Privacy Policy

Quazar Digital OÜ is the controller of your personal data collected through the Service.

Data You Provide

• Account data: email address, name (if provided), account credentials.
• Payment data: billing details processed by Stripe. We never store full card numbers.
• Uploaded files: documents you upload for processing (PDF, Word, Excel, images, and other supported formats).
• Support communications: information you provide when contacting us.

Data We Collect Automatically

• IP address and approximate location (country/city level).
• Browser type and version, operating system, device type and identifiers.
• Language preferences and time zone.
• Usage data, including pages visited, features used, documents processed, and time spent using the Service.
• Session information, cookie data, and tracking information.
• Purchase and subscription activity.

Payment Information

Payments are processed by Stripe. We do not store complete payment card numbers. We may receive transaction-related information including transaction date, amount, payment status, payment method type, billing country, and fraud-prevention information.

Service Delivery

To provide document processing including:

• File conversion;
• PDF tools;
• OCR;
• Translation;
• AI-powered analysis;
• AI-generated summaries;
• Information extraction;
• Account functionality.

Legal basis: Performance of contract.

Customer Support

To respond to inquiries, troubleshoot issues, and provide assistance. Legal basis: Performance of contract and legitimate interests.

Payment Processing

To process payments, subscriptions, refunds, and related financial transactions. Legal basis: Performance of contract and legal obligations.

Security and Fraud Prevention

To detect, prevent, investigate, and respond to fraud, abuse, and security incidents. Legal basis: Legitimate interests and legal obligations.

Service Improvement and Analytics

To understand how users interact with the Service and improve functionality, performance, and reliability. Legal basis: Legitimate interests and, where required by law, consent.

Legal Compliance

To comply with applicable legal obligations, court orders, accounting obligations, and tax requirements. Legal basis: Legal obligations.

AI-Powered Processing

Where users request AI-assisted features, uploaded content may be processed by AI systems operated by approved service providers, including OpenAI and Anthropic, solely for the purpose of performing the requested operation. Uploaded content is not used by us to train proprietary AI models.

We rely on one or more of the following legal bases under Article 6 GDPR:

• Performance of contract: Providing document-processing services, creating and maintaining user accounts, processing subscriptions and payments, and delivering requested functionality.
• Legitimate interests: Improving the Service, conducting analytics, maintaining security, preventing fraud, monitoring system performance, and measuring advertising effectiveness.
• Legal obligations: Complying with tax obligations, accounting requirements, regulatory compliance obligations, and lawful requests from authorities.
• Consent: Non-essential cookies, certain analytics technologies, and marketing communications (if introduced in the future). You may withdraw consent at any time.

We share data only with service providers necessary to operate the Service:

• Contabo GmbH — infrastructure hosting, application hosting, database storage, file storage, and backup systems.
• Stripe, Inc. — payment processing, subscription management, and fraud prevention.
• Google LLC — analytics services including Google Analytics and Google Tag Manager.
• Cloudflare, Inc. — website security, content delivery network (CDN), DDoS protection, and performance optimisation.
• Anthropic PBC — AI-powered document processing, summarisation, extraction, translation, OCR assistance, and analysis features.
• OpenAI, L.L.C. — AI-powered document processing, summarisation, extraction, translation, OCR assistance, and analysis features.
• Professional advisors, including lawyers, accountants, auditors, and consultants.
• Government authorities where required by law, court order, or regulatory obligation.

A current list of providers is available on our Sub-Processors page. All providers are required to process personal data only for authorised purposes and in accordance with applicable data-protection laws.

Depending on your location and applicable law, you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete personal data;
• Delete your personal data under certain circumstances;
• Restrict certain processing activities;
• Object to processing based on legitimate interests;
• Receive your data in a machine-readable format (data portability);
• Withdraw consent where processing is based on consent.

The Service is not intended for children under the age of 16. Users between 16 and 18 years of age (or the age of majority in their jurisdiction, if higher) may use the Service only with the permission and supervision of a parent or legal guardian. We do not knowingly collect personal data from children under 16.

If you believe that a child has provided personal data to us, please contact us immediately at support@astroway.guru.

We may transfer personal data to countries outside the country in which it was originally collected. Where personal data originating from the EEA, United Kingdom, or Switzerland is transferred to countries that do not provide an adequate level of protection, we implement appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Adequacy decisions adopted by competent authorities;
• Other lawful transfer mechanisms recognised under applicable law.

For additional information, please review our GDPR Notice and Sub-Processors page.

Uploaded Files and Generated Documents

Uploaded files and generated documents may be retained for up to 180 days from the upload date for account functionality, document history, customer support, security monitoring, fraud prevention, and service improvement. Users may request earlier deletion where available.

Account Information

Account information is retained while your account remains active. If an account is deleted, personal data will generally be deleted or anonymised within 30 days unless longer retention is required by law.

Financial and Transaction Records

Financial and transaction records may be retained for periods required by applicable law.

Security Logs

Security-related logs may be retained for a reasonable period to protect the Service and investigate abuse, fraud, or security incidents.

This section applies to California residents and supplements the remainder of this Privacy Policy.

California residents may have the following rights:

• Right to Know;
• Right to Delete;
• Right to Correct;
• Right to Non-Discrimination.

We do not sell personal information as defined under applicable California privacy laws.

The Service does not currently respond to browser-based “Do Not Track” signals. Where required by applicable law, we may recognise Global Privacy Control (GPC) signals and similar privacy preferences. Users may also manage cookie preferences through our cookie-consent tools.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last Updated” date and, where appropriate, by providing additional notice through the Service or by email. Continued use of the Service after changes become effective constitutes acceptance of the revised Privacy Policy.

If you have questions regarding this Privacy Policy, your personal data, or your privacy rights, please contact: