Privacy Policy

1. Introduction

Asteri ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service management platform, including our integrations with third-party services such as Meta (Facebook and Instagram), Google services, Stripe, and communication providers.

This policy applies to all users of the Asteri platform, including service business owners and their team members ("Business Users") and customers who book services through the platform ("End Customers").

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Name
• Organization/business name
• Password (securely hashed — we never store plaintext passwords)

2.2 Booking & Customer Information

When End Customers book a service, we collect:

• Name, email address, and phone number
• Service address
• Service selections and preferences
• Special instructions or notes

This information is collected on behalf of the Service Provider and is shared with them to fulfill your booking.

2.3 Payment Information

Payment processing is handled entirely by Stripe, Inc. Your card number, expiration date, and CVC are transmitted directly to Stripe and are never stored on Asteri’s servers. We receive only:

• A confirmation that the payment succeeded or failed
• The last four digits of the card (for display purposes)
• The card brand (e.g., Visa, Mastercard)
• Transaction amounts and timestamps

2.4 Google Business Profile Data

When a Business User connects their Google Business Profile, with their explicit consent, we access and store:

• Business Locations: Name, address, phone number, website, business hours
• Reviews: Customer reviews, star ratings, reviewer display names, and your responses
• Posts: Business updates, offers, and events you create through our platform
• Performance Insights: Search views, map views, website clicks, direction requests, phone calls
• OAuth Tokens: Encrypted access and refresh tokens to maintain your connection

2.5 Gmail Data

When an authorized Business User connects Gmail, we access the connected account email; message and thread identifiers; sender and recipient addresses; subjects; message previews and content needed for the requested mailbox view; labels; and attachment metadata. We also access attachment content when it is downloaded for a customer-linked business record. If a user sends email from Asteri, we transmit the user-composed message through the connected Gmail account.

Asteri stores encrypted OAuth tokens, synchronization cursors, message metadata and previews, customer associations, and customer-linked attachments so authorized organization members can use the communications timeline and continue mailbox synchronization.

2.6 Google Calendar Data

When an authorized Business User connects Google Calendar, we access the connected account email, calendar list, and event information including event titles, descriptions, locations, attendees, organizers, availability, and start and end times. We use this data to select calendars, synchronize availability, prevent scheduling conflicts, and create, update, or remove Asteri-related events according to the organization’s settings.

2.7 Google Drive Data

Asteri requests the limited Google Drive permission that applies only to files and folders a user creates with Asteri or explicitly opens or selects for use with Asteri. We access file and folder names, identifiers, types, sizes, links, modification times, and file content when needed to complete a user-requested browse, upload, download, folder-creation, link, or deletion action. File bytes may pass through Asteri to complete the requested transfer; Asteri does not copy a user’s entire Google Drive.

2.8 Google Ads and Data Manager Data

When an authorized Business User connects Google Ads, we access the connected account email; accessible Google Ads customer accounts; campaign, ad-group, keyword, spend, performance, and conversion-action information; and Data Manager partner-link status when partner onboarding is used. We use this information to report marketing performance, associate leads and revenue with campaigns, configure and verify conversion actions, and upload user-authorized conversion or event data.

2.9 Meta (Facebook and Instagram) Platform Data

When a Business User connects a Facebook Page, Instagram professional account, or Meta Ads account, with their explicit consent, Asteri may access and store:

• Meta user, Business Manager, Facebook Page, Instagram professional account, ad account, Pixel, and lead-form identifiers and display names
• Facebook Page messages, posts, comments, sender names, and profile pictures needed for the Communications inbox and authorized replies or moderation
• Instagram Direct messages and professional-account profile or media information needed for the Communications inbox and authorized feed publishing
• Meta Ads campaigns, ads, spend, performance insights, conversion events, and lead form submissions used for attribution, reporting, authorized Pixel/conversion tracking, and CRM lead creation
• Granted permissions and encrypted OAuth access tokens needed to maintain the connection

Asteri uses this data only to provide the Meta integration features selected by the Business User. We do not sell Meta Platform Data, use it to build advertising profiles for third parties, or share it with unrelated organizations.

