Privacy Policy

1. Introduction and Scope

Astracore EOOD, trading as AstraCore (“we”, “us”, or “our”), is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share, and protect information in connection with:

• our website astracore.eu; and
• the Astra Platform services available at platform.astracore.eu: Astra.Platform (accounts and administration), Astra.Helpdesk (customer support ticketing), Astra.PBX (business telephony) and Astra.Voice (AI voice agents). This includes white-label editions of these services offered through our partners.

Section 8 explains how Astra.Helpdesk accesses, uses, stores, and shares data received from Google APIs.

We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Bulgarian and EU data protection law.

2. Data Controller

The data controller for the website and for account data of Astra Platform users is:

When a business (“organisation”) uses the Astra Platform, it decides what customer communications are processed. This includes connected mailboxes, tickets, calls, and reviews. For that content the organisation is the controller and we act as its processor under a data processing agreement. If you contacted a business that uses our services, you can direct privacy requests to that business. We will help them respond.

3. Data We Collect on the Website

We may collect the following categories of personal data:

• Contact information — name, business email address, phone number, and company name when you submit a demo request or contact form.
• Usage data — IP address, browser type, pages visited, and time spent on the site, collected in aggregated form by our cookieless analytics tool.
• Communication data — content of messages you send us via email or contact forms.
• Voice assistant data — if you choose to talk to the voice assistant on our website, your voice input and the conversation transcript are processed to answer you.

4. How We Use Website Data

We use the data we collect to:

• Respond to your demo requests and enquiries.
• Provide, operate, and improve our services.
• Send you relevant product updates and marketing communications (only with your consent or where we have a legitimate interest).
• Comply with legal obligations.
• Analyse website usage to improve user experience (via anonymised analytics).

5. Legal Bases for Processing

We rely on the following legal bases under GDPR Article 6:

• Contract — processing necessary to fulfil a contract with you or take pre-contractual steps at your request.
• Legitimate interests — improving our services, keeping them secure, and communicating with prospective customers.
• Consent — for marketing communications and non-essential cookies.
• Legal obligation — where required by law.

6. Cookies and Analytics

We use Umami Analytics, a privacy-friendly, GDPR-compliant analytics tool that does not use cookies and does not collect personally identifiable information. We do not use advertising or cross-site tracking cookies.

The only cookie we set is a strictly necessary one that remembers your language preference. Details are in our Cookie Policy.

7. Astra Platform Services

When an organisation uses the Astra Platform, we process the following data to provide the services it has subscribed to:

• Account data — names, business email addresses, roles, and sign-in and security events of the organisation’s users (administrators and agents).
• Helpdesk content — tickets, customer contact details, email conversations, chat messages, internal notes, attachments, Facebook comments, and Google Business Profile reviews, from the channels the organisation connects.
• Telephony data — call records, call recordings, voicemail, and transcripts, where the organisation enables them.

Organisations can connect Google (Gmail and Google Business Profile), Microsoft 365 / Outlook, and Facebook accounts. Data from these accounts is accessed only with the organisation’s authorisation and only to provide the features described here.

AI features. Astra.Helpdesk offers optional AI features: ticket summaries, ticket classification, reply suggestions and improvements, detection of recurring problems, and triage of Facebook comments and Google reviews. When these features are on, the relevant ticket content is sent to our AI provider, OpenAI, to generate the result. Organisation administrators control these features in the Helpdesk AI settings.

Speech processing. Call and voicemail transcription and Astra.Voice AI agents run on our own NVIDIA GPU servers in Sofia Data Center II, Sofia, Bulgaria. If that service is unavailable, OpenAI may be used as a fallback for transcription.

We do not use customer content to train generalised AI models. We use our AI providers through their business APIs, under terms that prohibit them from using the content to train their models.

8. Google User Data (Astra.Helpdesk)

Astra.Helpdesk lets an organisation connect a Gmail mailbox and a Google Business Profile, so its support team can handle emails and reviews in one place. This section explains exactly which Google user data we access and what we do with it.

8.1 Google data we access

• Gmail — read access (gmail.readonly): email messages and their content, headers, senders and recipients, and attachments, starting from the sync start date the administrator chooses. Spam and Trash are excluded. We also read the mailbox email address, and we receive notifications from Google when new mail arrives.
• Gmail — compose access (gmail.compose): we create drafts and send replies from the connected mailbox. We do this only for replies that an authorised agent writes and sends in Astra.Helpdesk.
• Google Business Profile (business.manage): the business accounts and locations you manage (name and address), reviews of those locations (reviewer display name, star rating, review text and dates), and existing replies. We publish replies to reviews.
• Basic account information (openid, email): the email address of the Google account used to connect the Business Profile, so administrators can see which account is connected.

We do not access Google Contacts, Calendar, Drive, or any other Google service. We do not delete, label, or move messages in your Gmail mailbox, and we do not change your Business Profile listing.

8.2 How we use Google data

We use Google user data only to provide these user-facing features:

• Turning incoming emails into support tickets, adding replies to the right ticket, and creating a customer contact for each new sender.
• Importing emails sent from the mailbox into the related ticket, so the conversation history is complete.
• Showing emails, tickets, and reviews to the organisation’s authorised agents.
• Sending the replies that agents write, from the connected mailbox.
• Importing Google reviews, creating tickets for reviews that need attention (for example low ratings), and publishing the business’s replies to reviews.
• If the organisation enables them, the AI features described in section 8.3.

