AXASTRO Privacy Policy

Effective date: October 15, 2026

Operator: AXASTRO LLC, a limited liability company organized under the laws of New Jersey, United States
Privacy and support contact: support@axastro.com
Public correspondence address: 5 Heights Road, Apt. PB, Ridgewood, New Jersey, 07450
Business contact: nik@axastro.com

1. Scope and who is responsible

This Privacy Policy explains how AXASTRO LLC ("we," "us," or "our"), the operator of the AXASTRO service, handles personal information in connection with https://axastro.com, https://app.axastro.com, our related application services, and communications with us. AXASTRO is the product and service name; where this policy refers to AXASTRO as the responsible operator, it means AXASTRO LLC.

AXASTRO is a software workspace for professional content planning and drafting, initially focused on U.S. immigration-law practices. It is not a law firm, government agency, immigration authority, or client case-management service.

We determine the purposes and means of processing account-administration, service-security, and support information. Where a business customer determines what personal information to include in its own workspace content, that customer may have separate responsibilities to the people concerned. This notice does not replace the customer's own notices or a data-processing agreement required for a particular use.

Current availability. Account registration is open. Content generation and paid subscriptions are not enabled yet. Registration, sign-in and workspace setup do not activate a starter content pack or authorize a payment. Production social-content acquisition is not enabled in this account/early-access release. Optional capabilities described below process information only when they are enabled and used. Before enabling new processing, we will update the applicable disclosures and obtain any required permissions. Google sign-in, if offered, is optional.

2. Information we handle

Account and authentication information

We use Clerk to provide authentication and session management. Depending on how you register or sign in, information processed for the account may include your email address, confirmation status, name, profile image if supplied, authentication-provider identifiers, AXASTRO/Clerk user identifiers, linked sign-in methods, workspace memberships, roles, and account-status records.

Google passwords are entered with Google, not provided to AXASTRO. When you use an email-and-password method, our authentication provider handles that method. Do not send passwords, recovery codes, API keys, or payment credentials to our support mailbox.

Workspace and content information

Information you choose to enter can include business name and description, website and public social links, services offered, audience and language preferences, content goals, competitor selections, comments or research notes, draft text, edits, review decisions, schedules, and performance figures you record. Features may retain revisions, source references, and the activity needed to maintain an understandable history.

Do not place confidential client files, privileged communications, passport or identity-document numbers, Social Security numbers, payment-card details, immigration case records, medical information, or other sensitive case material into AXASTRO. Use de-identified examples for marketing preparation. Contact us before any proposed use that requires a separate confidentiality, data-processing, or regulated-data agreement. Sending information to this service does not create an attorney-client relationship with AXASTRO or guarantee that a legal privilege is preserved.

Public-source and research information

When the relevant features are enabled, AXASTRO can obtain publicly available official publications and public social-content information, including source URLs, author or account information, captions, transcripts, dates, engagement metrics, and analysis results. Public-source materials or their general analyses may be reused across workspaces; a user's private business profile, private notes, account information, and drafts are not made public merely because the underlying public source is shared.

Public availability does not mean that information is free of privacy or intellectual-property protections. A person concerned about information in a public-source record can contact support@axastro.com with a specific reference. We will assess the request and the applicable legal and factual context; we cannot promise that we can alter the original third-party publication.

Service usage, diagnostics, and browser information

Our services and infrastructure providers process request and connection information necessary to operate the website, such as IP address, browser and device information, requested routes, timestamps, authentication and security events, errors, and service-operation identifiers. AXASTRO also records relevant in-product actions, operation status, quota use, and billing-flow events when those flows are used. We use this information to operate, secure, troubleshoot, and understand use of the service.

Local browser storage may retain preferences such as language and teleprompter display settings, and limited state for interrupted-session recovery. The current teleprompter is a script reader: it does not request camera or microphone access or record video or audio. It stores reading preferences and limited recovery state rather than recording a performance.

Support communications

When you email us, we process your email address, message, and attachments you intentionally provide. Our support email is hosted by Zoho. Include only information needed to describe the issue; do not send client case files or credentials. We may retain the correspondence and relevant resolution records.

Payment information, only when paid subscriptions become available

AXASTRO does not currently accept production subscription payments. Before enabling payments, we will update the applicable commercial disclosures and payment-provider information. The planned payment provider is Stripe. In an enabled Stripe flow, Stripe would collect the payment details necessary to process a transaction, while AXASTRO would receive account, subscription, payment-status, and billing records needed to administer access. This paragraph does not represent that a paid service or payment method is currently active.

