Privacy notice

AstroWorks FZE LLC, registered in the United Arab Emirates, runs astroware.ai and console.astroware.ai. For anything about your data, email core@astroware.ai.

Our representative in the EU under Article 27 of the GDPR is Complico Consulting GmbH, Bahnhofstr. 12, 63549 Ronneburg, Germany, info@complicoconsulting.com. You can contact them instead of us, or as well as us, about anything to do with your data.

When you send a form, we keep what you type in it:

• Contact form: name, email, company and message.
• Trial requests sent through our earlier form: name, work email, company, role, what your AI feature does, where your users are, what you would like to test and, if you add it, your company website.

We also keep your IP address, the country it points to, your browser's user agent, the page you sent the form from, the campaign tags in that page's address, and the site that linked you to it.

• To reply to you.
• To set up a free trial you asked for. If you later share sample outputs with us, we first agree with you how they are shared.
• To stop spam and misuse of the forms.
• To learn which pages and campaigns bring enquiries.

Taking steps you asked for before a possible contract, and our legitimate interest in answering business enquiries and keeping the forms safe. The sections below give the basis for accounts, support and prospective customers.

When you use our console, we process your work email, optional name, company name and email domain, account creation and last-use information, and sign-in and session records. We also keep the names and identifiers of your API keys, a one-way fingerprint and shortened display of each key, its status, and your company's budget and usage totals.

Several people from one company can share an account. When joining is switched on, anyone with a verified work email at the company's domain, or at a subdomain of it, can join the account by signing in. While joining is switched off, we add a colleague only with the agreement of an owner of the account. Everyone in the account can see the others' names (if given), email addresses, roles and the dates they joined. All of them can also see the company's list of keys (never a full key), its usage and its budget. An owner can remove someone, and anyone except the last owner can leave. Either way, they are signed out and their user record is deleted from our live systems. This does not remove security and account-action records that mention them. Keys they created, and the names they gave them, stay with the company. The keys are revoked when the person is removed or leaves, and an owner can restore any of them. We try to email the account's owners when someone leaves or is removed. The email does not name the person.

Usage records are linked to your company's account. They include the time of a call, how long it took, whether it worked, the key's identifier and name, the model, token counts, calculated cost, internal reference numbers and the name of the client software exactly as your software sends it (the User-Agent text). We use these records to operate the service, show usage, apply budgets and investigate problems. We keep security and account-action records, including event time, action, outcome and limited account or operator identifiers, to prevent abuse and investigate incidents.

Text you send to the API is held in memory to answer it. The model server may keep a processed form of it in memory until that server restarts. It is not saved in any log, file or database.

We use Google Workspace to send sign-in links and account notices. Our legitimate interests are enabling authorised company access, managing the business relationship and preventing misuse. We need a work email and company-domain information to create and secure your account; without them you cannot sign in. Your name is optional.

The API and console application logs are configured not to retain visitors' IP addresses. Network providers still process connection information, and administration logs can record the addresses of administrators and of automated login attempts, for about five weeks. To limit request rates, the console holds a visitor's IP address in memory until the server restarts. It is not written to logs or a database.

We use first-party cookies to keep you signed in and operate the email-link sign-in flow. The session cookie contains a random session token; the sign-in flow also briefly stores the email address you entered and the time a sign-in email was sent.

A session expires after 14 days without activity and no later than 30 days after it begins, or when you sign out. The email and resend-time cookies expire after 15 minutes; the email cookie expires sooner after a refused sign-in. These cookies serve authentication and security purposes. We do not use console cookies for advertising or cross-site tracking.

When you ask for help, we process your contact details, company or account information, message, time and our replies. Messages sent through the console are delivered to our support mailbox through Google Workspace, and we reply by email. You can also write to core@astroware.ai.

We use this information to answer your request, resolve problems and protect the service. Our basis is our legitimate interest in providing and documenting support.

