Global Privacy Policy

Effective date: 2026-08-30 Version: 1.1.0

This document forms part of the Astalias global legal framework. Astalias is an international software and digital-services platform and is not presented as being directed exclusively to any single country. Mandatory rights and obligations that cannot lawfully be excluded or restricted remain unaffected.

1. Scope

This Privacy Policy explains how Astalias Shopping, International Partnership, Software GmbH, trading as Astalias Software GmbH, collects, uses, discloses, stores and protects personal information in connection with Astalias websites, customer accounts, purchases, digital downloads, software licensing, support, communications, hosted functionality, APIs, connectors and related Services. It also explains choices and rights that may be available depending on where you are located and which privacy law applies.

For processing where Astalias determines the purposes and means, Astalias acts as controller, business or equivalent responsible organisation. Where Astalias processes personal data solely on documented instructions of a business customer, Astalias may act as processor or service provider and the Data Processing Agreement may apply.

2. Personal information we collect

Identity and account information: name, username, organisation, account identifiers, account status and authentication-related information.
Contact information: email address, billing/contact address, country or region and support contact details.
Commercial information: products purchased, plan, order identifiers, invoice data, subscription status, refunds, coupons, entitlements and support eligibility.
Payment-related information: payment-provider identifiers, transaction status, limited billing metadata and fraud/risk signals. Full card details are generally collected directly by payment providers such as Stripe and are not normally stored by Astalias.
Technical information: IP address or privacy-preserving derivatives, browser and device characteristics, operating system, timestamps, referrer, requested URLs, server logs, error information and security events.
Software and licensing information: product and version, license/entitlement identifiers, activation/deactivation records, site or installation identifiers, compatibility information and update requests where the product uses such functionality.
Support and communications: support tickets, emails, chat or form submissions, attachments, diagnostic details and feedback.
API and connector information: API identifiers, OAuth scopes, connector configuration, authentication metadata, webhook metadata and data necessary to perform an integration you enable.
Usage information: interactions with websites, account areas, hosted Services and documentation, subject to applicable consent or privacy requirements.
Customer-controlled content: information submitted, transmitted, stored or processed through a Service where the Service is designed to handle customer content.

3. Sources of information

We collect information directly from you, automatically from your device or use of the Services, from payment processors, from an organisation that provides you access, from third-party services you choose to connect, and from lawful fraud-prevention, security or compliance sources. Where information is received from a third-party connector, the categories depend on the permissions you grant to that provider.

4. Purposes and legal bases

Depending on applicable law, we process personal information under one or more lawful bases or business purposes:

Purpose	Typical information	Typical basis
Provide accounts, downloads, software, APIs and services	Account, order, technical, licensing and service data	Contract performance; requested service
Process payments, refunds and subscriptions	Billing, transaction and provider data	Contract performance; legal obligations; legitimate interests in fraud prevention
Deliver updates, support and security	Account, product, diagnostic and technical data	Contract performance; legitimate interests in secure and reliable services
Prevent fraud, abuse and attacks	Technical, security, account and transaction data	Legitimate interests; legal obligations; protection of rights
Maintain legal, tax and audit records	Orders, invoices, consent evidence, communications	Legal obligations; establishment or defence of claims
Operate connectors you enable	OAuth, API, content and configuration data	Contract performance; your instructions or consent where required
Product analytics and improvement	Usage, diagnostic and interaction data	Legitimate interests or consent where required
Marketing communications	Contact and preference data	Consent where required or other lawful basis permitted by applicable law

Where we rely on legitimate interests, we consider whether our interests are proportionate to the impact on individuals and whether additional safeguards are appropriate. Where consent is the legal basis, you may withdraw consent for future processing at any time without affecting prior lawful processing.

5. Payment providers

Astalias may offer payment methods processed by Stripe and PayPal, including more than one Stripe payment configuration or merchant account. The selected payment provider independently processes information required to authorise and settle the transaction, prevent fraud and comply with financial law. Their processing is governed by their own privacy notices in addition to this Policy.

6. Cookies and similar technologies

We use cookies, local storage, pixels, session identifiers and similar technologies for essential site functions and, where enabled and permitted, preferences, measurement or marketing. Non-essential technologies are controlled in accordance with the Cookie Policy and applicable consent requirements. Where consent is required, non-essential technologies should not be treated as authorised merely because you continue browsing.

