Privacy Policy

1. Introduction

AgentAstro.ai Inc. ("Agent Astro," "we," "us," or "our") provides AI-enabled regulatory intelligence, analysis and workflow software for medical-device regulatory professionals and organizations. This Privacy Policy explains how we collect, use, disclose, store and otherwise process Personal Information in connection with our websites, platform, services and related business activities.

This Privacy Policy applies to Personal Information that Agent Astro processes for its own business purposes. Where we process Customer Content on behalf of a business customer, our processing is also governed by the applicable customer agreement and our documented data-handling practices.

2. Personal Information and Customer Content

Personal Information

"Personal Information" means information about an identifiable individual, or information treated as personal information or personal data under applicable privacy or data-protection law.

Customer Content

“Customer Content” means information, documents, files, data, text, prompts, materials, and other content that you or your authorized users submit, upload, transmit, or otherwise provide through the Services. Where system or diagnostic logs contain actual customer-entered text, that text is also Customer Content.

Customer Content may contain Personal Information, but it is treated separately in this Policy because Agent Astro generally processes it to provide services to the applicable customer or organization. “Outputs” means responses, analyses, reports, recommendations, comparisons, summaries, documents, or other content generated by the Services in response to Customer Content or your use of the Services.

3. Information We Collect

Depending on how you interact with Agent Astro, we may collect:

• Account and profile information, such as name, email address, company or organization, title and professional credentials.
• Business and communications information, including correspondence, support requests, meeting information and other communications with us.
• Customer Content submitted to or generated through the service.
• Operational and usage information, such as authentication events, feature usage, system events, device/browser information, IP address and other non-content telemetry used to operate, secure and maintain the service. In two limited error paths, when an external service fails, system logs may record approximately the first 60–80 characters of a search query for diagnostic purposes.
• Billing and transaction information. Payment-card information is processed by third-party payment processors; Agent Astro does not intend to store full payment-card numbers.
• Information you provide in connection with demonstrations, events, sales inquiries, surveys or other business interactions.

4. How We Use Information

We may use Personal Information as reasonably necessary to:

• provide, administer and support the Agent Astro service;
• create and manage accounts and organizational access;
• process transactions and administer subscriptions;
• respond to inquiries, provide customer support and troubleshoot issues;
• secure, maintain, monitor and improve the reliability and operation of the service;
• communicate about the service, including administrative, security and product communications;
• conduct sales, marketing and business-development activities in accordance with applicable law and consent requirements;
• comply with legal, regulatory and contractual obligations; and
• protect the rights, security and integrity of Agent Astro, our customers, users and others.

5. Customer Content and AI

Agent Astro processes Customer Content to provide, maintain, secure and support the service, including to analyze Customer Content and generate Outputs requested by authorized users.

Agent Astro does not use Customer Content for generalized product improvement or to train or improve Agent Astro AI models without the customer's express authorization.

This restriction applies even where Customer Content could otherwise be aggregated or deidentified. Non-content operational telemetry may be used to operate, secure, evaluate and improve the service.

Agent Astro may use third-party AI models, cloud services, APIs and other technology providers to process Customer Content as necessary to provide the service, subject to applicable contractual, privacy and security protections. We do not make a general promise that third-party providers retain no data. Specific provider configurations are reviewed as part of our privacy and security governance.

The service may use prior Customer Content and Outputs within the same customer or organization to provide persistent project context and related functionality. Customer Content is not made available to another customer or organization unless authorized.

6. Human Access to Customer Content

Agent Astro personnel do not routinely review Customer Content. Authorized personnel may access Customer Content where reasonably necessary for customer support, troubleshooting, maintenance, security, abuse prevention or investigation, compliance with law, or another purpose authorized by the customer. Personnel with such access are subject to applicable confidentiality and security obligations.

7. How We Disclose Information

We may disclose Personal Information or Customer Content, as applicable:

• to service providers and subprocessors that support hosting, infrastructure, AI processing, authentication, communications, customer support, payment processing, security and other service operations;
• to a customer's authorized organizational administrators and users in accordance with account permissions and organizational controls;
• where required by law, legal process or governmental authority, or where reasonably necessary to protect rights, safety, security or the integrity of the service;
• in connection with a merger, financing, acquisition, reorganization, sale of assets or similar business transaction, subject to applicable confidentiality and legal requirements; or
• with the customer's or individual's direction or authorization.

Agent Astro does not sell Personal Information. We do not use Customer Content for third-party advertising.

8. Technology, Hosting, Security and Tracking

AI and Technology Providers

Agent Astro uses third-party AI services on paid business accounts. Most AI functionality is provided through an enterprise cloud AI service under commercial terms. A limited document question-and-answer feature, which allows a customer to upload a document and ask questions about it, uses a paid developer AI service because the required capability is not available through the enterprise service. Under the applicable paid-service terms, the AI provider does not use customer content processed through either service to train or improve its models.

