Privacy Notice

1. Background

1.1 This notice (Privacy Notice) tells you how we look after your personal data when you visit our website at astrenian.com (Website), when you use Astrenian, together with everything we provide through it (Software), and when your personal data reaches us through someone else’s use of the Software, for example when you respond to something they have published, are invited or emailed through it, or open something they have shared. It also covers prospective customers and other business contacts, such as suppliers.

1.2 This notice sets out what information we collect about you, what we use it for and whom we share it with. It also explains your rights under data protection laws and what to do if you have any concerns about your personal data.

1.3 We may update this Privacy Notice from time to time, for example to reflect changes in how we provide the Software or in the law. If you have an account and a change affects how we use your personal data, we will tell you by email or in the Software before it takes effect. The date at the top of this notice shows when it last changed.

2. Who we are and other important information

2.1 We are ASTRENIAN LTD, registered in England and Wales with company number 16188105 with our registered address at 71-75 Shelton Street, London, WC2H 9JQ (we, us or our).

2.2 We are the controller of the personal data we use to run the Software and the Website, such as your account, your subscription and the security of our systems. This means we decide what information we collect and how it is used. Where you use the Software to collect or keep personal data about other people, for example responses you gather or people you invite, you decide what is collected and why, and we use it only to provide the Software to you, as set out in clause 13.4 of our Terms of Service.

3. Contact details

3.1 If you have any questions about this Privacy Notice or the way that we use information, please get in touch using the following details:

• Email address: info@astrenian.com
• Postal address: 71-75 Shelton Street, London, WC2H 9JQ

4. The information we collect about you

4.1 Personal data means any information which does (or could be used to) identify a living person. We have grouped together the types of personal data that we collect, and where we receive it from, below.

4.2 The types of personal data we collect:

• Identity and Contact Data: your name and email address, and how you sign in (an emailed code, or an account you hold with another provider).
• Account Data: your settings and preferences, such as your time zone, language and which notifications you receive and where, and any suspension of your account.
• Session and Technical Data: details of your signed-in sessions, such as the browser and operating system and when they were used, and the IP address and browser details of requests to the Software and the Website.
• Content Data: everything you create, upload, import or collect in the Software; information other people send you through it, such as their responses and any email address or files they include; and the email addresses of people you invite or email through it.
• Connected Account Data: when you connect an account you hold with another provider, the access it grants us and the data you bring in from it.
• Usage Data: a record of activity in your account, such as when items were created or changed, which you can see in the Software; counts of your use for limits; and when you were last active and which parts of the Software you used.
• Payment Data: your plan, your subscription status, the dates and amounts of your payments and your billing country.
• Communications Data: emails you send us, and records of emails we send, such as whether they were delivered.
• Security Data: records of activity that may be abuse or an attack, linked to an account or an IP address.

We receive this data from you; from people who use the Software, where their content includes you; from providers you choose to connect; from our merchant of record, for payments; and automatically from your browser when you use the Software or the Website (see our Cookie Notice).

4.3 Please note that we do not collect your payment card details. You give them at checkout to our merchant of record (section 6).

4.4 Connected services

When you connect an account you hold with another provider, we access only the data needed for what you choose to do with it. We do not sell this data, use it for advertising or use it to train artificial intelligence models. We only look at it where needed to provide the Software or keep it secure and working, when you ask us to help you with it, to act on a report or a suspected breach of our Terms of Service or Acceptable Use Policy, or where the law requires it.

Astrenian’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. How we use your information

5.1 We are required to identify a legal justification (also known as a lawful basis) for collecting and using your personal data. There are six legal justifications which organisations can rely on. The most relevant of these to us are where we use your personal data to:

• fulfil our contract with you;
• comply with a legal obligation that we have;
• pursue our legitimate interests (our justifiable business aims) but only if those interests are not outweighed by your other rights and freedoms (e.g. your right to privacy); and
• do something for which you have given your consent.

5.2 Below is set out the lawful basis we rely on when we use your personal data. If we intend to use your personal data for a new reason that is not listed below, we will update our Privacy Notice.

5.2.1 Contract

• To create and run your account and provide the Software to you, including storing, processing and showing Your Content (clause 8.5 of our Terms of Service), and doing what you ask with accounts you connect.
• To manage your subscription with our merchant of record.
• To send you emails about your account, your subscription and security, and the notifications you choose to receive.
• To help you when you contact us.

5.2.2 Legal Obligation

• To send you information the law requires us to give you, such as changes to our terms or to this notice.
• To respond to your requests about your personal data, and to lawful requests from authorities.

5.2.3 Legitimate Interests

We rely on our legitimate interests (or those of a third party) to process your data, provided your interests and fundamental rights do not override those interests. We process data for the following:

• Recognised Legitimate Interests (under the Data (Use and Access) Act 2025): where needed to prevent or detect crime, including fraud, or to protect someone, including a child, from harm.
• Other Legitimate Interests (always weighed against your rights): a) Security: keeping the Software, the Website and our systems secure, and detecting and stopping abuse, attacks and misuse of free trials; b) Reliability: making sure our emails arrive, including stopping emails to addresses that cannot receive them; c) Reports and Complaints: handling reports about content or activity, and complaints; d) Our Rights: enforcing our Terms of Service and Acceptable Use Policy, and establishing, exercising or defending legal claims; e) Corporate Transactions: to facilitate a sale, merger or restructuring of our business; and f) Improvement: understanding how Astrenian is used, by counting how many accounts are active and use each part of the Software, without looking at content.

