Legal

Astro LLC Privacy Policy

Last updated: Nov 10, 2026

1Introduction, Scope, and Our Role

Astro LLC ("Astro," "we," "us," or "our") is a Minnesota limited liability company with its principal office at 10 S 5th St., Unit 1024, Minneapolis, MN. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information, and what choices and rights you have. Our Cookie Policy is part of this Privacy Policy and appears in Section 6. This Privacy Policy is effective as of the "Last updated" date above.

1.1What this policy covers

This Privacy Policy applies to personal information we handle through:

our websites, including astrocrm.ai and any related subdomains (the "Sites");
our cloud-based software platform, applications, application programming interfaces, and related tools (the "Platform");
our sales, marketing, events, onboarding, and customer support activities.

The Sites, the Platform, and all related services are together the "Services." The Services are designed for businesses and professionals. They are not intended for personal, family, or household use.

1.2Our two roles

We handle personal information in two different capacities, and your rights and our obligations depend on which one applies.

Astro as controller (or "business"). For information about our own website visitors, prospects, customers, and the authorized users of customer accounts ("Business Contact Data"), we decide why and how the information is processed. This Privacy Policy describes that processing.
Astro as processor (or "service provider"). Our customers use the Platform to store, send, and manage information about their own leads, clients, and other contacts, including the content of messages, call recordings, and transcripts ("Customer Data"). For Customer Data, the customer decides why and how the information is processed, and we process it only on the customer documented instructions under our written agreement with that customer.

1.3If your information is in a customer's account

If you are a contact, lead, or client of one of our customers, that customer is responsible for how your information is collected and used, and its privacy notice governs. We do not control those decisions. If you want to access, correct, delete, or restrict your information, or opt out of messages you receive through the Platform, please contact that customer directly. If you contact us, we will direct your request to the relevant customer where we can identify them, and we will help the customer respond as our agreement requires.

1.4Your agreement

By using the Services you acknowledge that you have read this Privacy Policy. If you do not agree with it, please do not use the Services. Use of the Services is also governed by our Terms and Conditions.

2Information We Collect

2.1Information you provide to us

Account and profile data: name, work email address, phone number, job title, company name, company size and industry, username, and password.
Billing data: billing name and address, tax identification details, and transaction history. Payment card details are collected and stored by our third-party payment processor. We do not store full card numbers.
Communications: the content of messages, forms, support tickets, chat transcripts, call recordings made for quality or training purposes, survey responses, and feedback you send to us.
Marketing and event data: your contact details and preferences when you request a demo, join a waitlist, subscribe to updates, download content, or register for an event or webinar.

2.2Information we collect automatically

Device and log data: IP address, browser type and version, operating system, device identifiers, language settings, referring and exit pages, date and time stamps, and error and crash reports.
Usage data: pages and features viewed, actions taken, settings selected, session length and frequency, and API call metadata.
Approximate location: general location inferred from your IP address.
Cookies and similar technologies: described in Section 6.

2.3Information from third parties

Integrations you enable: when you connect a third-party account (for example, an advertising, calendar, email, telephony, or payment account), we receive the information that account shares with us under the permissions you grant.
Single sign-on providers: basic profile details if you sign in using an identity provider.
Business partners: resellers, referral partners, and event co-sponsors who share business contact details with us.
Data and enrichment providers and public sources: business contact details, firmographic information, and publicly available professional information used for sales and marketing.

2.4Customer Data

Our customers may submit or collect Customer Data through the Platform, which can include contact names, email addresses, phone numbers, addresses, appointment details, message and chat content, call recordings and transcripts, form submissions, lead source and campaign attribution data, and notes. We process Customer Data as a processor on behalf of the customer, as described in Section 1.2.

2.5Sensitive information

We do not ask you to provide, and we do not intentionally collect for our own purposes, sensitive personal information such as government identification numbers, financial account numbers, health information, biometric data, precise geolocation, or information about race, religion, sexual orientation, or similar characteristics. Customers are prohibited from submitting those categories of data to the Platform unless our written agreement with them expressly allows it. Please do not send us sensitive information in support requests or other communications.

3How We Use Information

We use Business Contact Data and other information for which we act as controller to:

provide, operate, secure, maintain, and support the Services, including creating and managing accounts and authenticating users;
process payments, issue invoices, and manage subscriptions;
respond to requests, provide customer support, and communicate about service updates, security alerts, and administrative matters;
analyze usage, diagnose problems, measure performance, and develop, test, and improve the Services and new features;
send marketing communications about our products, events, and content, where permitted by law, with an opt-out in every message;
detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms and Conditions or Acceptable Use rules;
comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims;
evaluate or carry out a merger, acquisition, financing, reorganization, or sale of assets, as described in Section 5; and
create aggregated or de-identified data that does not identify you or any customer. We will not attempt to re-identify that data, and we will use it only in de-identified form.

