Privacy Policy

This Privacy Policy explains how ASTROX TECHNOLOGIES LTD collects, uses, and protects personal data in connection with the AstroX platform and website, in compliance with UK GDPR and the Data Protection Act 2018 and, where applicable to customers or end-customers in the European Economic Area, the EU GDPR.

1. Who we are

AstroX is a trading name of ASTROX TECHNOLOGIES LTD (Company No. 16584933), registered in England and Wales. Registered office: Office 21432, 182-184 High Street North, East Ham, London E6 2JA, United Kingdom.

We are the data controller for personal data collected through our website and platform account management. For personal data your end-customers share through your AI agent (e.g., your shoppers' messages), we act as a data processor on your behalf — see our Data Processing Agreement.

If you are a shopper or end-customer of a business that uses AstroX and have questions about how that business handles your personal data, please contact that business directly. It is the data controller for your data, and its own privacy notice applies. We are not responsible for the privacy or data-security practices of our customers.

Our processing of personal data is subject to the UK GDPR and the Data Protection Act 2018 and is supervised by the UK Information Commissioner's Office (ICO). We have not appointed a formal Data Protection Officer (DPO) but have designated support@astroxtech.com as our data protection contact for all privacy-related enquiries.

Contact our data team: support@astroxtech.com

2. What data we collect and why

We collect personal data in the following contexts:

a) Website enquiries and contact forms

• Data: Name, email address, company name, message content.
• Legal basis: Legitimate interests (responding to your enquiry and operating our business).

b) Account registration and management

• Data: Name, business email, company name, billing address, password (hashed).
• Legal basis: Performance of a contract (to provide you with access to the service).

c) Billing and payment

• Data: Billing name, email, company, country. Payment card details are handled directly by Stripe — we do not store full card numbers.
• Legal basis: Performance of a contract; legal obligation (financial record-keeping).

d) Service usage and platform activity

• Data: Login timestamps, feature usage, AI agent configuration, conversation logs, integration data (e.g., Shopify store data, WhatsApp contact identifiers).
• Legal basis: Performance of a contract; legitimate interests (maintaining service quality and security).

e) Technical and analytics data

• Data: IP address, browser type, pages visited, error logs.
• Legal basis: Legitimate interests (security, performance monitoring, fraud prevention).

3. Cookies

We currently use only strictly necessary cookies and storage: session authentication and CSRF protection in the platform, security cookies set by our CDN provider, and local storage for remembering your settings and choices (such as dismissing the cookie notice). These are required for the site and platform to function and cannot be disabled.

We do not currently set analytics, tracking, or marketing cookies on our website or platform. A notice banner is displayed on your first visit to our website; your acknowledgement is stored in your browser's local storage so you are not asked again. You can reset this at any time by clearing your browser's local storage or site data. Because only strictly necessary cookies are currently used, no consent choice is required under UK PECR. If we introduce any non-essential cookies or similar technologies (including those set by embedded third-party content), we will update this policy and present you with a consent choice before they are set, as required by UK PECR and equivalent laws.

4. How we share data

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share data with the following categories of service providers (“subprocessors”) solely to operate the service:

• Cloud hosting: Server infrastructure with vetted cloud providers. The platform is multi-tenant: each customer's data is logically separated by tenant identifiers and access controls on shared infrastructure. Specific hosting regions are confirmed on request; where infrastructure is located outside the UK/EEA, the transfer safeguards in Section 5 apply.
• Payment processing: Stripe, Inc. (PCI-DSS compliant).
• AI model services: Third-party AI model providers (currently OpenAI) generate AI agent responses and translate conversations in the agent inbox. We engage them under business terms that prohibit the use of your data to train their models. Your end-customers' conversation data remains your data.
• Messaging channels: Meta Platforms (WhatsApp Business Cloud API delivery, under your own Meta Business account).
• Email delivery: Transactional email providers for account notifications.
• eCommerce integrations: Shopify (data accessed under your authorisation).
• Website delivery & security: Cloudflare, Inc. (CDN, DDoS protection, DNS — USA/Global).

We require all subprocessors to maintain appropriate data protection and security standards. The current list of subprocessors, with their purposes, locations, and transfer safeguards, is published on our Sub-processors page, which we update as our infrastructure evolves.

Legal and law-enforcement disclosures: We may disclose personal data where we believe in good faith that doing so is required by law, regulation, court order, or a lawful request of a public authority, or is reasonably necessary to investigate or prevent fraud, abuse, or a security threat, to enforce our terms, or to protect the rights, property, or safety of AstroX, our customers, or the public.

Corporate transactions: If we are involved in a merger, acquisition, financing, reorganisation, or sale of all or part of our business or assets, personal data may be disclosed to the parties involved (and their professional advisers) under confidentiality obligations and may be transferred to the successor business, which will continue to be bound by this policy. We will notify you of any such transfer where required by law.

5. International data transfers

Some of our subprocessors are based outside the UK and EEA, which means your personal data may be transferred internationally. The most significant transfer is described below:

• AI model providers (USA): When you or your end-customers interact with an AI agent on our platform, the message content (the text of the conversation) is sent to our AI model provider's servers in the United States to generate a response. This is a core part of how the AI service works. Our agreement with the provider prohibits use of that data to train its models. We rely on Standard Contractual Clauses (SCCs) as the transfer mechanism for this transfer.
• Cloudflare (USA/Global): Web traffic to our website passes through Cloudflare's network for delivery and security purposes. Cloudflare may process limited request metadata (such as IP addresses) internationally. We rely on SCCs for this transfer.
• Stripe (USA): Payment card data is processed by Stripe in the USA. Stripe is PCI-DSS compliant and relies on UK IDTA / SCCs.
• Cloud hosting: Where our server infrastructure is located outside the UK/EEA, platform data is stored and processed in that region under UK IDTA / SCC safeguards. Current hosting regions are available on request at support@astroxtech.com.

