Privacy Policy

Last updated: October 30, 2026

AOSTRAC (“we”, “us”) is an AI-powered business operating system. This policy explains, in plain language, what personal data we collect, why we collect it, how long we keep it, and the choices and rights you have over it.

1. Data we collect

Account data: your name, email address, and password (stored as a one-way hash — we never see your password).

Workspace data: the projects, tasks, team members, and operational data you enter or connect. This is your data; we process it only to operate the product for you.

Integration data: when you connect tools like GitHub, Slack, or Google Calendar, we store the access tokens needed to sync and only read the data required for the features you enable.

Usage data: basic diagnostic information such as pages visited, features used, and error reports, used to keep the service reliable.

2. How we use data

To provide and improve AOSTRAC: running your workspace, generating AI analysis and recommendations, sending transactional email (verification, password reset, notifications), preventing abuse, and meeting legal obligations. We do not sell your personal data.

3. AI processing

Operational analysis may be processed by third-party AI providers (such as Google, OpenAI, or Anthropic, where configured) under their data-processing terms. Your credentials are never included in AI prompts. AOSTRAC never lets AI silently change your data — consequential actions require your explicit approval and are recorded in the audit log.

4. Data sharing

We share data only with service providers needed to run AOSTRAC (hosting, database and backup storage, email delivery, payment processing, AI providers, error monitoring), under contracts that limit their use of it to providing their service to us. We disclose data when required by law.

5. Security

We protect personal data with encryption in transit, encryption of sensitive values at rest, access controls, and strict isolation between workspaces. Sign-in uses secure http-only session cookies, and every account can enable two-factor authentication. Our audit log is tamper-evident, and backups are encrypted. No system is perfectly secure; report vulnerabilities to aostracsupport@gmail.com and we will respond promptly.

6. Data retention and deletion

We keep personal data only for as long as it is needed for the purposes above. The main periods are:

Workspace data (projects, tasks, team records)

While your workspace is active. Deleted when the workspace is deleted or a deletion request is processed.

AI conversations

Up to 365 days, per your workspace's retention setting.

Activity and event records

Up to 90 days.

Notifications

Up to 90 days.

Presence (online/last-seen) data

Up to 30 days.

Audit log

Kept permanently as an accountability record. If you delete your account, your user ID is removed from your earlier audit entries.

Backups

Encrypted backups are purged on a rolling cycle, so deleted data also disappears from backups after deletion.

You can export or delete your workspace data at any time — see section 8 for how.

7. Your rights

Over your personal data, you have the right to:

Access — see what personal data we hold about you and how it is being used. Correct — fix anything inaccurate or incomplete. Export — get a copy of your workspace data. Delete — have your personal data erased when it is no longer needed. Withdraw consent — where processing is based on your consent (such as optional integrations), you can withdraw it at any time; this does not affect processing already carried out, and switching an integration off stops that processing. Nominate — name another person who may exercise these rights on your behalf in the event of your death or incapacity. Complain — raise a grievance with us (section 9), and escalate to the competent data protection authority if you are not satisfied with our response.

8. How to exercise your rights

The fastest route is inside the product: Settings → Privacy lets you export your data and request deletion directly. You can also email aostracsupport@gmail.com from your account email address. We may ask you to verify your identity before acting on a request, so that data is only ever released to its owner. We will acknowledge every request within 7 days and resolve it within 30 days.

9. Grievances

If you have a concern about how we handle your personal data, contact us at aostracsupport@gmail.com. We acknowledge grievances within 7 days and resolve them within 30 days, and we will tell you the outcome and the reasons for it.

10. If something goes wrong

If a security breach affects your personal data, we will inform you and the competent authorities without undue delay. Our message will explain, in plain language, what happened, what data was affected, what it could mean for you, what we are doing about it, and any steps you can take to protect yourself.

11. Children

AOSTRAC is a business tool and is not directed at anyone under 18. If you believe a person under 18 has provided us personal data, contact us and we will delete it.

12. Changes

If we change this policy materially, we will notify you in the product or by email before the changes take effect.

13. Contact

Questions about privacy: aostracsupport@gmail.com