Privacy

What you give us. When you use the contact form we collect your name, email, company (optional), the service you picked, and your message. When you talk to the chatbot, we process the messages you type so it can answer.

Payments. When you buy an audit or a video, checkout is handled by Paystack (and Flutterwave for some international cards). Your card or M-Pesa details go straight to them — they never touch our servers and we never see them. We keep only the payment reference, the amount, and which terms you agreed to.

To reply to your enquiry, quote for work, and — if you become a client — deliver it. That's it. We don't sell your data, and we don't add you to a marketing list you didn't ask for.

The chatbot sends your messages to Anthropic's API to generate a reply. Contact-form submissions may pass through our own automation tooling (n8n) and email provider so they reach a human. These processors handle the data on our behalf; we don't hand it to advertisers.

Enquiries are kept for 24 months, then deleted. Payment records are kept for seven years because tax law requires it. Ask us to delete your details and we'll do it within 30 days — reply STOP to any message from us and we'll treat that as the request.

If you sign in to Astra Client Ops with Facebook, we read the Facebook Pages you manage, the Instagram Professional accounts connected to them, and the posts, captions and comments those accounts have published. We use this only to plan video scripts. We do not sell it, share it with advertisers, or use it to make decisions about people.

We never see your Facebook or Instagram passwords. Access tokens are stored encrypted and kept only while they are valid. You can remove the app at any time from Facebook → Settings → Apps and websites, and you can ask us to delete all the data we hold about you at /data-deletion.

We sometimes scan the public websites and Google listings of businesses we think we can help, and send the result as a free report. That uses information a business publishes for customers to find — a website, a phone number, a listing — and nothing else. The scan is read-only: we never submit your contact form, never send a test enquiry, and never sign you up to anything.

If you'd rather we didn't, reply STOP to any message and we'll delete your details and not contact you again.

For clients who ask us to manage their YouTube channel, we connect through Google's YouTube Data API using access the channel owner grants us directly — never through YouTube Studio permissions alone. That access is used only to do the work the client asked for: organizing videos into playlists, editing titles, descriptions and chapters, and similar channel management. We never use it to read or export a client's audience data, and we never transfer it to advertisers or any other third party.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. A client can revoke our access at any time from myaccount.google.com/permissions, or by asking us to disconnect it.

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Email hello@astraco.agency and a human will handle it.

Astra & Co. · Nairobi, Kenya · working worldwide · hello@astraco.agency