2.10 Communications Data

When Business Users use our communication features, we process:

• SMS messages: Sent and received via Telnyx on behalf of the Business User
• Emails: Sent via Resend on behalf of the Business User (appointment confirmations, invoices, review requests, etc.)

2.11 Log & Device Data

When you access the platform, we automatically collect:

• IP address
• Browser type and version
• Device type and operating system
• Pages visited and time spent on each page
• Referring URL
• Date and time of access

2.12 Location & Vehicle Data

When a Business User enables mobile location features (such as field-technician tracking, time-clock geofencing, dispatch, or route optimization) or connects a vehicle telemetry device, we collect:

• Precise GPS coordinates (latitude and longitude)
• Speed, heading, and timestamps
• Trip history (start/stop points, route taken)
• For connected vehicles: telemetry such as ignition status, odometer, and device identifiers, received via our integration partner Flespi

On mobile, location may be collected in the background while the app is open or while you are clocked in, in accordance with the permissions you grant your device. Location data is visible only to authorized users within your organization and is used for dispatch, time and attendance, vehicle history, and analytics. You may disable location collection at the device level or by signing out / clocking out; certain features (live dispatch, drive-time analytics) will not function while location is disabled. Business Users are responsible for informing their team members about location tracking before enabling it and for complying with applicable employment and privacy laws.

2.13 Marketing Performance and Benchmark Data

When a Business User connects advertising or marketing integrations, or uses Asteri’s marketing analytics tools, we may process campaign, ad account, spend, lead, booking, and attributed revenue metrics. We use this information to show your own marketing performance and, unless you opt out, to create aggregate peer benchmark snapshots.

Benchmark snapshots are designed to protect business confidentiality. We do not expose customer records, click identifiers, ad-account identifiers, raw organization totals, or named businesses in peer benchmarks. We only show percentile ranges for cohorts that meet Asteri’s minimum qualification rules, including a minimum cohort size of 10 qualified businesses and a minimum monthly ad-spend threshold.

Organization owners and authorized administrators can opt out of contributing to future aggregate benchmark snapshots, or hide benchmark comparisons in their own workspace, from Marketing Settings.

2.14 What We Do NOT Collect

• Full credit or debit card numbers (handled by Stripe)
• Social Security numbers or government-issued ID numbers
• Personal information of reviewers beyond their public display name
• Google account data outside the services and permissions you explicitly authorize
• Google Contacts or Google People data; Asteri does not request a Google Contacts permission
• Biometric identifiers (facial geometry, fingerprints, voiceprints)

3. How We Use Your Information

We use the collected information to:

• Provide, operate, and maintain the platform and its features
• Process bookings and facilitate communication between Business Users and End Customers
• Process payments through Stripe on behalf of Service Providers
• Send transactional communications (confirmations, reminders, invoices)
• Display your business locations and performance metrics in our dashboard
• Enable you to view and respond to customer reviews
• Synchronize authorized Gmail business communications and send messages composed by authorized users
• Synchronize selected Google Calendars, avoid scheduling conflicts, and manage Asteri-related events
• Complete user-requested Google Drive file and folder operations on items authorized for use with Asteri
• Import Google Ads performance and upload user-authorized conversion or event data through Google Ads or Data Manager
• Generate AI-powered suggestions (review responses, floor inspection analysis, proposal and estimate drafting, smart chat replies, marketing copy generation)
• Provide dispatch, routing, time-and-attendance, and vehicle-history features using device or vehicle location data, for Business Users who enable those features
• Provide analytics and insights about your business performance
• Create privacy-preserving aggregate marketing benchmarks that help Business Users understand how their marketing performance compares with qualified peer cohorts
• Measure product usage and improve the Service through first-party product analytics (such as which steps of the booking flow customers complete or abandon). These events are recorded by Asteri directly and are not shared with third-party advertising or marketing companies
• Monitor errors, crashes, and performance through our error-monitoring provider (Sentry), to keep the Service reliable
• Detect and prevent fraud, abuse, and security threats
• Comply with legal obligations

4. Data Storage and Security

4.1 Encryption

All OAuth tokens are encrypted using AES-256-GCM encryption before being stored. Tokens are never stored in plaintext. All data in transit is encrypted using TLS 1.2 or higher.