3. Sign in with Google

Data requested and received

When Sign in with Google is available and you choose it, the connection requests only the OpenID Connect sign-in permissions openid, email, and profile (or their equivalent Google scope identifiers). Google and Clerk process the authentication exchange. Basic information made available to the connection can include a stable Google account identifier, your email address and its verification information, your name, and a profile picture if provided. AXASTRO receives the account information made available through its authentication integration for the purposes below.

This Google connection does not request access to Gmail messages or attachments, Google Drive files, Calendar events, contacts, YouTube content, or the ability to post or send messages on your behalf. It does not create a Google Workspace mailbox or transfer your email hosting.

Purposes

We use Google sign-in information to create or identify your account, link an authorized sign-in method, display basic account information, protect account access, administer your existing workspace memberships and permissions, and handle account-support requests. An email address alone does not grant access to another workspace or platform-administrator privileges.

Storage, access, and sharing

Google handles your Google-account authentication. Clerk handles the sign-in connection and session-related records for AXASTRO. AXASTRO stores the limited identifiers and profile information needed for its account and workspace records in its hosting/database environment. Authorized operational personnel and service providers may access the minimum information necessary for account administration, support, security, and compliance with law. Credentials and session tokens are not public profile fields.

We do not sell Google sign-in information, disclose it to advertisers for targeted advertising, or use it to train or fine-tune general-purpose AI models. We do not send Google authentication credentials or tokens to content-generation providers. A user may independently choose to include a name or other personal information in their own business profile or draft; that is a separate user-directed content submission, not permission to repurpose the Google sign-in connection.

Our use of information received through Google APIs is subject to the Google API Services User Data Policy, including applicable Limited Use requirements. Any broader Google-data access would require a separate user-facing feature, an updated disclosure, and the permissions required for that feature. The current sign-in connection is not permission for future Gmail, Drive, or Calendar access.

Your choices

Google sign-in is optional. Email-and-password sign-in remains available where configured for your account. You can review and remove the AXASTRO connection in your Google Account connections settings. Removing that authorization is not the same as deleting information already stored in AXASTRO or deleting your AXASTRO workspace. Before removing your only sign-in method, arrange another supported method so that you do not lose access. For account-data requests, use the contact in Section 8.

4. How we use information

We use the information described above for these purposes:

• Providing accounts, workspaces, available features, saved materials, settings, and user-requested actions.
• Maintaining session security, checking workspace permissions, preventing misuse and duplicate operations, and administering usage limits.
• Responding to support, privacy, and security requests and sending essential service communications.
• Diagnosing failures and improving the reliability and usability of the service using relevant operational information.
• Maintaining records required to resolve disputes, protect legal rights, and comply with applicable obligations.
• Processing optional AI, research, or payment functions only when enabled and requested under the relevant disclosures.

We do not sell personal information or share it for cross-context behavioral advertising. We do not use private workspace content to train or fine-tune our own or another provider's general-purpose models without a separate, informed opt-in. Choosing to generate a draft is permission to process the relevant input to produce that result, not an opt-in to general model training. Account signup is not consent to unrelated marketing. Optional marketing communications, if introduced, will have the choices required by applicable law.

5. AI and optional processing providers

When AI features are enabled and you request them, selected business-profile information, source excerpts, content instructions, relevant research, and draft text may be sent to the configured AI provider to produce or assess a result. Such submissions can contain personal information if you put it in those fields. Do not submit information you are not authorized to disclose.

The provider planned for the current AI implementation is OpenAI. Apify is planned for applicable public-content acquisition and transcription workflows. These production processing paths are not enabled at this policy version's release. Before activation, we will confirm the actual providers and their applicable data-use, retention, and subprocessor settings and update this disclosure as necessary. We do not promise zero provider retention, a particular retention period, or that an endpoint's storage option removes all abuse-monitoring records.

No access to Gmail, Drive, or Calendar is needed for these features. Enabling Google sign-in does not itself send workspace drafts to an AI provider or enable an AI-generation budget.

6. Who receives information

Optional AI/research providers and a future payment provider are described separately above; their inclusion as planned providers does not mean production processing is already active. Information is provided to each recipient only as relevant to its stated role and the processing actually performed.

If ownership of the service changes, information may be considered or transferred as part of a legitimate transaction, subject to appropriate confidentiality, notice, legal requirements, and any additional consent required by the Google API Services User Data Policy or other applicable rules. This clause does not authorize an undisclosed change of purpose or avoidance of your rights.

7. Locations, security, and retention

Locations

AXASTRO LLC is organized in New Jersey, United States. The public correspondence address above is a contact address, not a statement about the location of every service operation or data store. The current application infrastructure includes processing in the United States and a primary application database/storage deployment in Canada. Authentication, support, and other service providers may process information in additional locations in accordance with their applicable terms. This is not a promise that all data, logs, support access, or backups stay exclusively in one country.

