never sold, and is never combined with any customer's lead data.

4. Lawful Bases for Processing (GDPR Article 6)

We process personal data only when an established lawful basis applies:

1. Performance of a Contract (Art. 6(1)(b)): To provide the CRM platform, manage multi-tenant workspace routing, sync connected advertising data, and process lead assignments.
2. Legitimate Interests (Art. 6(1)(f)): To detect and prevent fraud, secure multi-tenant database isolation, prevent unauthorized access, and optimize application performance.
3. Legal Obligations (Art. 6(1)(c)): To retain financial and transaction records for tax compliance, accounting, and lawful law enforcement requests under applicable statutory law.
4. Explicit Consent (Art. 6(1)(a)): Where you explicitly authorize third-party OAuth connections (Google Ads, Meta Business) or request optional marketing updates. You may withdraw consent at any time.

5. Measuring Our Own Advertising

On our public website, we ask before loading optional measurement tags. If you allow analytics, Google Analytics 4 may measure site visits through Google Tag Manager. If you allow advertising, the Meta Pixel may measure visits and conversions through the same container. You can reject both choices or change them later using Cookie settings in the website footer. Our consent cookie stores your choices for up to 180 days; first-visit campaign details held in your browser expire after 90 days.

Astrya advertises itself on Meta and Google. So that we can tell which of those advertisements lead to a real subscription rather than merely a form submission, we report a small number of events about our own customers back to those platforms through their conversions interfaces: that an account was created, that a demo was requested, that an advertising account was connected, and that a subscription began or lapsed.

Where an identifier is needed to match the event, we send your email address only as an irreversible SHA-256 hash, never in readable form. We do not send names, telephone numbers, lead records, campaign figures or anything belonging to your clients. This concerns only Astrya's relationship with you as our customer, and is entirely separate from the conversion reporting you may configure for your own advertising inside the product, which uses your own dataset and your own data.

If you would prefer we did not include you in this measurement, write to privacy@astryapro.com and we will exclude your account.

6. Google API Services User Data & Limited Use Disclosure

Astrya integrates with the Google Ads API to retrieve advertising performance data and enable offline conversion imports.

If you connect Google Sheets, Astrya creates a spreadsheet in your Google Drive and can only see and edit the spreadsheets it created.

Specifically, in adherence to the Limited Use requirements:

• We only request the Google scopes each feature needs: https://www.googleapis.com/auth/adwords to read campaign performance, https://www.googleapis.com/auth/datamanager to send the offline conversions you choose to report, and https://www.googleapis.com/auth/drive.file for the spreadsheets Astrya creates when you connect Google Sheets.
• We do not sell, rent, or transfer any Google user data or ad telemetry to external third parties, data brokers, or advertising networks.
• We do not use Google user data to serve retargeted, behavioral, or interest-based advertisements to you or any third party.
• We do not use Google API data to train generalized artificial intelligence (AI), machine learning (ML), or large language models (LLMs).
• OAuth refresh tokens provided by Google are encrypted at rest using industry-standard AES-256 encryption with isolated cryptographic keys and are never exposed to browser clients.
• You can revoke Astrya's access to your Google account at any time either via our Integrations settings or directly within your Google Security Settings.

7. Meta (Facebook & Instagram) Platform Data & WhatsApp Cloud

When you connect Meta accounts (Facebook Pages, Instagram Accounts, Meta Lead Ads, or WhatsApp Business), we process data strictly in compliance with the Meta Platform Terms and Developer Policies:

• Lead Ads Synchronization: Lead data submitted via Facebook Instant Forms is ingested into your isolated workspace in real time and is accessible solely by your designated organization members.
• WhatsApp Messaging: Communications sent to leads via WhatsApp must be conducted in strict compliance with WhatsApp Business Messaging Policies. Businesses must possess verifiable opt-in consent before initiating contact.
• No Unauthorized Sharing: Meta user data is never commingled with other organizations, sold, or utilized for profiling outside your explicit CRM instructions.
• Platform Deletion: When you disconnect Meta from Astrya, synchronization ceases immediately, and cached platform identifiers are scheduled for deletion.

7. User Data Deletion Instructions (Meta & International Standards)

In accordance with the Meta Platform Terms (Data Deletion Instructions URL requirement), GDPR Article 17 ("Right to Erasure"), and the CCPA, you have the absolute right to request the deletion of your personal data and all data associated with your Facebook, Google, or CRM activities.

To exercise your right to delete your data, you may choose any of the following methods:

Method A: Automated Disconnect via Astrya (Instant Sync Revocation)

1. Sign in to your Astrya account and navigate to Settings > Integrations.
2. Locate the connected provider (e.g., Meta or Google Ads) and click Disconnect.
3. All cached OAuth tokens are permanently erased immediately, background sync crons are cancelled, and new lead imports cease.

Method B: Remove the Astrya App from your Facebook Account

1. Log in to your Facebook profile and navigate to Settings & Privacy > Settings.
2. In the left sidebar, click Apps and Websites (or Business Integrations).
3. Locate Astrya in the list of active apps and click Remove.
4. Facebook will notify our systems and revoke all token access automatically.

