AstraPay Privacy Notice
Effective Date: April 6, 2026
This Privacy Notice explains how Astra, a company incorporated under the laws of the Cayman Islands, and its affiliates (collectively, "Astra," "we," "us," or "our") collect, use, protect, and share your Personal Data when you interact with the AstraPay platform, including its website (pay.byastra.ai), dashboard, APIs, smart contracts, blockchain integrations, and related tools or services (collectively, the "Platform").
AstraPay is a non-custodial, non-KYC crypto payment processing platform. We do not hold, store, or control your funds, tokens, or private keys at any time.
By using the Platform, you agree to this Privacy Notice. If you disagree, please do not access or use the Platform. We may update this notice to reflect legal or operational changes, notifying you of material updates via email or Platform announcements. Continued use after updates constitutes acceptance.
The Platform is intended for users aged 18 and over. By using the Platform, you confirm you are at least 18 years old. This restriction is a terms-of-service requirement. If we learn that a minor has provided Personal Data, we will delete it promptly upon notification to support@byastra.ai.
Data Controller
Astra, based in the Cayman Islands, is the data controller, determining how and why your Personal Data is processed. We engage third-party processors (e.g., cloud providers, analytics services) under strict confidentiality agreements to support Platform operations.
Personal Data We Collect
We collect Personal Data only from merchants who register and use the AstraPay Platform. We do not collect Personal Data from end customers who make payments through AstraPay-powered checkout pages.
Merchant Account Data
- Full name or company/business name
- Email address
- Country of residence or operation
- Password (stored in hashed form — never in plain text)
Wallet & Payment Data
- Merchant wallet addresses added to the Platform for receiving payments
- Payment records including amounts, tokens, networks, status, and associated metadata
- Transaction history visible in the merchant dashboard
Astra Coins
- Internal platform coin balance and transaction history
- Coin-to-USDC conversion records
- On-chain data is generated only when depositing or withdrawing from the Platform
API Key Data
- Key prefix (first 8 characters, for display purposes only)
- Last used timestamp
- No per-request logging, no IP address logging, no full key storage
Webhook Delivery Data
- Webhook endpoint URLs
- Full delivery payloads (JSON)
- Event types, delivery status, attempt count, response codes and bodies
- Timestamps of delivery attempts
- Retained for 30 days then automatically deleted
Analytics Data
- Website usage data collected via Google Analytics (Measurement ID: G-NSB8V3TQ0X), including page views, session duration, bounce rate, device type, browser type, and general geographic location (country/region level)
How We Collect Data
- Directly from you — through account registration, dashboard usage, support requests, and voluntary submissions
- Automatically — via cookies, web beacons, or server logs during Platform use
- From public blockchains — wallet addresses and transaction data visible on-chain
Cookies and Tracking Technologies
We use cookies and similar technologies to ensure Platform functionality, security, and performance.
- Essential Cookies — required for Platform operation (e.g., login sessions)
- Functional Cookies — save preferences for seamless navigation
- Analytics Cookies — track usage to optimize performance via Google Analytics
- Targeting Cookies — deliver Platform-relevant content, managed by us or approved partners
We do not use cookies for third-party advertising or data sales.
You can block or delete cookies via your browser or device settings. To opt out of Google Analytics tracking, install the Google Analytics opt-out browser add-on or adjust your browser settings to block cookies.
Why We Process Personal Data
We process Personal Data to:
- Operate the Platform, including payment processing, product management, and webhook delivery
- Create and manage merchant accounts
- Enable API access and key management
- Process Astra Coins and USDC conversions
- Provide customer support and respond to inquiries
- Ensure platform security and detect fraudulent or malicious activity
- Analyze usage to improve Platform performance and user experience
- Meet applicable legal obligations
- Communicate Platform-related updates and announcements
Legal Bases
- Contractual Necessity — to provide Platform services and execute merchant agreements
- Legitimate Interests — for security, analytics, and operational efficiency
- Consent — for optional communications and marketing, where explicitly agreed
- Legal Obligations — to comply with applicable laws and regulations
Sharing Personal Data
We share Personal Data only when necessary and with appropriate safeguards:
- Astra Ecosystem Affiliates — with entities within the Astra ecosystem for operational purposes, under strict data protection standards
- Service Providers — with vendors (e.g., cloud hosting, analytics) bound by confidentiality agreements, solely for Platform purposes
- Legal Requirements — with authorities or courts to comply with legal obligations or respond to lawful requests
We do not sell Personal Data. We do not share Personal Data for non-Platform purposes without your consent, except as required by law.