Please do not include passwords, API keys or personal information about other people. We do not forward support-message text to Telegram. We delete your support messages and our replies when you ask.

We research people whose professional responsibilities may be relevant to our business services. We may collect your name, employer, job title, published work contact details, professional profile, source links, relevant business notes, and records of our messages and your replies. Sources include company websites, public professional profiles such as LinkedIn, and information you give us directly.

We use this information to assess whether our services may be relevant, prepare and review business communications, manage follow-ups and record contact preferences. We rely on legitimate interests in relevant business development where permitted, and comply separately with the marketing rules applicable to the message and recipient.

We use AI services from providers in the United States to research prospects and to prepare and review messages. They work under their business terms, which include the EU standard contractual clauses for transfers.

You can object to direct marketing at any time by replying to a message or emailing core@astroware.ai. We will stop marketing to you, including associated profiling. We keep a limited suppression record so that we do not contact you again against your preference.

We count visits with Cloudflare Web Analytics. It does not use cookies and does not track you across other sites.

Our hosting provider also records technical details of each request to our site, such as the time, the page address (including any campaign tags), your network address, your country and your browser. It keeps these sampled records for at least a month, under its own retention rules, which we cannot change. We can see them in our account. We use them to run and protect the site.

We also count clicks on the links we share on social media, in newsletters and in messages. Our counter keeps only daily totals per channel, campaign and page, with no IP address and no cookie. Like any request to our site, a click also appears in our hosting provider's request records, described above.

• Cloudflare, which hosts this site, stores form submissions, counts visits, keeps request records and runs the risk screening tool's and the Red Lines box's bot checks.
• Google Cloud, which hosts our API, console, and account and usage records, in the EU (the Netherlands and Belgium). It also runs the guard model that answers requests typed into the Red Lines box.
• Google Workspace, which sends sign-in links and account notices and carries support email; and Google's calendar, which runs our booking calendar when you book a call.
• AI service providers in the United States, which process text for the risk screening tool and help us research prospects and prepare and review sales messages.
• An AI service provider in Germany, which scores the replies in test runs in the EU. Under its terms, it deletes what we send it once it has returned its score.
• Telegram, which carries an internal alert to our team when a form arrives. The alert holds the form type and company name only, never your name, email or message.

• Website forms: we delete form submissions automatically 12 months after you send them, or sooner if you ask. If we start working together, what that work needs is kept in our customer records.
• Accounts: we keep company and user information while the account is active. We delete a person's user record from our live systems when they leave or an owner removes them, and the company's information when the account is deleted. This does not remove security and account-action records.
• Security and account-action records: deleted 24 months after they are made. They include a short record of each test-run approval: a scrambled form of the approving owner's email, the time, the company and the versions of the approval text and the Terms. These records stay after an account is deleted, so that we can show a run was approved.
• Usage: per-call records, error records and daily summaries are deleted after 90 days.
• Sign-in: email links expire after 15 minutes. Sessions expire as described under console cookies.
• Support: we delete support correspondence 12 months after the last substantive exchange, or sooner if you ask.
• Prospects: we delete inactive prospect records 12 months after collection or the last meaningful two-way business contact. An unanswered message from us does not restart that period. We keep only the suppression information needed to respect an objection.
• Red Lines box: we save no text in any log, file or database. Usage records are deleted after 90 days. The per-network counter is kept for one hour and deleted when the next request arrives after that. Our hosting provider's request records are kept at least a month under its own rules.
• Test runs: approval records, scorecards and per-test results are deleted 30 days after the run is requested, or sooner if you ask. A short record of the approval is kept with the security records (above). We do not keep your assistant's replies or your key after the run.
• Backups: deleted account information, usage records and test-run records can remain in restricted backups for up to 7 more days before they expire.

When you check a website, we read its public pages. To answer the tool's questions, we send the text of those pages, or the one-sentence description you type, to an external AI service provider that processes it on our behalf. We do not store the page text or your description ourselves. Our AI service provider and our hosting provider may process this information outside the European Union.