Hosting and Data Location

Agent Astro’s current production environment is hosted in the United States. The application, Customer Content, customer accounts, conversations, saved work, customer data exports and database backups are hosted in Google Cloud’s Iowa region (us-central1). Sign-in and identity data are stored in the United States. Agent Astro’s public FDA document library may be stored across United States regions. Agent Astro does not provide a different data-residency commitment unless expressly agreed in writing.

Encryption and Security Controls

Agent Astro uses administrative, technical and organizational safeguards designed to protect information against unauthorized access, use, alteration or disclosure. No security measure or method of electronic storage or transmission can guarantee absolute security.

Cookies, Analytics and Similar Technologies

Agent Astro does not currently use analytics or tracking technologies in the current version of the service. The service stores limited functional information in a user’s browser, including light/dark theme preference, a pending team-invitation code and a login token. These items are used to provide requested functionality, not for analytics or advertising tracking.

Backups

Database backups are maintained in the same United States (Iowa) region as the production database. Daily backups are retained for seven days, together with point-in-time recovery capability. Information deleted from active production systems may remain in protected backups until those backups expire or are overwritten through normal backup processes, subject to applicable legal or contractual requirements.

9. Cross-Border Processing

Agent Astro is a Canadian company, while its current production environment and customer data are hosted in the United States. Accordingly, information provided to Agent Astro may be transferred to and processed in the United States. Information may be subject to the laws of the jurisdiction in which it is processed, including lawful access by courts, law-enforcement agencies or other authorities. If Agent Astro materially changes its data-hosting locations, this Policy may be updated accordingly.

10. Retention and Deletion

Agent Astro retains Personal Information and Customer Content in accordance with documented retention practices, applicable customer agreements, operational requirements and legal obligations.

Customer conversations are retained in Agent Astro’s database so authorized users can reopen their history. Customer Content and other saved work are retained and deleted in accordance with applicable customer agreements and Agent Astro’s documented retention practices. Where self-service deletion is not available, customers may contact Agent Astro to request deletion.

Deleting an individual user account or profile does not necessarily delete Customer Content associated with an organization. Organizational content may remain under the control of the applicable customer or organizational administrator.

Uploaded documents may be subject to separate documented retention and deletion practices. Information deleted from active systems may remain temporarily in protected backups until normal backup expiration or overwrite occurs, subject to legal or contractual requirements.

11. Organizational Accounts and Administrators

If you use Agent Astro through an organization, authorized organizational administrators may manage users and access associated with that organization. Depending on available administrative functionality, administrators may add, edit or remove organizational users and may access or manage organizational projects. Your organization may have its own policies governing its use of your information and Customer Content.

12. Sensitive Information and Health Information

Unless Agent Astro has expressly agreed in writing to support a particular use case, users must not submit protected health information, patient-identifiable information or other information requiring healthcare-specific privacy or security safeguards that the service has not been expressly configured to support.

13. Marketing Communications

Agent Astro may send business or marketing communications in accordance with applicable law. Where consent is required, we will seek the applicable consent. You may unsubscribe from marketing communications using the mechanism provided in the communication or by contacting us. Administrative, security or service-related communications may still be sent where necessary.

14. Privacy Rights

Depending on applicable law and your relationship with Agent Astro, you may have rights relating to your Personal Information, such as rights to request access, correction or deletion, or to withdraw consent where processing is based on consent. These rights may be subject to legal exceptions and verification requirements.

Where Agent Astro processes Personal Information within Customer Content on behalf of a business customer, requests concerning that information may need to be directed to the applicable customer or organization.

15. Legal Basis and Applicable Privacy Laws

Agent Astro processes Personal Information in accordance with applicable privacy and data-protection laws, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) where applicable, as well as other applicable federal, provincial, state, national or international requirements.

Depending on the circumstances and applicable law, processing may be based on consent, performance of a contract, compliance with legal obligations, legitimate business interests recognized by applicable law, or another lawful basis.

16. Security Incidents

Agent Astro maintains processes for responding to security incidents. Where an incident involving Personal Information or Customer Content requires notification under applicable law or contract, Agent Astro will provide notification in accordance with those requirements. We do not state a single universal notification deadline because applicable requirements vary by jurisdiction and contractual relationship.

17. Children

Agent Astro is a professional and business service and is not directed to children. We do not knowingly design or market the service for use by children as consumers.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, practices, legal requirements or other circumstances. We will update the Last Updated date when we make changes and, where appropriate or required, provide additional notice of material changes.

19. Contact Us

Questions, requests or concerns about this Privacy Policy or Agent Astro's privacy practices may be directed to:

AgentAstro.ai Inc. Privacy Officer

Email: info@agentastro.ai