8.3 AI processing of Google data

If an organisation enables Helpdesk AI, content derived from Google data is sent to OpenAI as part of the ticket context. This content includes email text and review text. OpenAI uses it only to return the requested result: a summary, a classification, a reply suggestion, or a reply improvement. Review triage is on by default and administrators can turn it off. It decides whether a review of 3 or more stars needs a ticket. For triage we send the business name and address, the rating, and the review text, but not the reviewer’s name.

AI requests are made with storage disabled. OpenAI does not use API data to train its models. It may retain requests for up to 30 days solely for abuse monitoring, then deletes them. Google user data is never used to develop, improve, or train generalised or non-personalised AI or machine learning models, by us or by our providers.

8.4 How we store and protect Google data

• Emails, attachments, tickets, and reviews are stored in our databases and file storage hosted in data centres in Bulgaria (European Union).
• Google OAuth refresh tokens and OAuth client secrets are encrypted at rest (AES-256). Gmail access tokens are never stored. Business Profile access tokens are kept only in memory until they expire.
• All connections to Google and to our services use encrypted HTTPS (TLS).
• Data of each organisation is isolated from other organisations. Only the organisation’s authorised agents and administrators can see its tickets. Administrators can further restrict agents to their own teams’ tickets.
• Email attachments are scanned for malware before they are made available.
• Our staff do not read Google user data, with these exceptions:
  • when the organisation asks for support and the specific content is needed for it;
  • to investigate security issues or abuse;
  • to comply with applicable law.
  Such support access requires two-factor authentication and a stated reason. It expires after 30 minutes and is logged.

8.5 How we share Google data

• Within the organisation — with the authorised agents and administrators of the organisation that connected the account.
• OpenAI — only when the AI features in section 8.3 are on, and only to provide them.
• Our hosting infrastructure in the EU, which stores the data on our behalf.
• When required by law, or as part of a merger or acquisition. In that case we notify affected organisations and the data stays protected by this policy.

We do not sell Google user data. We do not use or transfer it for advertising, including personalised or interest-based advertising. We do not use it to determine creditworthiness or for lending. We do not transfer it to data brokers or information resellers.

8.6 Retention and deletion of Google data

• Synced emails, attachments, and reviews are kept as part of the organisation’s ticket history while it uses Astra.Helpdesk, unless the organisation deletes them earlier. We also store a copy of each synced message, including messages not turned into tickets, such as automated notifications.
• Deleted tickets stay in a recycle bin for 30 days and can be restored. After that their email and review text is permanently erased.
• Disconnecting a Google Business Profile deletes the stored token and stops all access. Disabling a Gmail mailbox stops synchronisation immediately. Its stored token is deleted when the mailbox connection is removed or at the organisation’s request.
• You can revoke Astra.Helpdesk’s access to your Google account at any time at myaccount.google.com/permissions. Our access stops immediately.
• When an organisation stops using our services, we delete or irreversibly anonymise its Google user data within 90 days after the contract ends, unless the law requires us to keep it.
• To request deletion of Google user data, email team@astracore.eu from an administrator account of the organisation. We complete deletion requests within 30 days. If you are a customer of an organisation, contact that organisation, or contact us and we will pass your request on.

8.7 Limited Use disclosure

Astra.Helpdesk’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9. Service Providers (Subprocessors)

We share data only with service providers that process it on our behalf, under data processing agreements with appropriate security measures:

• Hosting infrastructure (Bulgaria, EU) — servers, databases, and file storage for the website and the Astra Platform, including our own GPU servers in Sofia Data Center II.
• Brevo SAS (France, EU) — delivery of emails sent from our website and platform (SMTP).
• OpenAI (United States) — Helpdesk AI features, and fallback transcription of calls and voicemail.

Google, Microsoft, and Meta process data under their own terms when an organisation connects its accounts with them. They are not our subprocessors.

10. International Transfers

We store your data in the European Union. Some processing takes place outside the European Economic Area (EEA): OpenAI processes data in the United States for the Helpdesk AI features and the fallback transcription described above.

For these transfers we rely on the European Commission’s Standard Contractual Clauses. Where the recipient is certified, we also rely on the EU–US Data Privacy Framework. We also apply supplementary measures such as encryption in transit and data minimisation. You can ask us for a copy of these safeguards at team@astracore.eu.

11. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy, or as required by law:

• Contact form submissions — up to 2 years, unless an ongoing business relationship exists.
• Helpdesk content — for the duration of the subscription, as described in section 8.6.
• Call recordings and transcripts — for the retention period the organisation sets. Transcripts are deleted when that period ends.
• Email delivery logs and sign-in and usage logs — 90 days.
• Account data — for the duration of the contract and up to 90 days afterwards, except where accounting or other laws require longer.

12. Your Rights

Under GDPR, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request erasure of your data (“right to be forgotten”).
• Object to or restrict processing.
• Data portability.
• Withdraw consent at any time (where processing is consent-based).
• Lodge a complaint with the Commission for Personal Data Protection of Bulgaria (CPDP) or another supervisory authority.

To exercise any of these rights, contact us at team@astracore.eu.

13. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encryption in transit, encryption of access credentials at rest, isolation between organisations, role-based access, two-factor authentication for privileged access, and audit logging. However, no internet transmission is completely secure, and we cannot guarantee absolute security.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page reflects the most recent revision. If we change how we use Google user data or other customer content, we will notify the administrators of affected organisations before the change takes effect. Where required, we will ask for their consent again.

15. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us at team@astracore.eu.