Data Retention
| Data Type | Retention Period |
|---|---|
| Merchant account data | Duration of account + 5 years post-closure |
| Payment & transaction records | 5 years for compliance purposes |
| Webhook delivery logs | 30 days, then automatically deleted |
| API key data (last used timestamp) | Duration of key validity |
| Analytics data | Up to 2 years, unless anonymized |
| Astra Coins transaction history | Duration of account + 5 years |
Post-retention, data is deleted or anonymized, except for blockchain-based data which is immutable and outside our control.
Blockchain Data and Privacy
Payment transactions processed through AstraPay result in on-chain activity when funds are deposited to or withdrawn from the Platform. Wallet addresses and transaction details are publicly visible on the relevant blockchain and may be analyzed or linked to your identity by third parties.
As a non-custodial provider, Astra has no control over public blockchains and cannot delete, modify, or restrict on-chain data. By using the Platform, you accept this inherent privacy characteristic of blockchain technology.
Merchant wallet addresses stored on the Platform are configuration data only — they represent the destination for incoming payments and do not constitute a custodial relationship. When a payment is initiated, a temporary deposit address is generated to route funds directly to the merchant's designated wallet. AstraPay never holds, controls, or has access to funds at any point in this process.
Data Security
We protect your Personal Data with:
- Encryption for data in transit and at rest
- Password hashing — plaintext passwords are never stored
- Access controls limiting data to authorized personnel only
- Regular security audits and vulnerability testing
- Analytics to detect fraud and malicious activity
As a non-custodial provider, we do not control your funds, tokens, or private keys. You are responsible for securing your account credentials, wallet keys, and API keys. Astra is not liable for losses resulting from user error, third-party breaches, or blockchain vulnerabilities.
International Data Transfers
As a Cayman Islands-based entity, we may transfer Personal Data to other jurisdictions (e.g., the United States or European Union) for processing and storage. We use contractual agreements to protect your data during such transfers. By using the Platform, you consent to these transfers, acknowledging that other jurisdictions may have different privacy standards.
Your Privacy Rights
Depending on your jurisdiction, you may have the right to:
- Access — view the Personal Data we hold about you
- Correct — fix inaccurate or incomplete data
- Delete — request deletion, subject to legal exceptions
- Restrict — limit how we process your data
- Portability — receive your data in a machine-readable format where feasible
- Object — challenge processing based on legitimate interests
- Withdraw Consent — stop consent-based processing at any time
To exercise any of these rights, email support@byastra.ai with proof of identity and a clear description of your request. We will respond within 30 days. Note that blockchain-based data cannot be deleted or modified.
Complaints
If you believe we have mishandled your Personal Data, contact support@byastra.ai. We will investigate and respond within 30 days. If unresolved, you may escalate to the Cayman Islands Ombudsman or relevant data protection authority in your jurisdiction.
Additional Information
- Third-Party Links — The Platform may link to external sites such as blockchain explorers. We are not responsible for their privacy practices.
- Non-Custodial Limitations — As a non-custodial provider, we cannot control or ensure privacy for blockchain data once it is recorded on-chain.
- Children — The Platform is not intended for anyone under 18. Use of the Platform constitutes confirmation that you meet this requirement.
- Updates — Check the effective date above for the latest version. Material changes will be communicated via email or Platform announcements.
- Contact — For any privacy-related inquiries: support@byastra.ai