4.2 Access Control

Your data is isolated at the organization level by application-layer access controls enforced on every API request. Only authenticated users within your organization, and with the appropriate role-based permissions, can access your data.

4.3 Infrastructure

Our data is hosted on secure cloud infrastructure with industry-standard security measures, including encryption at rest and in transit. File uploads are stored on Cloudflare R2 with access-controlled URLs.

4.4 PCI Compliance

Asteri does not process, store, or transmit cardholder data. All payment card processing is handled by Stripe, which is certified as a PCI Level 1 Service Provider.

5. Data Sharing

We do NOT:

• Sell your data to third parties
• Share your organization-level business data with other organizations on the platform, except as aggregate or de-identified benchmark statistics described below
• Use your data for advertising purposes
• Transfer your data to third parties for their marketing purposes

For purposes of the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA), we do not “sell” or “share” your personal information as those terms are defined in Cal. Civ. Code § 1798.140.

We do not use Google Workspace data from Gmail, Google Calendar, or Google Drive for advertising, ad targeting, creditworthiness, lending, or aggregate marketing benchmarks. We do not transfer Google Workspace data to advertising platforms.

We share data with the following categories of service providers:

• Service Providers you book with: Your booking details and contact information to fulfill your appointment
• Payment processor (Stripe): Transaction data necessary to process payments and prevent fraud
• Communication providers (Telnyx, Resend): Phone numbers and email addresses necessary to deliver SMS, voice calls, and email
• AI provider (OpenAI): When you use AI features (Smart Chat, Floor Inspector, proposal and estimate generation, review-response suggestions, marketing studio drafting), the content you submit to those features—including customer names, addresses, service descriptions, photos, and chat messages—is transmitted to OpenAI’s API over an encrypted connection so the model can generate a response. We do not anonymize or pseudonymize content before transmission. Under OpenAI’s default API terms, data submitted via the API is not used to train OpenAI’s general-purpose models, but OpenAI may retain inputs for a limited period for abuse monitoring and policy enforcement. See OpenAI’s Privacy Policy. We may add or change AI providers in the future and will update this Section and Section 8 if we do. If you do not want particular content processed by an AI provider, do not submit it to AI features.
• Vehicle telemetry provider (Flespi): For Business Users who enable vehicle tracking, device identifiers and GPS telemetry are exchanged with Flespi to deliver fleet features
• File storage (Cloudflare R2): Files, photos, and documents you upload are stored on Cloudflare R2 with access-controlled URLs
• Legal compliance: When required by law, subpoena, or court order, or to protect the rights, property, or safety of Asteri, our users, or the public
• Business transfer: In connection with a merger, acquisition, financing, reorganization, or sale of assets

5.1 Aggregate Marketing Benchmarks

Asteri may use Business User marketing performance data to produce aggregate or de-identified benchmark statistics, such as median cost per lead or peer percentile ranges by service vertical and monthly ad-spend band. These statistics are generated as precomputed snapshots and are not designed to identify any individual customer, team member, ad click, ad account, or named business.

We suppress benchmark rows unless the cohort meets our minimum privacy thresholds. We also show only coarse sample-size labels, such as “10+ businesses,” instead of exact contributor counts. If you turn off benchmark contribution, your organization is excluded from future benchmark snapshots. Previously generated aggregate statistics may remain if they no longer identify your organization.

6. Data Retention and Deletion

6.1 Active Accounts

While your account is active, we retain your data to provide our services. Booking and payment records are retained for at least 7 years for tax and legal compliance purposes.

6.2 Google Business Profile Disconnection

When you disconnect your Google Business Profile from Asteri, we immediately and permanently delete all cached reviews, posts, performance insights, business location data, review request history, and OAuth tokens.

