Last updated: June 28, 2026
AstraMedia ("we," "our," or "us") values your privacy. This Privacy Policy explains how we collect, use, store, process, and share your personal data when you use our services, in compliance with the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA), and other applicable data protection laws. By using our services, you agree to the terms described here.
The data controller responsible for your personal data is:
Astra Intelligence Labs
(providing the AstraMedia service)
Email: contact@astramedia.app
Privacy inquiries: contact@astramedia.app
We do not currently have a statutory Data Protection Officer (DPO). For all data protection matters, please contact us at contact@astramedia.app. We will respond within the timeframes required by applicable law.
We collect the following categories of personal data:
If you choose to connect your Gmail account to AstraMedia, we may access Gmail data only after you explicitly authorize access through Google's OAuth consent process. See Section 7 below for detailed information about Google API data handling.
We use cookies and similar storage technologies to provide, secure, and improve our service. Our Cookie Consent Manager (powered by Cookiebot, with a standalone fallback) allows you to control how cookies are used. Consent categories:
| Category | Purpose | Examples | Consent Required |
|---|---|---|---|
| Necessary | Essential for the website to function. Cannot be disabled. | Session cookies, CSRF/XSRF-TOKEN cookies, Cookiebot consent cookie | Always active (no consent needed) |
| Preferences | Remember your settings and preferences. | Language preference, UI customization | Your consent |
| Statistics | Analytics and performance measurement. Enables GA4 tracking. | Google Analytics 4 (_ga, _gid, _gat), funnel analytics (localStorage) | Your consent |
| Marketing | Advertising and social media tracking. | TikTok Pixel, cross-subdomain acquisition cookie (astra_acq) | Your consent |
Third-party cookies:
You can change your cookie preferences at any time by clicking the "Cookie Settings" link in the footer of our website. You may also configure your browser to reject cookies, but this may affect the functionality of our service.
We process your personal data for the following purposes and on the following legal bases under the GDPR:
| Purpose | Data Categories | Legal Basis (GDPR Art. 6) |
|---|---|---|
| Providing our service (account creation, authentication, feature delivery, AI-powered outreach tools) | Account data, user-created content, Google Gmail data (with authorization) | Performance of a contract (Art. 6(1)(b)) — processing necessary to deliver the service you signed up for |
| Processing payments and managing subscriptions | Billing data | Performance of a contract (Art. 6(1)(b)) |
| Customer support and communication | Account data, communications | Performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) — to respond to your inquiries |
| Analytics and service improvement (GA4) | Usage data, device data | Consent (Art. 6(1)(a)) — via Cookiebot consent banner (statistics category) |
| Marketing and advertising (TikTok Pixel, acquisition cookies) | Marketing data, usage data | Consent (Art. 6(1)(a)) — via Cookiebot consent banner (marketing category) |
| Security, fraud prevention, and abuse detection | Account data, usage data, device data | Legitimate interests (Art. 6(1)(f)) — protecting our service and users against security threats |
| Legal compliance (record-keeping, responding to lawful requests) | Account data, communications, billing data | Legal obligation (Art. 6(1)(c)) |
| AI-powered features (drafting, summarization, workflow automation) | User-created content, Google Gmail data (with authorization) | Performance of a contract (Art. 6(1)(b)) — core feature of the service you requested |
Legitimate interests explained: Where we rely on legitimate interests (Art. 6(1)(f)), we have balanced our interests against your rights and freedoms. Our legitimate interests include: operating and maintaining a secure service, preventing fraud and abuse, improving our product, and responding to customer communications. You have the right to object to this processing at any time (see Section 9).
Consequences of not providing data: If you do not provide the personal data requested at registration (name, email), we cannot create your account and you cannot use our service. If you decline statistics or marketing cookies, our service will still function, but we will not track your activity for analytics or advertising purposes. If you decline necessary cookies, the website may not function correctly.
We do not sell or rent your personal information or Google user data to third parties. We may share information only in the following limited circumstances:
We engage trusted third-party service providers who process personal data on our behalf:
We may share data if required by law, legal process, or governmental request, or to protect the rights, property, or safety of AstraMedia, our users, or others.
If AstraMedia is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you of any change in ownership or data controller.
Your personal data may be transferred to, and processed in, countries outside the European Economic Area (EEA) or the United Kingdom, including the United States. When we transfer your data internationally, we ensure an adequate level of protection through one or more of the following safeguards:
To obtain a copy of the relevant safeguards, please contact us at contact@astramedia.app.
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Specific retention periods:
| Data Category | Retention Period | Rationale |
|---|---|---|
| Account data (name, email, profile) | Duration of your account + 90 days after account deletion (for legal compliance) | Performance of contract; legal obligations |
| Billing records | 7 years (tax/accounting legal obligation) | Legal obligation (revenue/tax records) |
| User-created content (drafts, campaigns, media kits) | Duration of your account; deleted within 90 days of account deletion | Performance of contract |
| Google Gmail data (retrieved via OAuth) | Only for the duration necessary to perform requested functionality; not permanently stored | Performance of contract; Google API Limited Use requirements |
| Analytics data (GA4) | Google Analytics default: 14 months for user-level data; aggregated reports retained indefinitely | Consent (statistics) |
| Cookie consent records | Duration of cookie lifetime (up to 12 months) or until consent is withdrawn | Legal obligation (ePrivacy, GDPR) |
| Communication records (support tickets, emails) | 3 years from last contact | Legitimate interests (customer service quality) |
| Funnel analytics (localStorage) | Client-side only; cleared when browser storage is cleared; maximum 200 events stored | Service functionality |
| Acquisition cookie (astra_acq) | 7 days | Consent (marketing) |
You may request earlier deletion of your data at any time (see Section 9 — Your Rights).
