Astris Privacy Policy

Last updated: 23 October 2026

This Privacy Policy explains how Persis Creative Hub, S.L. ("Astris", "we", "us") uses personal data when you visit astris.run, sign in to the Astris Console, or use the Astris API, MCP server or command-line tool (together, the "Service").

1. Who is responsible

1.1 Your account data: we are the controller. This is the data about you as our customer, listed in section 2. Controller: Persis Creative Hub, S.L., NIF B21813613, Calle Guillem de Castro 43, 46007 València, Spain. Contact: privacy@astris.run.

1.2 Data inside your applications: you are the controller and we are your processor. The personal data that your applications and databases hold about your own users belongs to you. We process it only to provide the Service, under the Data Processing Terms in section 13 of our Terms of Service. If your users ask us about that data, we refer them to you.

1.3 We have not appointed a Data Protection Officer, because the law does not require one for our activity. Write to privacy@astris.run with any privacy question.

2. What we collect, and where it comes from

From GitHub, when you sign in. Your verified email address and your GitHub account identifier. We do not keep GitHub's access tokens, and your sign-in does not give us access to your repositories.

From your browser, when you use the Console. A session record: a session token, its expiry, and the IP address and browser user-agent of the sign-in.

From you, when you create an API key. The name you give it, a short prefix of the key, a one-way hash of the key, and when it was created, last used and revoked. We cannot read the key after we show it to you once.

From you and from Stripe, when you buy a plan. Your business or trade name, your confirmation that you buy for your trade, business or profession, your tax identification number if you give it, your plan, and the identifiers Stripe gives your customer record and subscription. Stripe collects your card details, billing name and address directly. We never see or store your full card number.

From you, when you deploy. Names of your projects, applications and databases; the Git repository address and branch; domain names you connect; resource settings; the public half of each deploy key; build and runtime logs; and the environment variables and secrets you set. Some of this can be personal data, for example a repository address that contains your name.

From you, when you contact us. Your email address and the content of your messages.

From your browser, when you visit astris.run. Our web server receives your IP address and browser details with each request, as every website does. We use no analytics and no advertising tools.

3. Why we use it, and our legal basis

Where we rely on legitimate interests, you can ask us for the balancing test we made, and you can object (section 9).

We do not sell personal data. We do not use it for advertising. We make no decision about you by automated means alone that has a legal or similarly significant effect on you. When a new application or database does not fit in your plan, the Service refuses it; that is a resource check, not a decision about you as a person.

We do not use your data or your Customer Content to train AI models.

4. Who receives it

We share personal data only with the following, and only as far as each needs it. The full list of sub-processors, with entity, function, location and transfer safeguard, is at astris.run/subprocessors.

• UAB Bacloud (Lithuania), which provides the data centre and server hardware on which we run the Service and your applications.
• Cloudflare, which stores our database backups and the object storage buckets you create (Cloudflare R2), and routes Astris email.
• Functional Software, Inc. (trading as Sentry), which receives error reports from the Service so that we can find and fix faults. Each report holds the error code and type, a technical trace of where the error happened, the route and identifier of the request, the software version, the environment name, basic runtime and operating system details, and the name of the server that sent it. Sentry also sees that server's network address. A report can be linked to your use of the Service through its request identifier, but it holds no Customer Content, request bodies, headers, cookies, query strings, email addresses or account identifiers, and Sentry stores the reports in its European Union region.
• Stripe, which processes payments. Stripe is a separate controller for some of the data it collects; see https://stripe.com/privacy.
• GitHub, when you sign in with GitHub. GitHub's own privacy statement applies to your GitHub account.
• Professional advisers, such as lawyers, accountants and auditors, who are bound by confidentiality.
• Authorities and courts, where the law requires it.
• A buyer or successor of the Service, if Astris is sold or merged. We tell you before your data is transferred.

5. Transfers outside the European Economic Area

The servers that run your applications and databases are in the European Union. Some of the providers in section 4 are based in, or may access data from, countries outside the European Economic Area, including the United States. For each such transfer we rely on an adequacy decision of the European Commission or on the European Commission's Standard Contractual Clauses. The sub-processor list names the safeguard for each provider. You can ask for a copy of the safeguards at privacy@astris.run.

6. How long we keep it

• Account, API key and deployment data: while you have a plan. When a plan ends, we keep this data for 30 days, then delete it (Terms, section 9.3). This data includes your email address and GitHub account identifier. A revoked API key stops working, but we keep its record until we delete this data.
• Accounts that never had a paid plan: deleted 90 days after the account is created. We email you 14 days before.
• Console sessions: 7 days from sign-in.
• Database backups: each nightly copy is kept for 30 days, then removed automatically. When you delete a database, its existing backups expire on the same 30-day schedule. When a plan ends, we keep your backups for 30 days and then delete them with your other data (Terms, section 9.3).
• Logs: up to 60 days, including the copies inside backups.
• Error reports: 30 days.
• Support messages: 2 years after the conversation ends.
• Records of notices under the Digital Services Act: 2 years after the decision.
• Billing and accounting records: 6 years (Spanish Commercial Code, Art. 30). VAT records for sales declared through the EU One-Stop Shop: 10 years.
• Data we must keep for a legal claim: until the claim is settled.

Data we keep only because the law requires it is restricted from any other use.

7. Cookies

The Astris Console sets only cookies that are strictly necessary: a cookie that keeps you signed in, and short-lived cookies that protect the GitHub sign-in step. They need no consent, so there is no cookie banner. astris.run sets no other cookies.

8. How we protect it

We apply technical and organisational measures suited to the risk. They include restricted administrative access, separation between customer environments, API keys stored only as one-way hashes, HTTPS for the Console, and nightly database backups kept with a separate provider account. Annex 1 of our Data Processing Terms (Terms, section 13) describes them. If a personal data breach is likely to put your rights at high risk, we tell you without undue delay.

9. Your rights

You have the right to:

• access the personal data we hold about you and get a copy;
• correct data that is wrong;
• delete your data, where there is no reason for us to keep it;
• receive your data in a structured, machine-readable form, or have it sent to another provider;
• restrict our use of it while a question about it is resolved;
• object to our use of it on the basis of legitimate interests.

Write to privacy@astris.run. We answer within one month; for complex requests we may extend this by two more months and tell you why. We may ask you to confirm your identity, for example by writing from the email address on your account. These requests are free.

You may complain to a data protection authority. In Spain this is the Agencia Española de Protección de Datos (AEPD), www.aepd.es. You may also complain to the authority in the country where you live or work, or where you think the law was broken.

10. Children

The Service is for people aged 18 or over who use it for their trade, business or profession. We do not knowingly collect data about children. If you think a child has given us personal data, write to privacy@astris.run and we will delete it.

11. Changes to this policy

We may update this policy. We email you about a material change before it applies, and we change the "Last updated" date above.

12. Contact

Persis Creative Hub, S.L., Calle Guillem de Castro 43, 46007 València, Spain, privacy@astris.run.

---

This document is adapted from a template prepared and made publicly available by General Legal, PC ("General Legal"). General Legal has not reviewed, and takes no position on, any modifications made to this document.