Privacy Policy

AstraOBP, Inc. (“Astra”, “we”, “us”, “our”) provides AI-based online brand protection services. This Privacy Policy explains how we collect, use, share and protect personal data when you visit our website (astraobp.com), use our platform or Chrome Extension, interact with us as a customer, partner, prospect or contact or are identified through our brand-protection monitoring activities.

AstraOBP, Inc., a company incorporated in Delaware, USA, is the controller of your personal data unless otherwise stated. Astra has a presence in the EU.

Some of our services have a separate privacy notice where related personal data processing is described in more detail. For example, our Chrome Extension has a separate privacy policy available at Privacy Policy Chrome Extension.

We are committed to protecting your personal data. We process it in accordance with applicable data protection laws, including the EU General Data Protection Regulation, and maintain appropriate safeguards as described in this Privacy Policy.

We may update this Privacy Policy from time to time, for example if we process personal data for new purposes or share personal data with new recipients. When we make material changes, we will notify you by posting a prominent notice on our website. The latest version is always available on this page.

We may collect your personal data in the following ways:

Personal data you provide to us, for example by creating an account, filling in forms on our website, contacting us by email or through our support channels, or entering into a service agreement.

Personal data we collect or generate automatically, for example when you visit our website (via cookies and similar technologies), when you use our website, platform or Chrome Extension, or when our monitoring tools scan publicly available online sources for potential IP infringement.

Personal data we collect from other sources, for example publicly available sources such as domain registries, WHOIS databases, marketplace platforms, social media, professional networking sites, and domain-name dispute resolution providers.

We process your personal data for the following purposes:

Providing and operating our brand-monitoring platform

We process personal data to deliver our AI-based brand protection services, including monitoring online channels, detecting potential infringement, compiling enforcement evidence packages, managing cases, and sending enforcement communications.

• Data categories: Identity and contact data; account and access data; technical and usage data; brand-protection monitoring data; and AI-generated data.
• Legal basis: Performance of a contract with our customer (Art. 6(1)(b) GDPR). Where we act as processor, we process data on our customer's instructions and in accordance with the applicable data processing agreement.

Account administration, authentication and billing

We process personal data to create and manage customer accounts, authenticate users, manage permissions and process payments.

• Data categories: Identity and contact data; account and access data; financial data.
• Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) and legitimate interest (Art. 6(1)(f) GDPR) in managing our business operations.

Customer support

We process personal data to respond to enquiries, handle support requests and maintain records of service-related correspondence as well as maintain customer relationships.

• Data categories: Identity and contact data; account and access data; and communication data.
• Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) and legitimate interest (Art. 6(1)(f) GDPR).

Maintaining, securing and improving our services

We process personal data to maintain, secure, troubleshoot and improve our platform and Chrome Extension, and to detect and prevent misuse, fraud and security incidents.

• Data categories: Technical and usage data; account and access data; and security event logs.
• Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) in ensuring our services function correctly and are secure.

AI/ML model improvement

We use automated tools to classify, enrich, cluster, prioritise and summarise monitored content. To improve these models, we may use data processed in the course of service delivery, applying anonymisation and aggregation where feasible.

• Data categories: Brand-protection monitoring data (anonymised/aggregated where feasible); and AI-generated data.
• Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) in improving the accuracy and effectiveness of our services.

Customer analytics and direct marketing

We analyse customer and website usage data to understand customer needs and improve our service offering. We may send targeted direct marketing communications to existing and prospective customers. You can opt out at any time.

• Data categories: Identity and contact data; professional and public-source data; technical and usage data; and communication data.
• Legal basis: Legitimate interest (Art. 6(1)(f) GDPR). Consent where required by applicable law.

Intra-group transfers and internal administration

We share personal data within our corporate group for centralised IT, service delivery, product development, internal reporting and operational purposes.

• Data categories: Various categories as needed.
• Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).

Legal compliance and legal claims

We process personal data to comply with legal obligations (such as tax and accounting requirements) and to establish, exercise or defend legal claims. We may retain data after service termination for this purpose.

• Data categories: All categories as relevant.
• Legal basis: Legal obligation (Art. 6(1)(c) GDPR) and legitimate interest (Art. 6(1)(f) GDPR).

We share your personal data with others when necessary.

Service providers: To fulfil the purposes of processing, we share personal data with service providers who process data on our behalf for hosting, infrastructure, authentication, communication, security, monitoring, AI/ML services and other services necessary to operate our platform. Service providers may only process your personal data for these purposes and only in accordance with our instructions. A current list of sub-processors is available on request.