We use Customer Data only to provide the Services to the relevant customer, as that customer instructs, and as our agreement with that customer and applicable law permit.

4Legal Bases for Processing (EEA, UK, and Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information as a controller only where we have a legal basis to do so. The list below describes the bases we rely on. Where we act as a processor, the customer is responsible for establishing the legal basis for processing Customer Data.

Providing the Services, managing accounts, billing, and support: performance of a contract with you or your organization, or steps taken at your request before entering a contract.
Security, fraud prevention, abuse prevention, and service improvement: our legitimate interests in operating a safe, reliable, and effective business.
Analytics and product development: our legitimate interests, or your consent where required for cookies and similar technologies.
Direct marketing to business contacts: our legitimate interests in promoting our Services, or your consent where required by law.
Optional cookies and similar technologies: your consent.
Tax, accounting, and other legal compliance, and responding to lawful requests: compliance with legal obligations.
Establishing, exercising, or defending legal claims: our legitimate interests.

Where we rely on consent, you may withdraw it at any time by using the controls described in Section 6 or by contacting us. Withdrawal does not affect processing that took place before you withdrew. Where we rely on legitimate interests, you may object as described in Section 10.

5How We Share Information

We disclose personal information only as described below. We do not sell Business Contact Data in exchange for money.

Service providers and subprocessors. We use vendors that help us run the Services, such as cloud hosting, data storage, payment processing, email and SMS delivery, telephony and messaging carriers, customer support tools, analytics, security, and artificial intelligence service providers. They may access personal information only to perform services for us and are bound by written agreements that require them to protect it and use it only for those services. A current list of our subprocessors is available on request at support@astrocrm.ai.
Our customers. Customer Data is made available to the customer that owns it and to that customer's authorized users. If you are an authorized user of a customer account, your name, work email address, role, and activity in the account may be visible to that customer's administrators.
Integrations and your instructions. When you or your organization connect a third-party service or direct us to send information to one, we share information with that service as instructed. The third party's privacy practices then govern its use of that information.
Professional advisers. Lawyers, accountants, auditors, insurers, and similar advisers, under duties of confidentiality.
Legal and safety reasons. Government authorities, courts, and other parties where we believe disclosure is required by law, subpoena, or legal process, or is necessary to protect the rights, property, safety, or security of Astro, our customers, or others, or to detect or prevent fraud or abuse. Where lawful and practical, we will notify the affected customer before disclosing Customer Data in response to a legal request.
Business transfers. A potential or actual acquirer, investor, or successor, and their advisers, in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business or assets. We will require that the recipient honor this Privacy Policy or give notice of any material change.
Affiliates. Entities under common ownership or control with Astro, for the purposes described in this Privacy Policy.
With your consent. Anyone else, where you direct us or consent to the disclosure.

We may also disclose aggregated or de-identified information that cannot reasonably be used to identify you.

6Cookie Policy

This Cookie Policy explains how Astro and our service providers use cookies and similar technologies on the Sites and in the Platform, and how you can control them.

6.1What are cookies and similar technologies?

Cookies are small text files placed on your browser or device when you visit a website. Similar technologies include pixels, tags, web beacons, software development kits, local storage, and device fingerprinting signals. Some are "first-party" (set by us) and some are "third-party" (set by another company). Some last only for your browsing session, and others persist until they expire or you delete them. In this Cookie Policy, "cookies" means all of these technologies.

6.2Types of cookies we use

Strictly necessary cookies. These keep the Services working: they sign you in, maintain your session, balance traffic load, protect against fraud and attacks, and remember your cookie choices. Examples include session and authentication identifiers, security tokens, load balancing, and the record of your consent. Your choice: these cannot be switched off in our settings. You can block them in your browser, but parts of the Services will not work.
Functional cookies. These remember your settings and preferences, such as language, region, and interface choices, to give you a more personalized experience. Your choice: optional, and off by default where consent is required.
Analytics and performance cookies. These help us understand how visitors and users use the Services so we can measure and improve them. Data is aggregated or pseudonymous. Examples include page views, feature usage, referral sources, and error and performance monitoring, using tools such as Google Analytics. Your choice: optional, and off by default where consent is required.
Marketing and advertising cookies. These measure the effectiveness of our own advertising and marketing, and may show you our ads on other websites and platforms. Advertising partners may use them to build a profile of your interests. Examples include conversion tracking and audience pixels, such as those of Google and Meta. Your choice: optional, and off by default where consent is required.

Marketing and advertising cookies are used only on our public marketing Sites and are not used inside the authenticated Platform. The specific cookies in use can change over time. A current list is available on request at support@astrocrm.ai.

6.3Third-party cookies

Some cookies are placed by third parties that provide analytics, advertising, embedded content, scheduling, chat, or video features on our Sites. These third parties collect information directly from your browser under their own privacy policies, and we do not control their cookies. Typical lifespans range from the length of your session up to 13 months.

