Privacy Policy

1. Introduction

Astro Ventures LLC (“we,” “our,” or “us”) operates multiple software products and services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our websites, applications, and services (collectively, the “Services”).

Our Services include: NestFolio (property management), BatchBook (group scheduling), OrbitCleaning (cleaning service management), DeckOS (presentation builder), Binful (waste management), Flatterly (real estate), Occura (healthcare), AstroFinance (financial tools), and other products developed under the Astro Ventures brand.

2. Information We Collect

2.1 Information You Provide

We collect information you provide directly to us, including:

• Account Information: Name, email address, password when you create an account
• Profile Information: Company name, job title, profile picture (optional)
• Communications: Information when you contact us for support or feedback
• Phone Number: Mobile phone number when you opt in to SMS notifications
• Payment Information: Billing details processed through secure third-party payment processors (we do not store credit card numbers)

2.2 Financial Data via Plaid

Certain Services use Plaid Inc. (“Plaid”) to connect your financial accounts. When you choose to link a financial account through Plaid, you authorize Plaid to access and transmit the following information on your behalf:

• Account Information: Account name, type, and financial institution details
• Balance Information: Current and available account balances
• Transaction History: Transaction details including date, amount, merchant name, and category
• Account Holder Identity: Name and contact information associated with the account

Your use of Plaid is also subject to the Plaid End User Privacy Policy. We access financial data only with your explicit consent, and you can disconnect your financial accounts at any time through your account settings.

2.3 Information Collected Automatically

When you use our Services, we automatically collect:

• Usage Data: Features used, pages viewed, time spent, clicks, and interactions
• Device Information: IP address, browser type, operating system, device identifiers
• Log Data: Access times, error logs, referral URLs
• Cookies and Tracking: Session cookies, preference cookies, analytics cookies

2.4 Information from Third Parties

We may receive information when you connect third-party services:

• Social Media: Profile information when you sign in via Google, LinkedIn, or Twitter
• Calendar Services: Calendar data when you connect Google Calendar or Outlook
• Payment Processors: Transaction details from Stripe
• Financial Institutions: Account and transaction data via Plaid (see Section 2.2)

3. How We Use Your Information

We use the collected information for:

• Service Delivery: Provide, maintain, and improve our Services
• Account Management: Create and manage your account
• Financial Services: Display account balances, categorize transactions, detect recurring charges, and provide financial insights
• Communication: Send updates, security alerts, and support messages
• Analytics: Understand usage patterns and improve user experience
• Security: Detect, prevent, and address fraud and security issues
• Legal Compliance: Comply with legal obligations and enforce our terms
• Marketing: Send promotional content (with your consent, where required)

4. How We Share Your Information

We do not sell your personal information. We may share information with:

4.1 Service Providers

• Hosting: Vercel (hosting and infrastructure), Railway (backend services)
• Database: Supabase (PostgreSQL database with row-level security)
• Payments: Stripe (payment processing)
• Financial Data: Plaid (bank account connectivity and transaction data aggregation)
• Email: Resend (transactional emails)
• Analytics: Vercel Analytics, PostHog
• Monitoring: Sentry (error tracking)

4.2 Financial Data Sharing

We share financial data obtained through Plaid only as necessary to provide our Services. We do not sell, lease, or disclose your financial data to third parties for marketing purposes. Financial data is encrypted in transit and at rest using industry-standard encryption.

4.3 Legal Requirements

We may disclose information if required by law or to:

• Comply with legal process or government requests
• Enforce our Terms of Service
• Protect our rights, property, or safety
• Prevent fraud or security issues

4.4 Business Transfers

If we merge with or are acquired by another company, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide Services. When you delete your account, we delete your personal information within 30 days, except:

• Information required for legal compliance (retained for 7 years)
• Anonymized analytics data (retained indefinitely)
• Backup copies (deleted within 90 days)

5.1 Financial Data Retention

Financial data obtained through Plaid is retained for up to 24 months while your account is active. Transaction data older than 24 months is automatically purged. When you disconnect a financial account or delete your user account, associated financial data is deleted within 30 days. Plaid access tokens are revoked immediately upon disconnection.

6. Your Rights and Choices

6.1 Access and Correction

You can access and update your account information through your account settings.

6.2 Data Portability

You can export your data in JSON or CSV format from your account settings.

6.3 Deletion

You can delete your account at any time. Email us at privacy@astroventures.io for assistance.

6.4 Financial Data Controls

You can disconnect linked financial accounts at any time through your account settings. Upon disconnection, we revoke the Plaid access token and delete stored financial data within 30 days.

6.5 Marketing Opt-Out

Unsubscribe from promotional emails using the link in each email or through account settings.

6.6 SMS Opt-Out

Reply STOP to any SMS message to unsubscribe from text notifications. You can also disable SMS notifications in your account settings. See our SMS Messaging Terms for full details on message frequency, opt-in, and opt-out.

6.7 Cookie Preferences

Manage cookie preferences through your browser settings. Note that disabling cookies may limit functionality.

7. International Data Transfers

Our Services are hosted in the United States. If you access our Services from outside the U.S., your information will be transferred to and processed in the United States, which may have different data protection laws than your country.

For European users: We comply with applicable data transfer requirements under GDPR, including Standard Contractual Clauses where required.

8. Security

We implement industry-standard security measures:

• Encryption: TLS 1.3 for data in transit, AES-256 for data at rest
• Authentication: Bcrypt password hashing, TOTP-based two-factor authentication
• Access Controls: Role-based access control (RBAC) with schema-level database isolation
• Financial Data Protection: Encrypted Plaid access tokens, schema-isolated storage, Row-Level Security (RLS)
• Monitoring: Automated security scanning, error tracking, and real-time alerting
• Audits: Regular security assessments and vulnerability scanning

However, no method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

9. Children's Privacy

Our Services are not intended for children under 13 (or 16 in the EEA). We do not knowingly collect information from children. If you believe we have collected information from a child, please contact us at privacy@astroventures.io and we will delete it.

10. California Privacy Rights (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of collected personal information
• Right to Delete: Request deletion of personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: Opt-out of sale or sharing (we do not sell or share personal information)
• Right to Limit: Limit the use and disclosure of sensitive personal information
• Right to Non-Discrimination: Equal service regardless of privacy choices

To exercise these rights, email privacy@astroventures.io with “CCPA Request” in the subject line.

11. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), UK, or Switzerland, you have rights under GDPR:

• Right to Access: Obtain a copy of your personal data
• Right to Rectification: Correct inaccurate data
• Right to Erasure: Request deletion of data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive data in machine-readable format
• Right to Object: Object to processing for direct marketing
• Right to Withdraw Consent: Withdraw consent at any time

To exercise these rights, email privacy@astroventures.io with “GDPR Request” in the subject line. You also have the right to lodge a complaint with your local data protection authority.

12. Gramm-Leach-Bliley Act (GLBA)

To the extent we collect nonpublic personal financial information through our Services, we comply with the Gramm-Leach-Bliley Act and its implementing regulations. We:

• Provide clear notice of our information-sharing practices
• Safeguard consumer financial information with appropriate security measures
• Do not share nonpublic personal financial information with non-affiliated third parties except as permitted by law
• Limit access to consumer financial data to authorized personnel only

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically. We will notify you of material changes by:

• Posting the updated policy with a new “Last Updated” date
• Sending an email notification to your registered email address
• Displaying a prominent notice within our Services

Your continued use of our Services after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us: