1. Who is responsible
Astrid Investment L.L.C (Astrid Apps), Office 1805 & 1806, Business Bay, Dubai, United Arab Emirates, decides how the personal data in this policy is used and is responsible for it (the "controller"). Questions and requests go to privacy@astridapps.com.
We process personal data in line with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and any other data protection law that applies to you.
2. What we collect
When you buy: your e-mail address, the product and plan, the amount, currency and date, the country of your card and the order reference. The payment provider tells us whether a payment succeeded and gives us a reference for renewals; we do not receive your full card number.
When you write to us: your messages, the address you wrote from and anything you choose to include.
When you use our products: the data each product needs to work, such as your files in Sync or your records in Ledger, and technical data such as the number of devices on your plan and the app version. Astrid Roam does not record the sites you open, the names you look up, the content of your traffic or the address you connect from.
When you visit this website: our hosting keeps standard server logs (IP address, browser type, page requested, time) to keep the site secure. This site uses no analytics, advertising or social media code.
3. Why we use it
To supply what you bought and renew it (performance of our contract with you); to answer your messages and fix problems (contract and legitimate interest); to prevent fraud and abuse and secure our systems (legitimate interest); and to keep accounting records and respond to lawful requests (legal obligation).
We send service messages about your orders. We send news or offers only if you have agreed to receive them, and you can stop them at any time.
5. International transfers
Our providers operate in several countries, so your data may be processed outside the country where you live. Where that happens we use contractual and technical safeguards that give your data a level of protection consistent with this policy.
6. How long we keep it
Orders and invoices: kept as long as accounting law requires, currently five years after the financial year closes. Support correspondence: two years after the last message. Website server logs: up to 30 days. Product data: for the life of your subscription and up to 30 days after it ends, unless you ask us to delete it sooner.
7. Your rights
You may ask for a copy of your personal data, have it corrected, have it deleted, restrict or object to its use, and receive it in a portable format. Write to privacy@astridapps.com from the address linked to your orders; we reply within 30 days. You may also take the matter to the data protection regulator in your country.
8. Children
Our products are bought by adults. We do not knowingly collect data from children under 16 except as part of a family plan managed by a parent or guardian.
9. Security
Data is encrypted in transit, access is limited to staff who need it, and we review our providers' security. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
10. Changes
This policy changes when our practice does. The date at the top identifies the current version; material changes are announced by e-mail to customers with an active subscription.