Where a transfer requires a particular legal safeguard, that safeguard must be established for the applicable processing before it occurs. Merely using the service or accepting these Terms does not replace a required transfer mechanism. Contact us with questions about the processing relevant to your account.

Security

We use technical and organizational measures appropriate to the service, including encrypted connections, authentication, workspace-based access controls, restricted operational access, and separation of production from test environments. No method of storage or transmission is completely secure. This notice is not a claim of end-to-end encryption, a named security certification, a completed external audit, or a guarantee against every incident.

Retention

We retain account and workspace information while needed to provide the account and selected features and for the additional periods reasonably necessary for security, support, legal obligations, and resolution of disputes. Relevant criteria include whether the account remains active, whether content is still needed by an authorized workspace, whether a deletion request has been made, and whether a record is subject to a specific retention obligation or legal hold.

Drafts, revisions, and source records may remain available while the associated workspace is maintained. Ending paid feature access, if paid features are later introduced, is not automatically a request to erase all saved materials. We will not treat the label of a quota period or the expiry of an OAuth authorization as an automatic deletion schedule.

Deletion from active systems may not immediately remove a copy in restricted backups. Backup copies are not a second live account and are retained only for the applicable recovery and retention purposes. Restoring a backup does not cancel a valid deletion request. Before restored personal information is returned to ordinary use, we review it against recorded requests and apply the restrictions or deletions required by those requests. A database backup does not include separately stored object files, and different categories and providers can have different retention periods.

8. Access, correction, deletion, and privacy choices

Privacy requests are handled manually. We do not currently provide one automatic action that erases an account and all associated authentication, workspace, storage and backup records. We explain which actions are available for the request and any unresolved part; removing an account or a connection is not proof that every copy has been erased.

Contact AXASTRO LLC at support@axastro.com with the subject Privacy request to ask about access, correction, export where applicable, deletion, objection, or other rights that apply to you. Identify your account email and describe the request. We may ask for proportionate information to verify your identity and authority. Do not send a password, authentication token, or identity document unless a secure, necessary verification process is specifically arranged.

Where a business customer controls the relevant workspace information, we may need to refer or coordinate the request with that customer. We will not use a request about one person's information to disclose another person's private records. Account closure, removal of a Google connection, deletion of workspace content, and cancellation of a future subscription are different actions; we will clarify the scope before taking an irreversible step.

Depending on the law applicable to the processing, you may have rights to receive information, access or correct data, request deletion, receive a portable copy, restrict or object to processing, withdraw consent, opt out of specified data uses, appeal a denied request, or complain to a competent authority. These rights are subject to applicable conditions and exceptions. We do not claim that every privacy statute applies to every user or that a statement in this policy removes a mandatory right.

Requests will be assessed and answered within the time required by applicable law. Where a request cannot be completed as asked, we will explain the applicable reason and available next steps. We will not impose retaliation for exercising an applicable privacy right.

More guidance is available at Data deletion and account requests.

9. Cookies, local storage, and tracking choices

AXASTRO and its authentication/infrastructure providers use cookies or similar browser mechanisms needed for authentication, session security, request protection, and service preferences. The application also uses browser storage for preferences and limited session recovery. You can manage browser storage through your browser settings, but blocking necessary mechanisms may prevent login or other features from working.

Our no-sale and no-cross-context-advertising commitments in Section 4 apply to information handled through browser technologies as well. Authentication and security mechanisms are distinct from optional measurement; we do not describe every browser-storage item or provider feature as strictly necessary. Browser Do Not Track settings do not themselves disable cookies needed for login or security. Browser controls do not replace any binding opt-out requirement, including a legally applicable universal opt-out signal. Before introducing non-essential trackers, we will accurately disclose them and implement consent or opt-out controls where required. Continued use of a website is not treated as a substitute for any legally required affirmative cookie consent.

This section does not describe the behavior of an unrelated website that you visit through an external link or the settings of your own Google account.

10. Children and professional use

AXASTRO is intended for adults using a professional content workspace and is not directed to children. Do not register or submit information if you are under 18. If you believe a child has provided information contrary to this policy, contact us so that we can investigate and take appropriate action. This age restriction is a service policy; it is not a statement that every child-privacy law has the same age threshold.

11. Changes and contact

We will identify the effective date when publishing this policy or a later revision. Material changes will be communicated in an appropriate way before they apply where required. A new purpose for Google user data will not be introduced solely by silently editing this page: we will provide the disclosures and obtain the permissions or consent required for the change.

For questions or requests, contact AXASTRO LLC at support@axastro.com or write to AXASTRO LLC at the public correspondence address above. Service notices may also be sent from nik@axastro.com. These addresses belong to AXASTRO; do not send sensitive client records or secrets in ordinary email.