Privacy Policy

Creator resources and community

Creator profiles, seller-supplied business names, addresses and contact emails, and approved resource descriptions, prices, licenses, discussions, and replies are public. Private prompt contents, uploaded resource files, working revisions, and moderation feedback are accessible only to their creator, entitled buyers where appropriate, and the owner. Download links expire after one minute; an entitled buyer can request another.

Service briefs and messages are visible to their participants and the owner for support and moderation. Reports are visible to their reporter and the owner. Do not include sensitive information in posts, files, or messages. We validate archive structure and file limits, but do not execute uploaded code or certify it as malware-free.

Stripe Connect receives sellers’ identity, business, and bank information directly during onboarding. Astra records an account reference, country, and payment readiness, alongside order references, licensed-version snapshots, digital supply consent, payment status, and the 5% commission. We do not store full card or bank credentials. Transaction information required by Stripe may be visible to the seller in their payment account; Astra’s public pages never expose buyer emails.

On account deletion we remove the public creator identity, hide authored discussions, close service conversations, and erase unpurchased draft content. Purchased versions may remain for buyers under their licenses. Closed conversations remain available to the other participant and are reviewed for deletion after two years unless needed for an unresolved issue. Transaction and necessary contract records can remain restricted for up to six years. Unreferenced files belonging to deleted accounts are removed by the cleanup worker.

Who is responsible

Continual Labs Limited (company number 17387340) is the data controller for Astra.Directory. Our registered address is 23 Oaklands Road, Northfleet, Gravesend, England, DA11 8PA. Contact hello@astra.directory about your information or use the form below.

Accounts and submissions

We process your email, verified sign-in identity, display name, optional website, session information, submitted project details, images, review history and account requests to provide the service and manage our agreement with you. Google sign-in shares the basic identity information you authorize, such as your email and profile name. We do not receive your Google password.

Drafts, private uploads and contact emails are accessible to the account holder and authorized platform administration. Approved project information, creator credits, links and processed screenshots are published. Publicly available showcase material is included for our legitimate interest in operating an attributed editorial collection; you can request a correction or removal.

Payments, messages and consent

Stripe processes checkout, payment credentials, fraud checks and refunds. Astra stores order references, amounts, status, dates, email and placement records. We do not store full card numbers. Processing supports our contract, fraud prevention and legal accounting obligations. Preview orders use test mode.

We send authentication and service messages needed to run your account and respond to your requests. Newsletter emails require separate consent and email confirmation. We record consent and subscription status. Unsubscribing stops future editions without stopping essential service messages.

Measurement and security

We count page views and outbound project visits in daily aggregates, not unique visitor profiles. We do not use advertising trackers. To reduce abuse, the application temporarily stores a hashed identifier derived from a request IP, action and time window. We do not save the raw IP in the application database. Hosting and security providers may process IP addresses and technical logs. We use legitimate interests in security, troubleshooting and understanding which content is useful.

Suppliers and international processing

Vercel provides website hosting and server functions. Supabase provides the Postgres database, authentication and file storage. The hosted database and application functions are configured in Mumbai, India; these suppliers may also process data in other locations for their operations. Hostinger delivers and hosts email. Stripe handles payments. Google provides optional sign-in. GitHub hosts application source and deployment integration; user submissions are not stored in the source repository.

These suppliers process information under their applicable service and data-processing terms. International processing may rely on contractual transfer safeguards, including applicable standard contractual clauses and UK transfer provisions. Contact us for information about the safeguards relevant to your data. External projects linked from the directory have their own privacy practices.

Retention

Account profiles and saved drafts remain while your account is active, until deletion or an editorial removal request is processed. Published records and credits remain while the listing is maintained. Deletion requests are handled by the owner; current orders or disputes may need resolution first. Financial records are restricted and retained for up to six years where needed for tax, accounting and claims.

Newsletter suppression records are retained while needed to respect your choice. Email message bodies are cleared from accepted or suppressed queue records after 90 days; delivery metadata remains for operational review. Mailbox copies follow the operator’s mailbox review and deletion process. Rate-limit identifiers expire and are removed after an additional day. Aggregate event counts are kept for 13 months, job records for 30 days, and support and audit records are reviewed for deletion after two years unless needed for a continuing issue or legal obligation.

Data in provider logs and backup copies follows the provider’s retention and the operator’s documented backup rotation. Restoring a backup requires reapplying subsequent deletion requests before the restored service is used.

Your choices and rights

You can edit your profile, manage listings, unsubscribe and request account deletion from your dashboard. Depending on applicable law, you may also request access, correction, erasure, restriction, objection or a portable copy of your personal data. We may need to verify your identity and explain any information that must be retained. You can withdraw marketing consent at any time.

Contact us first with a privacy concern so we can investigate. You can also complain to the UK Information Commissioner’s Office at ico.org.uk or the relevant authority where you live. We do not use your data for solely automated decisions with legal or similarly significant effects.

Send a message