Privacy policy

Astra is operated by EcoSapienz (India). This policy explains what we collect when you use astra.ecosapienz.com, why, and the choices you have. It is written to meet the Digital Personal Data Protection Act, 2023 and the rules made under it.

What we collect

• Account data: your name, email address and sign-in provider identifiers, so you can sign in and we can contact you about the service.
• Business data you bring in: customers, vendors, products, documents, payments, messages and instructions that you or your team enter, import or connect. This includes personal data of your customers and staff (names, phone numbers, addresses, GSTINs).
• Usage data: pages visited, actions taken, device and browser type, and error logs, to keep the service working and secure.

How we use it

• To run the features you use: reading messages, drafting orders and reminders, computing GST, producing documents and briefs.
• To keep an audit trail of every change and every automated action, which you can inspect in Settings.
• To support you and to improve the product. We do not sell personal data and we do not use your business data to train models for other customers.

AI processing

Astra runs its AI features on a private model operated by EcoSapienz. Your messages and documents are processed to extract structured information and to draft text. Hosted speech-to-text or OCR services are off by default and only enabled if you switch them on in Settings; that page names the provider.

Your role and ours

For business data you bring into Astra, you are the data fiduciary for your customers and staff, and EcoSapienz processes it on your instructions. You are responsible for having a lawful basis to contact your customers, including for WhatsApp reminders. For your own account data, EcoSapienz is the data fiduciary.

Storage and security

Data is stored in Supabase (AWS Mumbai region, ap-south-1) with row-level access controls so that only members of your organisation can read it. Connections are encrypted in transit. Backups are kept by the hosting provider. Secrets for connectors are never shown back to you or logged.

Retention and deletion

Your data stays as long as your organisation exists. An owner can delete the organisation from Settings, which removes all its data within 30 days except records we must keep by law. You can export your data at any time.

Your rights

You may access, correct or erase your personal data, withdraw consent, and nominate someone to exercise these rights. Write to s.s@ecosapienz.com. We respond within 30 days. If unresolved, you may approach the Data Protection Board of India.

Cookies

We use only the cookies needed to keep you signed in and remember your preferences. No advertising trackers.

Changes

We will post changes here and update the date above. Material changes will be announced in the app.