If you choose to connect your Gmail account to AstraMedia, AstraMedia may access Gmail data only after you explicitly authorize access through Google's OAuth consent process.
Depending on the permissions you grant, AstraMedia may access Gmail message content, message metadata, sender and recipient information, subject lines, timestamps, labels, attachments, drafts, and related Gmail information.
Gmail attachments are accessed only when necessary for user-requested functionality and are not permanently stored unless the user intentionally saves, uploads, or incorporates the attachment content into AstraMedia.
AstraMedia uses Gmail data only to provide Gmail-related features requested by you, such as reading relevant emails, summarizing email content, generating draft responses, creating drafts, sending emails, applying labels, updating message status, organizing messages, archiving messages, or performing other user-requested mailbox actions.
AstraMedia may modify Gmail messages only to perform user-requested actions, such as applying or removing labels, marking messages as read or unread, archiving messages, or updating draft-related message state.
AstraMedia will not send emails from your Gmail account unless you intentionally initiate or approve that action within the product.
AstraMedia's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
AstraMedia does not use Google Workspace API data, Gmail data, Google account data, or other Google user data obtained through Google APIs to develop, improve, or train generalized artificial intelligence or machine learning models.
Google user data is not used for advertising, behavioral profiling, or any purpose unrelated to providing the functionality requested by the user.
AstraMedia uses artificial intelligence systems to provide user-requested functionality such as drafting, summarization, email assistance, workflow automation, contact research, and other productivity features.
User content and Google user data may be processed by AI systems solely to provide the functionality requested by the user.
Automated decision-making (GDPR Art. 22): AstraMedia does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. AI-generated drafts, summaries, and suggestions require your review and approval before any action is taken. We will notify you if this changes.
Under the GDPR and UK GDPR, you have the following rights regarding your personal data:
| Right | Description | GDPR Article |
|---|---|---|
| Right of Access | Request a copy of the personal data we hold about you. | Art. 15 |
| Right to Rectification | Request correction of inaccurate or incomplete data. | Art. 16 |
| Right to Erasure ("Right to be Forgotten") | Request deletion of your personal data when it is no longer necessary, you withdraw consent, or you object to processing. | Art. 17 |
| Right to Restriction of Processing | Request that we restrict how we process your data (e.g., while a correction is verified). | Art. 18 |
| Right to Data Portability | Receive your data in a structured, commonly used, machine-readable format (e.g., JSON) and transmit it to another controller, where processing is based on consent or contract and carried out by automated means. | Art. 20 |
| Right to Object | Object to processing based on legitimate interests (including analytics), direct marketing, or processing for scientific/historical research. We will stop unless we demonstrate compelling legitimate grounds. | Art. 21 |
| Right to Withdraw Consent | Withdraw your consent at any time where we rely on consent as the legal basis. Withdrawal does not affect the lawfulness of processing before withdrawal. | Art. 7(3) |
| Right to Lodge a Complaint | Lodge a complaint with your local data protection supervisory authority if you believe we have violated data protection laws. | Art. 77 |
How to exercise your rights: Submit requests to contact@astramedia.app. We will respond within 30 days (extendable by up to 60 days for complex requests). We may require proof of identity before processing your request. Most rights are exercised free of charge; we may charge a reasonable fee for manifestly unfounded or excessive requests.
Supervisory authority: If you are in the EEA, you have the right to lodge a complaint with your national data protection authority (e.g., the Irish DPC, the UK ICO, or the relevant authority in your member state). Contact details for EEA DPAs are available at https://edpb.europa.eu. The UK supervisory authority is the Information Commissioner's Office: https://ico.org.uk.
Additional rights for California residents (CCPA): If you are a California resident, you have the right to know what personal information we collect, disclose, or sell (we do not sell personal information), to request deletion, to opt out of sales (we do not sell data), and to non-discrimination for exercising your CCPA rights. To exercise your CCPA rights, contact us at contact@astramedia.app.
We use administrative, technical, and organizational safeguards designed to protect personal information and Google user data from unauthorized access, disclosure, alteration, or destruction.
These safeguards may include access controls, encryption (TLS in transit, encryption at rest where applicable), secure token storage, monitoring, and other measures appropriate to the nature of the data we process.
No security measure is 100% effective. If you have reason to believe your interaction with us is no longer secure, please notify us immediately at contact@astramedia.app.
If we change how we use Google user data or personal data, we will:
We encourage you to review this Privacy Policy periodically. Material changes will be notified at least 30 days before taking effect where feasible.
AstraMedia is not intended for children under 13 years of age (or under 16 in the EEA), and we do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child without parental consent, we will delete it promptly.
If you have questions about this Privacy Policy, wish to exercise your data protection rights, or would like to request access, correction, or deletion of your data, please contact us:
Email: contact@astramedia.app
Subject line: "Privacy Request" for data rights inquiries
Data Controller: Astra Intelligence Labs (providing the AstraMedia service)