Group companies: We share personal data with our group companies for centralised IT, service delivery, product development, internal reporting and operational purposes.

Customers: Brand owners who have engaged our services receive enforcement evidence packages that may contain brand-protection monitoring data and AI-generated data.

Other recipients: We may share personal data with professional advisers (lawyers, auditors, insurers), law enforcement and regulators where required by law, and in connection with a merger, acquisition or sale of assets.

We do not sell personal data. We do not share personal data for advertising purposes.

AstraOBP is based in the United States and fully owned by a European company. Personal data may be transferred to and processed in countries outside the European Economic Area. We take appropriate steps to ensure that your privacy is protected in connection with any such transfer, including relying on European Commission adequacy decisions, Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or other legally valid transfer safeguards. Intra-group agreement available upon request.

If you have questions about the countries to which your personal data is transferred and the applicable safeguards, please contact us using the details below.

You have certain rights under data protection law in relation to our processing of your personal data. Please send requests to exercise your rights to privacy@astraobp.com.

You have the right to:

Access your personal data

You have the right to access the personal data we process about you. You may request a copy of your personal data.

Update your personal data

You have the right to request that incorrect or incomplete personal data is corrected or supplemented.

Withdraw your consent

Where processing is based on your consent, you have the right to withdraw your consent at any time.

Object to processing

You have the right to object to processing based on our legitimate interest, including for direct marketing purposes. We will stop processing immediately where you object to direct marketing.

Erase your personal data

In certain circumstances, you have the right to request that your personal data is deleted.

Restrict processing

In certain circumstances, you have the right to request that we restrict the processing of your personal data.

Data portability

You have the right to request a copy of your personal data in a structured, commonly used and machine-readable format.

Automated decision-making

You have the right to request human review of any decision made solely by automated means that significantly affects you.

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. When determining retention periods, we consider:

• the nature and sensitivity of the personal data;
• the purposes for which we process it;
• whether those purposes can be achieved by other means;
• applicable legal, regulatory, tax or accounting requirements; and
• applicable limitation periods for potential legal claims.

As a general guide:

• Customer account and service data is retained for the duration of the service relationship and for a reasonable period thereafter to support follow-up enquiries and the applicable limitation period for contractual claims.
• Financial and billing records are retained as required by applicable tax and accounting legislation.
• Technical, usage and security logs are retained for a limited period proportionate to operational and security needs, after which they are deleted or anonymised.
• Brand-protection monitoring data processed on behalf of customers is retained in accordance with the applicable customer agreement and Data Processing Agreement.
• Marketing data is retained until you opt out, withdraw consent or object, after which it is deleted or suppressed promptly from marketing lists.
• Communication records (such as support requests and service-related correspondence) are retained for a reasonable period necessary to resolve the matter and for related follow-ups.

We regularly review our retention periods and delete or anonymise personal data when it is no longer needed. In some cases, data may be retained for a longer period where required by law or strictly necessary for the establishment, exercise or defence of legal claims or other justified legitimate need, in which case it is isolated from ordinary processing and deleted when the purpose ends.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental or unlawful alteration, disclosure, loss, destruction and other unlawful forms of processing. These measures may include, where appropriate, encryption of data in transit and at rest, access controls and role-based permissions, multi-factor authentication for access to relevant systems, vulnerability assessments, employee training on data protection and security awareness, and procedures for detecting, responding to and managing security incidents. We notify affected individuals and relevant supervisory authorities of personal data breaches where required by applicable law.

We regularly review and, where necessary, update our security practices to reflect changes in our processing activities, technology, the risks associated with the processing of personal data and applicable legal, regulatory and contractual requirements.

Our website uses cookies and similar technologies to ensure the website functions correctly, to analyse usage patterns and to remember your preferences. We use the following types of cookies:

• Strictly necessary cookies are required for the website to function and cannot be switched off. They do not require your consent.
• Analytics cookies (such as Google Analytics via Google Tag Manager) help us understand how visitors interact with our website by collecting information anonymously.
• Functional cookies enable enhanced functionality and personalisation, such as remembering your preferences.

When you first visit our website, you will be asked to accept or reject non-essential cookies. You can change your cookie preferences at any time via the cookie settings on our website.

Please contact us if you have questions about the processing of your personal data. If you are not satisfied with our response, you may lodge a complaint with the relevant supervisory authority.

AstraOBP, Inc.

1111B S Governors Ave STE 53266

Dover, DE 19904, USA

Email: privacy@astraobp.com

EU Representative: Marc Olivier Meunier COO