6.3 Other Google Integration Disconnection

Disconnecting Gmail removes stored OAuth tokens, disables the provider account, and stops future synchronization. Previously synchronized message records and customer-linked attachments remain as organization business records until an authorized user deletes the related data, the organization account is deleted, or a verified deletion request is completed.

Disconnecting Google Calendar removes its OAuth connection, synchronization mappings, and cached busy-time data and stops future synchronization. Disconnecting Google Drive deletes the stored connection but does not delete files from Google Drive. Disconnecting Google Ads or Data Manager attempts to revoke the Google grant, deletes stored OAuth tokens and connection configuration, and stops future imports and uploads; previously imported campaign and conversion records may remain as organization business records until account deletion or a verified deletion request.

6.4 Meta Platform Data Disconnection and Deletion

To disconnect Meta and stop Asteri’s access:

1. Sign in to Asteri.
2. For Facebook or Instagram, open Settings > Integrations and select Disconnect for the connected account. For Meta Ads, open Marketing > Settings and disconnect Meta Ads.
3. You may also revoke Asteri from Facebook’s Business Integrations settings.

Disconnecting deletes Asteri’s stored OAuth token and connection configuration and stops future Meta data collection. Historical business records, such as messages, published-post history, leads, and campaign reporting already imported into the organization’s workspace, remain subject to the organization’s normal retention settings.

To request deletion of stored Meta Platform Data, email notifications@getasteri.com from the email address associated with your Asteri account and include your organization name and the connected Facebook, Instagram, or Meta Ads account. After verifying the request, we will delete the applicable Meta Platform Data within 30 days, except records we must retain for legal, security, fraud-prevention, or financial-compliance obligations.

6.5 Account Deletion

If you delete your Asteri account, all data is permanently deleted within 30 days, except where retention is required by law.

6.6 Benchmark Opt-Out Retention

If you opt out of contributing to aggregate marketing benchmarks, we stop using your organization’s marketing performance data in future benchmark snapshot generation. Historical aggregate or de-identified snapshots may remain in the Service when they cannot reasonably be used to identify your organization or any person.

6.7 End Customer Data

End Customer data is retained by the Business User’s organization, which is the data controller. End Customers who wish to have their data deleted should contact the Service Provider directly using the contact information on their booking confirmation.

Backstop: If a Service Provider does not respond to a deletion request within 30 days, the End Customer may contact us at notifications@getasteri.com with a copy of the original request. Upon verification, we will delete the End Customer’s personal data from our systems within 30 days of receiving the escalation, except where retention is required by law (for example, transaction records retained for tax or anti-fraud purposes), in which case we will restrict processing of that retained data to the legally required use.

7. Your Rights

You have the right to:

• Access: Request a copy of all data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data (subject to legal retention requirements)
• Portability: Request a copy of your data in a portable, machine-readable format
• Disconnect: Remove any third-party integration at any time from Settings
• Revoke: Revoke Asteri's access to Google directly through your Google Account settings
• Opt-out: Opt out of non-essential communications at any time

To exercise any of these rights, contact us at notifications@getasteri.com. We will respond within 30 days.

8. Third-Party Services

Our platform integrates with the following third-party services:

• Stripe: Payment processing. Stripe Privacy Policy
• Google APIs: Optional Google Sign-In, Gmail, Calendar, Drive, Business Profile, Google Ads, and Data Manager integrations. Google Privacy Policy
• Meta Platforms (Facebook, Instagram, and Marketing API): Business messaging, Page and Instagram publishing, lead retrieval, advertising management, and campaign reporting. Meta Privacy Policy
• Telnyx: SMS messaging and voice calling. Telnyx Privacy Policy
• Resend: Email delivery. Resend Privacy Policy
• Cloudflare R2: File storage. Cloudflare Privacy Policy
• OpenAI: AI inference for Smart Chat, Floor Inspector, proposal and estimate generation, review-response suggestions, marketing studio drafting, and other AI features. OpenAI Privacy Policy
• Flespi: Vehicle telemetry for fleet and routing features, for Business Users who enable vehicle tracking. Flespi Privacy Policy
• Sentry: Application error and performance monitoring. Sentry receives error stack traces and a sample of performance traces from the platform. We do not enable session replay and our Sentry configuration is set to omit personally identifying request data by default. Sentry Privacy Policy

9. Cookies and Tracking

We use essential cookies to maintain your session and preferences. We do not use third-party tracking or advertising cookies. For full details, see our Cookie Policy.