Method C: Complete Organization & Account Deletion

1. Sign in as an Organization Owner and navigate to Settings > Data export & deletion (or Settings > Organization).
2. Under Delete Organization, confirm your organization name and click delete.
3. Access is terminated immediately for all team members. All client records, campaigns, leads, conversations, and files are permanently purged after a 30-day graceful safety window (designed to protect against accidental business destruction).

Method D: Direct Written Request & Data Deletion Tracking Portal

If you are an end-user whose data was submitted to one of our customers, or if you are unable to access your account:

• Submit a deletion request via our dedicated Data Deletion Request Page.
• Or email us directly at privacy@astryapro.com from the email address associated with your data.
• We reply to confirm the request, and remove the data from our live systems within thirty (30) calendar days. Encrypted database backups are kept on a rolling ninety (90) day cycle for disaster recovery and are overwritten as that cycle turns; deleted records are not restored from them.

8. Multi-Tenant Architecture & Technical Security Safeguards

We employ rigorous defense-in-depth security measures to protect your data against unauthorized access, loss, or alteration:

• Database Row-Level Security (RLS): Tenant isolation is enforced inside PostgreSQL itself, not only in application code. Every query runs as a restricted database role bound to one organization, so Organization A cannot read or write Organization B's records even if the application asks it to.
• Encryption in Transit: All communications are encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS) with strict HSTS headers.
• Encryption at Rest: All persistent database volumes, database snapshots, and sensitive access tokens are encrypted at rest using AES-256.
• Access Controls & Staff Auditing: Platform administrators do not see customer lead details in the course of normal operation. Support access to an organization is read-only, requires the organization's consent, and is written to an append-only audit log that the organization can read itself.

9. Sub-processors & International Transfers

We partner with vetted, enterprise-grade cloud service providers who act as sub-processors under strict contractual data protection agreements:

• Application Hosting & Edge Network: Vercel Inc. (serverless hosting and global CDN).
• Database: Neon Inc. — managed PostgreSQL running on Amazon Web Services infrastructure, encrypted at rest.
• Domain & DNS: Cloudflare, Inc. (authoritative DNS for astryapro.com).
• Transactional Email Delivery: Resend Inc. (sign-in codes and notification email).
• Business Email: Zoho Corporation (the mailbox that receives your messages to us).
• Encrypted Backups: GitHub, Inc. (nightly database backups, stored encrypted and privately).
• Telecommunication Gateways: Authorized BTRC-licensed SMS aggregators for one-time code delivery in Bangladesh.

Where data is transferred outside the European Economic Area or Bangladesh, such transfers are governed by European Commission Standard Contractual Clauses (SCCs) or equivalent cross-border transfer mechanisms to ensure an adequate level of data protection.

10. Your Rights Under Global Privacy Laws

For Residents of the European Economic Area and the United Kingdom (GDPR / UK GDPR):

• Right of Access (Art. 15): Request confirmation of whether we process your personal data and obtain a copy.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal records.
• Right to Erasure (Art. 17): Request permanent deletion of personal data ("Right to be Forgotten").
• Right to Restriction of Processing (Art. 18): Request that we restrict processing under certain conditions.
• Right to Data Portability (Art. 20): Receive your data in a structured, commonly used, and machine-readable format (CSV or JSON).
• Right to Object (Art. 21): Object to processing based on legitimate interests or direct marketing.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local EU/UK Data Protection Authority.

For Residents of California and the United States (CCPA / CPRA):

• Notice at Collection: We collect the categories of personal information listed in Section 3 for the business purposes described in Section 4.
• No Sale or Sharing of Personal Information: We have not sold and do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.
• Right to Know & Delete: You have the right to request disclosure of specific pieces of personal information collected and request deletion.
• Non-Discrimination: We will not discriminate against you (by denying services, charging different rates, or altering service quality) for exercising any of your CCPA/CPRA rights.

Under Bangladesh Legal Framework (Cyber Security Act 2023 & ICT Act 2006):

We comply with all applicable digital governance regulations in Bangladesh. We implement measures to prevent identity theft, unauthorized electronic access, and digital fraud. All digital records and electronic agreements made on the platform are recognized in accordance with Section 7 of the Information & Communication Technology Act 2006.

11. Children's Privacy (COPPA Notice)

Our Service is designed exclusively for commercial enterprises, marketing agencies, and business professionals. We do not knowingly solicit, collect, or process personal data from children under the age of 16. If we become aware that an individual under 16 has submitted personal information to us, we will immediately delete that information from our servers.

12. Updates to this Privacy Statement

We may update this Privacy Policy from time to time to reflect modifications in our service features, emerging technologies, or evolving legal requirements. When material changes occur, we will notify you via a banner within your workspace dashboard, through your registered account email, and by updating the "Effective Date" at the top of this document.

13. Contact Us About Your Data

If you have questions, feedback, or wish to exercise your data subject rights, write to the person responsible for privacy at Astrya: