Privacy Policy

1. Who we are

Astroz is a store management platform with inventory, orders, customers, suppliers, purchasing, finance, public storefront, notifications, and operational communication features.

When a store uses Astroz to manage its own customers, suppliers, and business data, that store decides which data is entered and is responsible for having a lawful basis to process it. Astroz processes that data to provide the contracted service.

2. Data we may collect

• Account data, such as name, email, hashed password, Google identifier when used, phone/WhatsApp number, avatar, CPF or CNPJ, and brand name.
• Store data, such as public slug, support email and WhatsApp number, pickup address, delivery options, catalog preferences, and business instructions.
• Customer and order data, such as name, email, phone/WhatsApp number, address, document when provided, order history, purchased items, payment method, notes, and status.
• Operational data, such as products, variants, SKUs, inventory, images, categories, suppliers, purchases, finance entries, attachments, reports, and audit logs.
• Communication data, such as messages, attachments, comments, conversations, support channels, and metadata needed to display history, notifications, and status.
• Technical data, such as session cookies, authentication identifiers, access logs, security events, IP address, and browser/device information when needed for security and operation.

3. Cookies and consent

We use necessary cookies for security, authentication, fraud prevention, essential preferences, and recording privacy choices. These cookies are required for the service to function.

On the public page, we may use measurement and marketing cookies and similar technologies only after consent, including Google Analytics, Google Tag Manager, Meta Pixel, and Microsoft Clarity. These tools help us understand visits, improve the experience, measure campaigns, and avoid irrelevant advertising.

You can accept, reject, or adjust optional cookies in the consent banner and can change or withdraw that choice at any time through the cookies button displayed on the public page.

4. How we use data

• Create and maintain accounts, authenticate users, and protect sessions.
• Operate inventory, sales, purchasing, finance, reporting, public storefront, and communication features.
• Send and record notifications, emails, alerts, and operational messages requested or configured by the user.
• Provide support, investigate errors, prevent abuse, maintain audit records, and improve service reliability.
• Comply with legal, tax, regulatory, contractual, and security obligations.

5. WhatsApp and Meta integration

When an integration with WhatsApp Business Platform is active, Astroz may process the data required to send, receive, organize, and display conversations related to the store's operations.

This data may include WhatsApp numbers, names or profile information provided, message content, attachments, timestamps, conversation identifiers, webhook events, delivery or read status when available, and other technical metadata needed to route support and maintain operational history.

Messages are sent and received through Meta and WhatsApp services. Meta may also process data according to its own policies, terms, and controls. The store is responsible for using the integration in compliance with Meta/WhatsApp policies and for having authorization or a lawful basis to contact people through the channel.

6. Sharing and processors

We may share data with providers that help operate Astroz, such as hosting, database, file storage, email delivery, notifications, authentication, monitoring, cloud infrastructure, and integrations configured by the user.

When the user enables third-party services, such as Meta/WhatsApp, Google, Telegram, email providers, storage, or payment gateways, the required data may be transmitted to those providers to perform the integration.

When connecting an assistant such as ChatGPT through OAuth, you authorize access to operational catalog, stock and production data within your selected scopes. Responses are transmitted to the assistant provider, which processes them under its own policies. This public profile offers no customer, sales-order, tax-invoice, payment or credential-configuration tools; it does not request CPF/CNPJ government identifiers, passwords, API keys or authentication codes, or expose free-form production fields and catalog metadata. Do not enter these data in names, SKUs or other operational fields. Tax documents required for store operations remain handled through the system's own workflows, outside this public profile.

7. Artificial intelligence

Some Astroz features use artificial intelligence: automated replies, triage, and automations on WhatsApp; reading, cataloging, and chat in Smart Files; reading receipts from photos in Finance; natural-language CRM Analytics; the Support help assistant; and the AI Agent (see 7.1). For these features, Astroz engages the processors below, which process data only to run them.

• Anthropic, PBC (United States), through the Claude model via its commercial API: receives the content sent to these features — messages, questions, document excerpts, images, and PDFs — and returns the response. Under Anthropic's commercial terms, this content is not used to train models; Anthropic may retain it for a limited period, under its own terms, for safety and abuse prevention.
• Amazon Web Services (Amazon Bedrock), in Astroz's AWS account: generates numerical representations (embeddings) of documents and messages for meaning-based search. The content is not used to train models.
• ElevenLabs (United States), via its commercial API, only in the AI Agent's voice mode: receives the speech audio to transcribe it and the response text to generate the voice. Astroz does not store the audio; only the transcript of the speech is kept in the conversation.

7.1 AI Agent

The AI Agent answers with the artificial intelligence Astroz engages: Anthropic's Claude generates the responses, and ElevenLabs transcribes speech and generates the voice, under the terms of section 7. The agent reads and operates the account areas (catalog, inventory, production, marketplaces, e-commerce, and the online store) and files attached to the conversation, always within the permissions each person grants it in the panel itself — nothing is allowed by default, a permission never exceeds what the person's team role allows, and it can be withdrawn at any time. What the agent does under a granted permission is done on behalf of the person who granted it.

The agent keeps a memory of each person's conversations with it — what they asked, the text of the answers, and anything they ask it to remember — to carry context into later conversations. The memory belongs to that person only (teammates cannot access it), is stored in Astroz's database, has numerical representations generated on Amazon Bedrock (section 7), and is deleted when the person deletes the conversation or asks the agent to forget.

We do not use store data to train artificial intelligence models, whether our own or third parties'.

8. Retention and security

We keep data for as long as needed to provide the service, comply with legal obligations, resolve disputes, preserve audit records, prevent fraud, and protect users and stores.

We apply reasonable technical and organizational measures to protect personal data, including access controls, authentication, account/team isolation, audit records, and protected storage. No system is completely risk-free, but we work continuously to reduce those risks.

You can limit scopes or revoke the assistant connection in Settings → Integrations. OAuth access expires in one hour and can be renewed through an authorization valid for 30 days since its last renewal. Revocation prevents new queries but does not delete responses already received by the assistant provider; use that provider's controls to manage those data. Operation usage and audit records are retained for security and traceability under the retention criteria above.

9. Data subject rights

Under the LGPD and other applicable laws, data subjects may request access, correction, confirmation of processing, anonymization, blocking, deletion, portability, information about sharing, objection, and withdrawal of consent where applicable.

Some data may need to be retained for legal obligations, security, fraud prevention, regular exercise of rights, or maintenance of tax and operational records.

10. International transfers

Astroz and its providers may process data on infrastructure located outside Brazil. In such cases, we seek to use providers with appropriate contractual, technical, and organizational measures to protect the information.

The artificial intelligence features described in section 7 send the required content for processing in the United States, by Anthropic and on Amazon Web Services infrastructure.

11. Changes to this policy

We may update this policy to reflect changes in the product, integrations, legal requirements, or security practices. The current version will be published on this page with the update date.