10. Children's Privacy

Asteri is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

11. Our Role as Data Processor

When Service Providers use the Asteri platform to collect and manage End Customer data, the Service Provider is the "data controller" and Asteri acts as a "data processor" on their behalf.

• The Service Provider determines why and how End Customer data is collected and used
• Asteri processes this data only as necessary to provide the platform’s features
• End Customers with questions about how their data is used should contact the Service Provider directly
• Service Providers are responsible for ensuring they have a lawful basis to collect and process their customers’ data

12. California Consumer Privacy Act (CCPA)

If you are a California resident, you have additional rights under the CCPA:

• Right to Know: Request disclosure of what personal information we have collected about you
• Right to Delete: Request deletion of your personal information, subject to legal exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale: We do not sell your personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

To exercise your CCPA rights, contact us at notifications@getasteri.com. We will respond within 45 days.

13. European Economic Area & United Kingdom (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR):

• Lawful Basis: We process your data based on contractual necessity (to provide the Service), legitimate interests (to improve the platform and prevent fraud), and your consent (where explicitly given)
• Right to Restriction: Request that we restrict processing of your personal data under certain conditions
• Right to Object: Object to processing of your personal data based on our legitimate interests
• Benchmark Opt-Out: Business Users can turn off contribution to future aggregate marketing benchmarks from Marketing Settings
• Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format
• Right to Lodge a Complaint: File a complaint with your local supervisory authority (data protection authority)
• Automated Decision-Making: Our AI-powered features (review response suggestions, floor inspection analysis, proposal generation) produce recommendations only. No solely automated decisions with legal or similarly significant effects are made without human review and approval

For GDPR-related inquiries, contact us at notifications@getasteri.com. We will respond within 30 days.

14. Do Not Track Signals

We do not currently respond to DNT browser signals. However, we do not use third-party tracking or advertising cookies.

15. Security Breach Notification

In the event of a data breach that affects your personal information, we will:

• Notify affected users via email within 72 hours of confirming the breach
• Provide details about what information was affected and what steps we are taking
• Notify relevant regulatory authorities as required by applicable law
• Offer guidance on steps you can take to protect yourself

16. International Data Transfers & Hosting Locations

Our services are hosted in the United States. If you access the platform from outside the United States, your data will be transferred to and processed in the United States.

17. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes (for example, new categories of data collected, new sub-processors that process your personal information, or new purposes of processing), we will post the revised Policy with an updated “Last updated” date, provide a short summary of what changed, and notify registered Business Users by email at least 30 days’ in advance of the change taking effect. For non-material changes (clarifications, typos, formatting), the revised Policy takes effect when posted.

18. Sub-processor Changes

The current list of sub-processors that process personal information on our behalf is in Section 8. We may engage new sub-processors as we add features or change vendors. We will update Section 8 when we make material changes to that list and treat the change as a material change under Section 17.

19. Contact Us

If you have questions about this Privacy Policy, please contact us at:

Email: notifications@getasteri.com

Address: 4503 Forge Road, Perry Hall, MD 21128

20. Google API Services User Data Policy

Asteri's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Google user data is used only to provide or improve the user-facing integration the user selected. It is not sold, used for personalized advertising, transferred for advertising purposes, or used to train generalized artificial intelligence or machine-learning models. Human access is limited to actions the user requests, security and abuse investigation, legal obligations, or support performed with the user’s consent.

A service-by-service description of the permissions, use, and disconnection behavior is available on our Google Integrations and Data Use page.