6.4How to manage your cookie preferences

Cookie banner and settings. Where required by law, we show a banner on your first visit that lets you accept, reject, or customize optional cookies by category. You can change your choices at any time using the cookie settings link in the footer of our Sites.
Browser controls. Most browsers let you block or delete cookies and alert you before a cookie is set. Instructions are available in your browser's help menu. Blocking all cookies may prevent parts of the Services from working.
Global Privacy Control and similar signals. We treat a valid Global Privacy Control (GPC) signal, or another legally recognized opt-out preference signal, as a request to opt out of the sale or sharing of personal information and of targeted advertising for that browser, and, where you are signed in, for your account. Our Sites do not currently respond to browser "Do Not Track" signals because there is no common standard for them.
Advertising opt-outs. You can also opt out of interest-based advertising from participating companies through the Digital Advertising Alliance (optout.aboutads.info), the Network Advertising Initiative (optout.networkadvertising.org), or the European Interactive Digital Advertising Alliance (youronlinechoices.eu), and you can use the ad settings of the platforms you use.
Analytics opt-out. Google offers a browser add-on to opt out of Google Analytics at tools.google.com/dlpage/gaoptout.

6.5Legal basis and consent

Where the law of your location requires consent for non-essential cookies, including in the EEA, the UK, and Switzerland, we set those cookies only after you give consent. You may withdraw consent at any time through the cookie settings link, and withdrawal does not affect earlier processing.

6.6Changes to this Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in the technologies we use or in the law. We will post the updated version with a new "Last updated" date and, where required, ask for your consent again.

7International Data Transfers

Astro is based in the United States, and the Services are hosted and operated in the United States. If you access the Services from outside the United States, your personal information will be transferred to, stored, and processed in the United States and in other countries where we or our subprocessors operate. Those countries may have data protection laws that differ from, and may be less protective than, the laws of your country.

Where we transfer personal information from the EEA, the UK, or Switzerland to a country that has not been recognized as providing an adequate level of protection, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures where needed. You may request a copy of the relevant safeguards by contacting us at support@astrocrm.ai.

8Data Retention

We keep personal information only as long as needed for the purposes described in this Privacy Policy, including to provide the Services, meet legal, accounting, and reporting requirements, resolve disputes, and enforce our agreements.

Account and Business Contact Data: retained while the account is active and for a reasonable period afterward for legal, tax, audit, security, and dispute purposes. Financial and tax records are kept for the period required by law, generally up to seven years.
Marketing data: retained until you opt out or the data is no longer relevant to our business relationship, after which we keep a suppression record so that we honor your opt-out.
Log and usage data: retained for a limited period, generally not longer than 24 months, then deleted or aggregated.
Customer Data: retained for the term of the customer's subscription and handled on termination as the customer's agreement provides. By default, we make Customer Data available for export for 30 days after termination, and we then delete it from active systems within 90 days. Copies in backups are overwritten in the ordinary backup cycle.

When we no longer need personal information, we delete or de-identify it. If that is not technically possible, we securely store it and isolate it from further use until deletion is possible. We may retain information longer where required by law or needed for a legal claim.

9Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include encryption of data in transit, encryption of stored data where appropriate, role-based access controls, authentication controls for our personnel, logging and monitoring, vendor security reviews, and an incident response process.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential, using strong and unique passwords, and promptly notifying us at support@astrocrm.ai if you suspect unauthorized access to your account. If we become aware of a security breach affecting personal information, we will notify affected individuals, customers, and regulators as required by applicable law and our customer agreements.

10Your Privacy Rights

Depending on where you live, you may have some or all of the following rights regarding personal information for which we are the controller:

Access: to know what personal information we hold about you and to receive a copy.
Correction: to have inaccurate or incomplete information corrected.
Deletion: to have your personal information deleted, subject to legal exceptions.
Portability: to receive your information in a portable, commonly used format.
Restriction and objection: to restrict or object to certain processing, including processing based on legitimate interests and direct marketing.
Withdraw consent: to withdraw consent at any time where processing is based on consent.
Opt out: to opt out of marketing communications, targeted advertising, and the sale or sharing of personal information.
Automated decisions: to not be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not make such decisions about individuals.
Complaint: to lodge a complaint with your data protection authority or, in the United States, your state attorney general.

10.1How to exercise your rights

Email us at support@astrocrm.ai with the subject line "Privacy Request," or write to us at Astro LLC, Attn: Privacy, 10 S 5th St., Unit 1024, Minneapolis, MN. Please tell us which right you want to exercise and the email address associated with your account. To protect your information, we may need to verify your identity, and for account-level requests we may ask you to sign in or confirm details we already hold. We will respond within the time required by applicable law, generally within 30 to 45 days, and we will tell you if we need more time and why. You can unsubscribe from marketing emails at any time using the link in the message.