To prevent abuse, our hosting provider runs a bot check when you start a check, and we count checks from each network for one hour, using a scrambled, shortened version of the network address that is deleted after the hour. We use this information only to give you the result you asked for and to protect the tool from abuse. These are our legitimate interests under the GDPR (Article 6(1)(f)).

When you type a request into the box, the page sends it to HaloGuard EU, our guard model. HaloGuard EU runs on Google Cloud in the EU (the Netherlands and Belgium). The answer, allowed or blocked and a policy name, comes back to your browser.

Please do not type personal data about yourself or anyone else. Do not type passwords or API keys.

We do not save what you type in any log, file or database. Our servers hold it in memory to answer it. The model server may keep a processed form of it in memory until that server restarts. We do not send it to any other AI provider.

For each request, our guard keeps a usage record without the text. It includes the time, how long it took, the number of tokens, whether it worked and the cost. The record does not hold your network address, your browser details or anything you typed. It is deleted after 90 days. We also keep totals of how many requests were tried, allowed or blocked, per day and per minute. The totals hold no text and nothing that identifies you.

To keep the box safe from abuse, our hosting provider runs a bot check when you use it. We also keep a counter for each network, made from a scrambled and shortened version of the network address, to limit how often the box can be used. It is kept for one hour and deleted when the next request arrives after that.

Our hosting provider carries your request to our server, so it may process the request in transit outside the EU. Our hosting provider may pass your network address to our server together with your request. We do not store it. Like any request to our site, a use of the box also appears in our hosting provider's request records, described above.

We use this information only to show you the answer you asked for and to protect the box from abuse. These are our legitimate interests under the GDPR (Article 6(1)(f)). The answer can be wrong. It is not a decision about you and it is not legal advice.

When your company asks us to test its AI assistant, an owner of your company's account gives us the assistant's web address (endpoint), its model name and an API key, and approves the run. We keep a record of that approval: your company's name and email domain, the approving owner's name (if given) and email, the assistant's name and, if given, its short description, and which version of the approval text they saw. The record does not hold the approver's network address or the key.

During the run, our server sends our test requests to your assistant and collects its replies. Please point us at a test setup that holds no personal data (our Terms, section 7.6).

Your API key: we use it only for the run. It is held in memory, never written to disk, and deleted when the run ends, also if it fails, and at the latest after 65 minutes. While a run is under way, our authorised administrators can technically access it. That access is limited to running and securing the service. Revoke the key after the test.

Your assistant's replies: our server holds them in memory during the run. We do not keep them after the run. To score them, we send each reply, with the test request and the conversation that led to it and a description of the area tested, to an AI service provider in the EU. We do not add your company's name, your API key or your endpoint address to what we send for scoring. A reply can itself contain personal or confidential information. We do not screen replies before scoring, so the test setup must hold no personal data and use no live data sources. Under its terms, the provider deletes what we send it once it has returned its score.

What we keep: the approval record, the scorecard and an internal table of results per test. We delete them automatically 30 days after the run is requested, or sooner if you ask, if you delete the run, or if your company's account is deleted.

The run takes place on our server in the EU (the Netherlands), and the scoring also takes place in the EU. Test content must not include personal data. If we find or reasonably suspect personal data in a run, we stop it and follow the steps in our Terms (section 7.14). Stopping a run cannot recall material already sent to the provider.

We use the approver's name and contact details, the approval record and the account and security details needed to run the test your company asked for, to show your company the results and to keep a record of who approved each run. For these, our legal basis is our legitimate interests under the GDPR (Article 6(1)(f)): providing and securing the service, and recording authorisation. Test content itself must not contain personal data.

You can ask to see, correct or delete your data, to restrict how we use it, or to receive a copy you can take elsewhere. You can also object to how we use it, including direct marketing. Email core@astroware.ai. If you are in the EU or UK, you can also complain to your data protection authority.

Last updated: 24 October 2026.