Privacy Policy

This Privacy Policy describes how Astra Financial, Inc. ("Astra," "we," "us") collects, uses, shares, and protects personal information when you use our websites, applications, and services (the "Platform"). It applies to visitors, early-access members, and customers.

Because Astra works with your financial life, we hold ourselves to the standards financial customers expect: we collect what the service needs, we use it to serve you, and we do not sell your personal information.

Information you provide.

• Identity and contact details — name, email address, phone number, and, for certain features, date of birth and address
• Profile and household information you share to personalize guidance — goals, family details, employment, location
• Messages, documents, and files you submit to the Platform
• Payment information (handled by our payment processor; we do not store full card numbers)

Information from linked financial accounts. When you connect accounts through our data aggregation providers (including Plaid), we receive account information such as institution name, account type, balances, transactions, holdings, liabilities, and associated identity data. We do not receive or store the credentials you enter at Plaid or your financial institution.

Information collected automatically. Device and browser type, IP address, pages viewed, actions taken, approximate location derived from IP, and cookies or similar technologies used for sign-in, security, and analytics.

Information from third parties. Service providers (identity verification, fraud prevention, communications delivery) and, where you use them, third-party sign-in providers (Google, Apple), which share your name, email, and profile image.

• Provide and operate the Platform — including generating personalized financial guidance, reports, and plans from the information and account data you provide
• Carry out actions you explicitly authorize (see the Terms of Service)
• Process payments, manage subscriptions, and calculate usage
• Communicate with you — service messages, guidance you request, reminders, and (with consent) SMS
• Protect the Platform and users — authentication, rate limiting, fraud and abuse prevention, security logging (including login attempts with IP addresses)
• Record legal acceptances — when you accept our Terms we record the version, timestamp, and technical details of the acceptance
• Comply with law and enforce our agreements
• Improve the Platform — debugging, research, product analytics, and training and calibrating Astra's own advisor and supporting AI systems on your interaction context (see Automated Processing)

Astra's guidance is generated in substantial part by automated systems, including machine-learning models, operating on the information and account data you provide. Automated outputs are designed to inform your decisions; significant actions require your explicit authorization.

We contractually restrict our technology service providers from using your personal information for their own purposes, including training their models on your data outside of providing services to us.

Our own AI systems. To provide and improve your advisor, we analyze the full context of your interactions with Astra — conversations across chat, SMS, email, and voice, the financial and account data you connect, uploaded documents, and derived facts and preferences. This context trains and calibrates Astra's own advisor and supporting AI systems so your advisor understands your situation and gets more useful over time. This processing is performed by Astra and its dedicated systems under this Policy and our security controls; it is handled on a need-to-know basis and is not sold or used for advertising. You can request deletion of your data at any time (see Your Choices).

We share personal information only:

• With service providers under contract who process data on our behalf — data aggregation (Plaid), payments (Stripe), cloud hosting, communications (email/SMS delivery), analytics, and model providers
• With third parties you direct us to work with — for example an insurer or institution you ask us to obtain a quote from or submit a form to
• For legal reasons — to comply with law, regulation, legal process, or enforceable governmental request, or to protect the rights, safety, and property of Astra, our users, or the public
• In a business transfer — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy
• With your consent — for anything else, we ask first

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Account linking is powered by Plaid Inc. By linking an account you authorize Plaid to retrieve your account information from your financial institution and provide it to us. Plaid's handling of your information is described in the Plaid End User Privacy Policy.

You can unlink an account at any time in your account settings, which stops future data retrieval for that account. You can also manage Plaid connections across apps at my.plaid.com.

We use strictly necessary cookies for sign-in sessions and security (including CSRF protection), and limited functional cookies such as your theme preference. We do not use third-party advertising cookies. Most browsers let you control cookies in settings; blocking essential cookies will prevent sign-in from working.

We retain personal information for as long as your account is active and as needed to provide the Platform. We retain certain records longer where required or advisable by law — for example billing records, security logs, and records of your legal acceptances. Short-lived operational data (such as login-attempt logs used for rate limiting) is pruned on a rolling basis.

When you close your account, we delete or de-identify personal information within a commercially reasonable period, except what we must retain for legal, security, or dispute-resolution purposes.

We protect personal information with administrative, technical, and physical safeguards, including encryption in transit, hashed credentials (we never store plaintext passwords), scoped internal access, login rate limiting, and audit logging. No system is perfectly secure; if we learn of a breach affecting your personal information we will notify you as required by applicable law.

Depending on where you live, you may have rights to access, correct, delete, or receive a portable copy of your personal information, and to limit certain processing. Regardless of location, we extend these basics to all users:

• Access and update profile information in your account settings
• Unlink financial accounts at any time
• Opt out of SMS (reply STOP) and non-essential email
• Request a copy or deletion of your data by emailing [email protected]

We will verify your request (typically via your account email) and respond within the time required by applicable law. We will not discriminate against you for exercising privacy rights. Residents of California and other states with comprehensive privacy laws may have additional rights (including appeal of a denied request) — contact us and we will honor what your state's law provides. We do not sell personal information, so there is nothing to opt out of on that front; we also honor Global Privacy Control signals where legally required.

The Platform is not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

The Platform is offered in the United States and your information is processed in the United States. If you access the Platform from elsewhere, you understand your information will be transferred to and processed in the U.S.

We may update this Policy from time to time. Each version carries a version identifier and effective date, and we will notify you of material changes through the Platform or by email before they take effect.

Questions or requests about privacy:
Astra Financial, Inc.
Email: [email protected]