Effective [effective date]
1. What this policy covers
This policy explains how Astra FP&A LLC (“we” or “us”) handles personal information on the Astra FP&A website, through our contact form, and in Astra FP&A accounts.
Colleges that subscribe to Astra FP&A control the data they put into the Service. For that data we act as the college's service provider (a “processor”), under our Terms of Service and Data Processing Agreement. If you have a question about your college's data, your college's Astra FP&A account owner is the first person to ask; we'll help them answer it.
2. What we collect
When you visit the website
We don't use advertising or third-party analytics trackers. Like any website, our servers keep basic request logs (IP address, browser type, the page requested and the time) to keep the site running and secure.
When you contact us
The “Talk to us” form asks for your name, title, college, work email, and optionally your phone number, your college's size and ERP, a message, and how you heard about us. We record which page you sent it from. To limit spam we keep a one-way hash of your IP address, not the address itself.
When you use the website chat
The “Ask about Astra FP&A” chat on the website sends your questions to our AI provider (Anthropic) to write the answers. We keep the conversation, the page you asked from and a one-way hash of your IP address, to answer follow-ups, improve the answers and limit abuse. Please don't type personal or financial details into it. If you choose “Talk to a person,” we also keep the name, email, institution and question you give us, as with the contact form.
When you request a quote
A quote request asks for a contact name and work email, your institution, the plan, and optionally a billing email, whether you need a purchase order, and notes. We keep the quote and a one-way hash of your IP address, and use them to prepare the order and invoice.
When you have an account
- Profile: your name, work email, college and role.
- Sign-in: your password, stored only as a salted hash; two-step verification settings (authenticator secrets are encrypted; passkeys store only a public key); and sign-in sessions, stored as hashes of the session token.
- Activity: a record of important actions, such as uploads, role and permission changes, and changes to forecast assumptions, with who made them and when.
- Analyst conversations: the questions you ask the AI analyst and its answers, so you can return to them.
What colleges upload
Astra FP&A is built for totals and summaries, not records about individual people. Uploads are scanned and refused if they appear to contain names, ID numbers, Social Security numbers, dates of birth, email addresses, phone numbers or home addresses.
4. How we use it
- to provide the Service, including the AI analyst, and to keep it secure;
- to answer your questions and provide support;
- to bill your college and manage its subscription;
- to understand, in aggregate, how features are used so we can improve them;
- to follow up on a contact form request, for example to schedule a conversation;
- to meet legal obligations and enforce our agreements.
We don't sell personal information, share it for cross-context behavioral advertising, or use college data to train AI models.
5. The AI analyst
When you ask the analyst a question, we send your question, the relevant results of the Service's calculations and the page you're on to our AI model provider to produce the answer. Under our agreement with that provider, it doesn't use this content to train its models. It may keep it for a limited period under its terms, for example to monitor for abuse.
7. How long we keep it
- Account information: while the account is active. When a college's subscription ends, its data is deleted within 60 days, as the Terms describe.
- Contact form requests and quotes: up to three years after our last contact with you, or sooner if you ask.
- Website chat conversations: 180 days.
- Free trials that end without a subscription: the trial's data is deleted 90 days after the trial ends.
- Server logs: a short period, generally no more than 30 days, unless needed to investigate a security issue.
- Backups: overwritten on a rolling schedule within 35 days.
8. How we protect it
Data is encrypted in transit, and each college's data is kept separate in the database itself. We offer passkeys and two-step verification, limit staff access to what's needed, and record important actions. More detail is on our Security page and in the Data Processing Agreement. No system is perfectly secure; if an incident affects your information, we'll notify you or your college as the law and our agreements require.
9. Your choices and rights
You can see and update your profile in the app. You can ask us to access, correct, export or delete your personal information, or to stop contacting you, by emailing privacy@astrafpa.ai. If your request concerns data your college controls, we'll work with your college to respond. Depending on where you live, you may have additional rights under state law; we honor these requests for everyone, wherever they live, and won't treat you differently for making one.
10. Children
Astra FP&A is a tool for college staff. It isn't directed to children, and we don't knowingly collect personal information from anyone under 16.
11. Where data is stored
We store and process data in the United States.
12. Changes to this policy
We'll post any changes here with a new effective date. If a change is material, we'll tell account owners by email before it takes effect.
13. Contact us
Astra FP&A LLC, [mailing address]. Email privacy@astrafpa.ai.