For all international transfers, we have verified that appropriate safeguards are in place under UK GDPR, including the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs) where applicable. You can request a copy of the relevant transfer mechanisms by contacting support@astroxtech.com.

6. Data retention

We retain personal data for as long as necessary to provide the service and meet our legal obligations:

• Account, billing, and security records (your registration details, billing records, payment history, security logs, and anti-fraud records): retained while your account is active and afterwards for as long as required to handle outstanding matters and meet our legal obligations, including 6 years from the end of the relevant accounting period for records required by HMRC (VAT Notice 700/21 and Corporation Tax rules).
• Conversation, agent handoff, and order history data (data we hold as data processor on your behalf): retained for the life of your subscription so you and your team can access your own history, then deleted after cancellation within the post-cancellation retention period for your plan as set out in Section 3 of our Data Processing Agreement, except where a longer period is required by applicable law or an active dispute.
• Contact/enquiry data: Retained for 12 months from last contact.

Important distinction: The post-cancellation deletion period applies to processor data (your end-customers' messages, contact details, and order history). It does not apply to controller data we hold in our own right, which we retain for the periods above. Encrypted backup copies may also persist for up to 30 days after a deletion event before being fully purged.

6A. Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including encryption in transit and at rest, access controls and tenant separation on our multi-tenant platform, logging, and the other measures described in Section 7 of our Data Processing Agreement. However, no method of transmission over the internet or of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for the security of the devices and networks you use to access the platform.

6B. Automated decision-making

The platform uses automated processing to operate the service — for example, to generate AI agent responses, route and prioritise conversations, translate messages, detect abuse or fraud, and apply usage limits. We do not make decisions about you that produce legal or similarly significant effects solely by automated means; any restriction or suspension of your account is subject to human review on request. Decisions affecting your end-customers (such as whether a return or refund is accepted) are made by you under the rules you configure, not by us.

6C. Links to other websites

Our website and platform may contain links to, or integrate with, third-party websites and services (including Shopify, Meta, and payment providers). We have no control over, and accept no responsibility for, the content or privacy practices of those third parties. Their own privacy notices apply to any data you provide to them.

7. Your rights under UK GDPR

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (subject to legal obligations).
• Restriction: Ask us to limit how we use your data in certain circumstances.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any right, email support@astroxtech.com with the subject line Privacy Request. We will respond within one month of receiving a valid request. Where a request is complex or we receive several from you, we may extend this by up to two further months as permitted by UK GDPR, and we will tell you within the first month if an extension is needed. We may ask you to verify your identity before acting on a request.

8. Marketing communications

We will only send you marketing emails if you have opted in. You can unsubscribe at any time by clicking the “Unsubscribe” link in any marketing email or by emailing support@astroxtech.com. Opting out of marketing does not affect transactional and account-related communications.

9. Data deletion request

To request deletion of your account and associated data, email support@astroxtech.com with the subject line Data Deletion Request and include your account email or company name. We will action a verified deletion request within one month, subject to the retention periods in Section 6 and any legal retention obligations. Data we hold as processor on behalf of a business customer is deleted on that customer's instruction under our Data Processing Agreement.

10. Right to complain

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the UK's data protection authority:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113

We would appreciate the opportunity to address your concerns directly before you contact the ICO, so please reach out to us first.

11. Children

Our website and platform are provided to businesses and are not directed at children under 16. We do not knowingly collect personal data from children for our own purposes; if we learn that we have done so, we will delete it. Where a business customer's end-customers include children, that business is the data controller and is responsible for any age-related consents and notices required by applicable law.

12. US state privacy disclosures

If you are a resident of a US state with a comprehensive privacy law (including California), the following applies in addition to the rest of this policy. In respect of end-customer data processed on behalf of our business customers, we act as a “service provider” or “processor” and process that data only on the customer's instructions; requests about that data should be directed to the relevant business. We do not sell personal information, do not share it for cross-context behavioural advertising, and have not done so in the preceding 12 months. You may exercise the rights described in Section 7 (including to know, access, correct, delete, and port your data) by contacting support@astroxtech.com; we will not discriminate against you for doing so, and an authorised agent may submit a request on your behalf with proof of authority.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by updating the “Last updated” date at the top of this page. Continued use of the service after the effective date constitutes acceptance of the updated policy.

Language and governing law: This policy is drafted in English, and the English text is the sole binding version; any translation or summary is for convenience only. It forms part of, and is governed by the same law and jurisdiction as, our Terms of Service (the laws of England and Wales, exclusive jurisdiction of its courts), without prejudice to any mandatory data-protection rights you have under UK GDPR or the EU GDPR.

14. Contact

For any privacy-related questions: support@astroxtech.com
ASTROX TECHNOLOGIES LTD (Company No. 16584933), registered in England and Wales.
Registered office: Office 21432, 182-184 High Street North, East Ham, London E6 2JA, United Kingdom.

Document History