นโยบายความเป็นส่วนตัวPrivacy Policy

Effective / Last updated: 15 June 2026

Astra (“we”) is built privacy- and security-first and complies with Thailand’s Personal Data Protection Act (PDPA). This policy explains what we collect, how we use it, and how we protect it.

1. Data controller

Astra is the data controller. Contact us about personal data at contact@aiastra.co.

All AI runs on your device: chat, speech-to-text, and text-to-speech are processed by models bundled in the app, on your device. We do not send your conversations or personal data to any third-party AI service, and there are no cloud AI calls.

2. Data we collect

• Astra ID account: the email used to sign in (passwordless).
• Conversations: processed on your device — chat content does not leave the device to any third party.
• Model-improvement data (with consent): if you enable “Help improve Astra”, we create structured records that are redacted on-device (emails, phone numbers, IDs, etc. removed) and kept on your device only — this version does not upload them or share them with any third party.
• Usage/diagnostics: anonymous technical metrics and crash reports (via Google Firebase Analytics/Crashlytics) — never chat content or AI data.

This version includes no web search and no third-party AI or search service — your questions and conversations are answered only by the on-device model.

3. How we use data

To provide the AI assistant, improve model quality and safety (only where consented), analyse usage in aggregate, and keep the service secure.

4. Legal basis (PDPA)

Consent (e.g. model improvement) and legitimate interest (security/operating the service).

5. Sharing & processors

We use Google Firebase (Authentication, Firestore, Analytics, Crashlytics, Hosting) as a processor on our behalf. We do not sell personal data.

6. International transfers

Some data may be processed on provider infrastructure outside Thailand, under appropriate safeguards.

7. Retention

Account data is kept until you delete your account; model-improvement data is stored redacted and versioned only as needed. We do not retain raw sensitive content long-term.

8. Your rights (PDPA)

You may access, rectify, erase, restrict, object, port, and withdraw consent at any time — model improvement can be turned off on any plan in Settings › Data & Model Improvement. You may also lodge a complaint with the PDPC.

9. Security

On-device redaction before storage, encryption in transit, and role-based access controls.

10. Children

The service is not directed to children under 13.

11. Changes

We may update this policy and will notify you in-app or on this page.

12. Contact

contact@aiastra.co