Privacy Policy

Account Information

• Name, email address, company name, and job title
• Billing information (processed securely via Stripe; we never store full payment details)
• Account preferences, timezone, and notification settings

Content & Campaign Data

• Social media posts, captions, media files, and campaign content you create
• Brand guidelines, voice profiles, and AI training data you upload
• Connected social media account metadata (usernames, follower counts, engagement metrics)
• Scheduling information and publishing history

Usage Analytics

• Device information, IP address, browser type, and operating system
• The IP address and approximate location (country, region, and city) recorded when you sign up, retained on your account for fraud and abuse prevention and to understand which markets we serve
• Pages visited, features used, and time spent in the platform
• Error logs and performance metrics to improve stability
• AI model interactions and content generation requests

Social Media Connections

When you connect social media accounts (LinkedIn, Facebook, Instagram, TikTok, YouTube, Twitter/X), we collect:

• OAuth access tokens (stored encrypted) to publish on your behalf
• Profile information, page details, and publishing permissions
• Post performance metrics (impressions, engagement, reach) for analytics

Google User Data (Calendar & Google Ads)

If you choose to connect Google services, we access the following Google user data solely to provide the features you enable, using OAuth tokens stored encrypted:

• Google Calendar (calendar, calendar.events): read your free/busy availability and create, update, or cancel meeting events (with Google Meet links) when you book calls with your leads through the appointment feature.
• Google Ads (adwords): read your own Google Ads campaign and conversion performance and upload offline conversions for the ad account you connect.
• Email address (userinfo.email): to identify the connected Google account.

Limited Use disclosure.Asteria Engine's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not transfer it to third parties except as needed to provide or improve these features (or as required by law), and do not allow humans to read it except with your consent, for security/abuse/legal reasons, or where the data is aggregated and anonymised.

Service Delivery (Contractual Necessity)

• Providing access to Asteria Engine platform and features
• AI content generation, scheduling, and publishing automation
• Brand Intelligence Engine training and optimization
• Customer support and technical assistance

Product Improvement (Legitimate Interest)

• Analyzing usage patterns to enhance AI model performance
• Developing new features based on user behavior
• Monitoring system health and preventing abuse
• Conducting research to improve content generation quality

Legal Compliance (Legal Obligation)

• Maintaining audit logs for security and fraud prevention
• Responding to legal requests and regulatory requirements
• Enforcing our Terms of Service and acceptable use policies

Marketing Communications (Consent)

With your explicit consent, we may send:

• Product updates, feature announcements, and best practice guides
• Educational content and webinar invitations
• Promotional offers (you can opt out anytime)

Infrastructure & Location

• Data is hosted on secure cloud infrastructure with UK/EU hosting options available for eligible customers
• Data transfers are protected with modern TLS encryption
• Data at rest is encrypted through managed cloud controls
• Database backups are performed daily with 30-day retention

Security Measures

• Multi-Factor Authentication (MFA): Required for all workspaces
• Role-Based Access Control: Granular permissions and workspace isolation
• Audit Logging: Immutable logs of all account activities
• Penetration Testing: Regular third-party security assessments
• Incident Response: Monitoring, alerting, and documented response processes

Data Retention

• Active account data is retained for the duration of your subscription
• After account deletion, data is permanently removed within 30 days
• Billing records are retained for 7 years per UK tax law
• Audit logs are retained for 12 months for security purposes