Privacy Policy
Version 2026-09-29 · effective from [TO FILL IN: effective date]
[TO FILL IN: This is a working draft written by the development team; it has not been reviewed by a lawyer yet. Before sales start, have the text reviewed, fill in every [TO FILL IN: …] marker and delete this notice.]
This document describes what personal data we process, why, for how long, and what rights you have. We follow the GDPR.
1. Data controller
Jan Rubeš, company ID 09864741, registered office Zvoleněves 49, 273 25 Zvoleněves, Czech Republic, email info@astrotransform.com. We have not appointed a data protection officer — please use the email above for all data protection matters.
2. What data we process
Registration and account: name, email, password hash, account creation date. Project: the address of the migrated site and the connector API key (stored encrypted), analysis results and the generated output. Order: billing address, country, VAT ID if any, amount, Stripe payment identifiers and the wording of your consent to starting performance. Communication: name, email, message text from the contact form and the IP address the message was sent from. Operations: IP address and technical records in server logs.
3. Your site's content — here we are a processor, not a controller
During migration you give us access to your site's entire content. It usually contains personal data of third parties — author names, contacts in the footer, form notification emails, photographs of people, comments. For that data you are the controller; we process it only on your instructions and solely to carry out the migration. We do not use it for anything else, do not pass it on, and delete it after the job as described in clause 7. This processing is governed by a data processing agreement under Article 28 GDPR: [TO FILL IN: link to the data processing agreement (a separate document) or how to request it]. Note that the lawfulness of giving us this content is on you — you must be entitled to migrate the site.
4. Purposes and legal bases
Providing the service and running your account — performance of a contract. Handling orders, issuing and archiving invoices — performance of a contract and compliance with legal obligations (accounting and tax). Evidence of consent to performance starting before the withdrawal period expires — legal obligation and our legitimate interest in documenting the transaction. Replying to contact form messages — our legitimate interest in communicating with prospects and customers. Securing the service, preventing abuse and keeping operational records — our legitimate interest. Marketing emails are sent only with your consent, and you can unsubscribe at any time.
5. Who we share data with
We process data mostly ourselves. We use only these processors: Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA) — payment gateway and invoicing. Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — running the application and the database on a server in its Falkenstein data centre (Germany, EU). Plus Five Five, Inc. (the Resend service), 2261 Market Street #5039, San Francisco, CA 94114, USA — sending transactional email (account verification, password reset, order confirmation) and receiving messages sent to addresses at astrotransform.com. [TO FILL IN: accountant or tax adviser, if the documents are processed outside the company]. We may also disclose data to public authorities where required by law. We never sell it and never share it for advertising.
6. Transfers outside the EU
Processing takes place primarily in the European Union. Stripe is part of a group headquartered in the USA; transfers are covered by the European Commission's standard contractual clauses. Email is processed by Plus Five Five, Inc. (Resend) primarily in the United States; the company participates in the EU-U.S. Data Privacy Framework, and transfers are additionally covered by the European Commission's standard contractual clauses.
7. How long we keep data
Account and projects: for as long as the account exists. Deleting a project also deletes its analysis results and the generated archive. Deleting your account deletes the account and all projects. Your site's content (analysis results, media, generated site): 12 months after the job is finished — counted from the completion of the analysis or from the first download of the output, whichever is later. 30 days before the period ends we email you a reminder; once it ends we delete the content even without a request from you and only a record that the project existed and when its content was deleted remains. Orders and invoices: 10 years from the end of the tax period in which the supply took place — this period is required by law and cannot be shortened, not even by deleting your account. After account deletion only what the invoice requires remains. Evidence of consent to starting performance: for as long as claims under the contract can be raised. Contact form messages (including the sender's IP address): 24 months after they were sent, then they are deleted automatically. Backups: the database and project data are backed up once a day and each backup is kept for 14 days; whatever you delete (a project, your account, content past its retention period) disappears from the backups within 14 days at the latest. Server logs: kept by volume rather than by time — for each service we keep at most 5 files of 20 MB and the oldest entries are continuously overwritten by new ones.
8. Your rights
You have the right of access and to a copy of your data, to rectification, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interest. Any consent you gave can be withdrawn at any time. You can exercise the right to erasure yourself: deleting your account in Settings removes the account and its projects. Data we must archive by law (invoices) is kept even after that — we cannot erase it. Send requests to info@astrotransform.com. We respond within one month; in complex cases we may extend by two more months and will tell you. To protect your data we may verify that the request really comes from you.
9. Cookies
We use only strictly necessary cookies that keep you signed in. The app would not work without them, so no consent is required. We set no analytics or marketing cookies and run no ad networks.
10. Complaint to the supervisory authority
If you believe we handle your data incorrectly, please contact us first. You may always also contact the supervisory authority directly: Úřad pro ochranu osobních údajů (Czech Data Protection Authority), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, www.uoou.gov.cz.
11. Contact and changes
Send questions about data processing to info@astrotransform.com. We may update this document; a new version will be published on this page with a version number and effective date.