7. Sharing and recipients

We may disclose personal information only as reasonably necessary to:

payment processors, hosting, infrastructure, email, support, analytics, security and other service providers;
third-party platforms or connectors that you intentionally enable;
professional advisers such as accountants, auditors, insurers and legal counsel subject to appropriate duties;
competent authorities where disclosure is required by law or reasonably necessary to protect rights, safety or security;
a buyer, investor, successor or adviser in connection with a merger, financing, restructuring, sale of assets or similar corporate transaction, subject to appropriate confidentiality and legal safeguards.

We do not disclose personal information to third parties merely because they request it. We evaluate legal demands and may challenge requests that are invalid, overbroad or unlawful where reasonably possible.

8. Sale, sharing and targeted advertising

Astalias does not treat ordinary payment processing or service-provider disclosures as a sale of personal information. If Astalias engages in an activity that qualifies as “sale”, “sharing”, targeted advertising or similar regulated disclosure under law applicable to you, we will provide the legally required notice and opt-out mechanism. Where a recognised browser-based opt-out signal must be honoured, we will apply it to the extent required by applicable law.

9. International data transfers

Astalias is an international service and personal information may be processed in countries other than your own. Where a privacy law requires a transfer mechanism, we will rely on an available lawful safeguard, such as an adequacy decision, contractual safeguards, approved clauses, certification, binding rules or a permitted derogation as appropriate to the transfer.

10. Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and for legitimate legal, tax, accounting, security, dispute and backup requirements. Retention is determined by factors such as account status, subscription or support term, statutory recordkeeping duties, limitation periods, fraud/security needs and the technical lifecycle of backups.

Typical operational records may be retained as follows unless a longer or shorter period is required: account data while the account remains active and for a reasonable period afterwards; transaction and invoice data for legally required accounting/tax periods; security logs for a proportionate security period; support communications for the time reasonably needed to resolve issues and defend claims; legal-consent evidence for the configured legal retention period; and backups until they age out under backup rotation.

11. Security

We use technical and organisational measures appropriate to the nature and risk of the processing, which may include access control, authentication, least-privilege practices, encryption in transit, secrets management, monitoring, backups, logging, patching and incident response. No internet service can guarantee absolute security, and you are responsible for protecting your own credentials and environment.

12. Your privacy rights

Depending on applicable law, you may have rights to request access to personal information, correction, deletion, restriction, portability, objection to certain processing, withdrawal of consent, opt-out of certain disclosures or targeted advertising, limitation of certain sensitive-data uses, and information about categories of data, sources, purposes and recipients. You may also have the right to lodge a complaint with a competent privacy regulator.

To exercise a privacy right, contact astalias@astalias.net. We may need to verify your identity or authority before fulfilling a request. We will not unlawfully discriminate against you for exercising a privacy right. Some rights are subject to exceptions, including legal retention obligations, security, fraud prevention, freedom of expression and establishment or defence of legal claims.

13. EEA/UK and similar rights

Where laws such as the GDPR or UK GDPR apply, the information in this Policy is intended to describe the controller identity, processing purposes and legal bases, recipients, international transfers, retention criteria and individual rights relevant to the processing. You may have rights including access, rectification, erasure, restriction, portability and objection, and may complain to a competent supervisory authority.

14. California and similar US privacy rights

Where a US state privacy law applies to Astalias and to you, you may have rights to know or access categories or specific pieces of personal information, delete, correct, opt out of certain sales/sharing/targeted advertising, limit certain uses of sensitive personal information, or use an authorised agent. Applicability and scope depend on the statutory thresholds and exemptions of the relevant law.

15. Children

The commercial Services are not directed to children. We do not knowingly solicit purchases or account registrations from persons below the age required to enter into the relevant contract. If you believe a child has provided personal information unlawfully, contact astalias@astalias.net.

16. Automated decision-making

We may use automated signals for fraud detection, security, abuse prevention, payment-risk handling or service protection. If applicable law gives you a right concerning a decision based solely on automated processing that produces legal or similarly significant effects, we will provide the applicable process and safeguards.

17. Business customers and processor data

When a business customer uses an eligible Service to process personal data for its own purposes, that customer controls its instructions and legal basis. Astalias processes covered customer personal data in accordance with the Data Processing Agreement where applicable. Requests concerning data controlled by a business customer may need to be directed to that customer.

18. Changes to this Policy

We may update this Policy to reflect changes in law, technology, Services, subprocessors or business operations. Material revisions receive a new version and effective date. Where legally required, we will provide additional notice or obtain consent before materially different processing begins.

19. Contact

Privacy requests and questions: astalias@astalias.net. Legal entity: Astalias Shopping, International Partnership, Software GmbH, Dürrerhöfer Allee1, 99817, Eisenach, Germany, HRB 2938. Legal contact: astalias@astalias.net.