5.2.4 Consent

• Where you allow your browser to show notifications from the Software. You can stop them at any time in the Software or in your browser.

We do not send marketing emails.

5.2.5 If you do not use Astrenian yourself

Where someone uses the Software to contact you or collect information from you, they decide what is collected and why (clause 2.2). Our own part, such as delivering an email to you and protecting you from abuse, relies on our legitimate interests.

5.3 If you do not give us the personal data we need to provide the Software, we may not be able to provide it.

5.4 We do not use analytics tools on the Software or the Website.

5.5 Some suspensions are made automatically, when the Software detects activity that breaches our Acceptable Use Policy. You can ask for a person to review a suspension (clause 15.2 of our Terms of Service).

6. Who we share your information with

6.1 We share your personal data with:

• The people who run Astrenian, who are bound by confidentiality.
• Microsoft, which runs sign-in and sends our emails (in its Europe region), hosts the Software and its data, and delivers the Software and the Website to you through its global network.
• Onelink, part of the Stripe group, the merchant of record for payments (clause 9.5 of our Terms of Service), which handles your payment details and the tax on your payments under its own privacy policy.
• Google, which hosts our email inbox at info@astrenian.com, so messages you send us are held there.
• Providers you choose to sign in with or connect, which confirm who you are or receive what you ask us to send them, under their own terms.
• Your browser’s maker, which carries notifications to your browser if you allow them. They are encrypted, so it cannot read them.
• Services whose content is embedded in the Software, such as videos, which your browser contacts directly when you view that content, under their own terms.
• People you share with, publish to or contact through the Software, as you choose.

We only share personal data in any other way where the law requires it, where needed to prevent crime or protect someone from harm (clause 5.2.3), with our accountants or lawyers when we need their advice, or with a buyer if Astrenian is ever sold, in which case we will tell you.

7. Where your information is located or transferred to

7.1 Your personal data, including backups, is stored in the United Kingdom.

7.2 Some of it is also processed outside the United Kingdom by the recipients in section 6, in the locations described there.

7.3 When your personal data is processed outside the United Kingdom, it stays protected as UK data protection law requires. We only allow this where:

7.3.1 Approved Destinations: the UK has found that the destination gives protection not materially lower than UK law. This includes the European Economic Area, and organisations in the United States certified under the UK extension to the EU-US Data Privacy Framework;

7.3.2 Appropriate Safeguards: the provider’s data protection terms include the International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses; or

7.3.3 At your request: you ask us to send it, for example to a provider you choose to sign in with or connect, as part of providing the Software to you.

7.4 You can ask us for a copy of the safeguards in clause 7.3.2 (section 3).

8. How we keep your information safe

8.1 We use appropriate technical and organisational measures to protect your personal data against loss, misuse and access by anyone who should not have it, including encrypting it when it travels over the internet and when it is stored. No system is completely secure, but we work to keep the risk as low as we reasonably can.

8.2 If a personal data breach affects you, we will tell the Information Commissioner’s Office, and you, where the law requires.

9. How long we keep your information

9.1 We keep personal data only for as long as we need it for the purposes in section 5, and then delete it:

• 9.1.1 Session and Technical Data and Security Data: within 30 days, or for a signed-in session, within 30 days after it ends.
• 9.1.2 Communications Data: records of emails we send, within 90 days (a record that an address cannot receive email is kept while the account it relates to exists); emails you send us, for as long as we need them to deal with what you asked.
• 9.1.3 All other personal data: while you have an account, unless you delete it or disconnect the account it came from sooner. Anything you delete is erased within 30 days. When your account ends, it is deleted as set out in clauses 14.2 to 14.4 of our Terms of Service.
• 9.1.4 Copies in our backups: deleted when the backups expire, within 12 weeks.

9.2 We keep personal data for longer only where the law requires it, or where we need it to establish, exercise or defend a legal claim (clause 5.2.3), and only for as long as that need lasts.

10. Your legal rights

10.1 In the circumstances the law sets out, you have the right to:

• 10.1.1 ask for a copy of your personal data and how we use it;
• 10.1.2 have it corrected if it is inaccurate or incomplete;
• 10.1.3 have it deleted;
• 10.1.4 ask us to limit how we use it; and
• 10.1.5 receive it in an electronic format, or have it sent to someone else.

10.2 You can object at any time to our use of your personal data where we rely on our legitimate interests (clause 5.2.3). We will stop unless we have compelling reasons to continue, or need it for a legal claim.

10.3 You can do much of this yourself in Settings: export Your Content and delete your account (clause 14.3 of our Terms of Service), and correct your name. For anything else, email us at info@astrenian.com. If you have an account, please email from its email address, so we can confirm it is you.

10.4 We will respond within one month of receiving your request, or of confirming your identity or receiving anything else we need to deal with it. If a request is complex, or you make several, we may take up to two more months and will tell you why.

10.5 We may refuse a request if we cannot confirm your identity, or if it is vexatious or excessive. For a vexatious or excessive request, we may instead charge a reasonable fee. If we do either, we will tell you why, and that you can complain (clause 10.7).

10.6 If your request is about personal data that someone else collects or keeps through the Software, they decide how it is used (clause 2.2), so we may pass your request to them.

10.7 If you are unhappy with how we use your personal data, please tell us first at info@astrenian.com. We will acknowledge your complaint within 30 days and respond without undue delay. You can also complain to the Information Commissioner’s Office (ico.org.uk) or, outside the United Kingdom, to the data protection authority where you live or work.