You may use an authorized agent to submit a request on your behalf. We may require proof of the agent's authority and may need to verify your identity directly with you. We will not charge a fee for a request unless it is manifestly unfounded, excessive, or repetitive, and then only as the law allows. We will not discriminate against you for exercising your rights.

If we deny your request, you may appeal by replying to our decision with the word "Appeal" in the subject line. We will respond to appeals within the time required by law and explain the outcome in writing. If you are not satisfied, you may contact your state attorney general or data protection authority.

11Additional Disclosures for US State Residents

This section supplements the rest of this Privacy Policy for residents of California and other US states with comprehensive privacy laws, including Colorado, Connecticut, Oregon, Texas, Utah, Virginia, and Minnesota. Some of these laws exempt information collected in a business-to-business or employment context. Where a law gives you rights, we honor them as described in Section 10.

11.1Categories of personal information (past 12 months)

Identifiers. Examples: name, work email, phone number, username, IP address, device identifiers. Disclosed for a business purpose to service providers, advisers, and authorized customer administrators.
Customer records. Examples: billing name and address, company details, payment confirmation (not full card numbers). Disclosed to payment processors, service providers, and advisers.
Commercial information. Examples: subscription plan, purchase and billing history. Disclosed to payment processors, service providers, and advisers.
Internet and network activity. Examples: pages viewed, features used, log data, referring sites. Disclosed to analytics and hosting providers and other service providers.
Approximate geolocation. Example: city or region inferred from IP address. Disclosed to analytics and hosting providers.
Professional information. Examples: job title, employer, industry. Disclosed to service providers and customer administrators.
Audio and electronic information. Examples: call recordings and chat transcripts with our support and sales teams. Disclosed to telephony and support providers.
Inferences. Examples: preferences and product interest drawn from usage. Disclosed to analytics and marketing providers.
Sensitive personal information. Example: account log-in credentials (username and password). Disclosed to hosting and security providers.

We use sensitive personal information only to provide the Services and maintain their security, and not to infer characteristics about you.

11.2Sale, sharing, and targeted advertising

We do not sell personal information for money. Some laws define "sale" or "sharing" broadly enough to include making identifiers and browsing activity available to advertising partners through marketing cookies on our public Sites. To the extent that applies, we disclose identifiers, internet activity, and inferences to advertising and analytics partners for cross-context behavioral advertising and measurement. You may opt out at any time through the cookie settings link in the footer of our Sites, by sending a Global Privacy Control signal, or by emailing support@astrocrm.ai. We do not knowingly sell or share the personal information of anyone under 16.

11.3Additional state rights

California: you may request the categories of personal information we disclosed for a business purpose, and under California's "Shine the Light" law (Civil Code Section 1798.83) you may ask which categories of personal information we disclosed to third parties for their direct marketing, and to whom. You may also ask us to limit the use of sensitive personal information, although we use it only for the purposes described above.
Minnesota: you may ask for a list of the specific third parties to which we have disclosed your personal data, to question the result of profiling that produced a decision about you, and to review and correct the data used in it.
Other states: you may have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. We do not engage in such profiling.

We retain personal information for the periods in Section 8 and do not collect it for purposes materially different from those disclosed in this Privacy Policy without notice.

12Artificial Intelligence Features

The Platform may include features powered by machine learning or generative artificial intelligence, such as drafting messages, summarizing conversations, transcribing calls, scoring leads, or automating responses. When a customer uses these features, the relevant Customer Data is processed to generate the output for that customer. We do not use Customer Data to train or improve generative AI models offered to other customers, and we do not permit our AI service providers to use Customer Data to train their own models. AI-generated output may be inaccurate, and customers are responsible for reviewing it and for complying with laws that apply to their use of it, including any notices or consents needed to record calls or to disclose automated interactions.

13Children's Privacy

The Services are intended for business use by adults and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided personal information to us, please contact us at support@astrocrm.ai and we will delete it.

14Third-Party Links and Services

The Services may contain links to, or integrations with, third-party websites, products, and services that we do not own or control. This Privacy Policy does not apply to them, and we are not responsible for their content or privacy practices. We encourage you to review the privacy policies of any third party before you provide information to it.

15Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on the Sites with a new "Last updated" date. If we make a material change, we will give you reasonable advance notice, such as by email to the account owner or a prominent notice in the Platform, and where the law requires it we will obtain your consent. Your continued use of the Services after the effective date of an update means you accept it, to the extent the law allows.

16Contact Us

If you have questions about this Privacy Policy or our privacy practices, or wish to exercise your rights, contact us:

Email: support@astrocrm.ai
Mail: Astro LLC, Attn: Privacy, 10 S 5th St., Unit 1024, Minneapolis, MN