Privacy Policy

Last updated: September 14, 2026

This Privacy Policy describes how AstraDesk® (“the App”) collects, uses, and protects information when you use the workspace on iPhone, iPad, Mac, Windows, and the web.

Who we are

AstraDesk® is a workspace for invoices, contracts, and e-signatures. You create, send, sign, and store ordinary business documents. Clients can sign in a browser without an AstraDesk account.

It is not a payment processor. When you add payment links or QR content, those come from your bank or payment provider; checkout runs on their systems. AstraDesk does not take your clients’ card numbers.

The App Store seller is Niall Darby (AstraDesk on the App Store, Apple ID 6783929265). AstraDesk is a product of Star-Tek IT Services, Ireland. Company facts: Who makes AstraDesk. If you put client personal data into AstraDesk, we act as your processor — see the Data Processing Addendum. Privacy requests: Support or support@astradesk.org.

Information we process

Depending on how you use the App, we may process:

• Account data: such as email address and authentication identifiers when you create an account or sign in.
• Sign in with Apple: Apple may share your name or email according to your choices and Apple’s terms.
• Business content you enter: invoices, contracts, documents, contacts, and related fields you save (such as line items, amounts, bill-to text, tax settings, company profile text, contract terms, signature-field placement, and payment link URLs or payment QR image data you supply from your own payment provider) may be stored with your account in our backend so you can sign in and access your records across devices. We store this only to show it back to you and to produce PDFs you generate — we do not process payments or access your provider’s transaction records.
• Signing activity: when you send a signing link, we keep a timestamped audit trail of key actions (for example sent, viewed, signed) so you have a business record. Recipients do not need an AstraDesk account.
• Generated PDFs: when you export or share a PDF, it is produced on your device or in the workspace download. We do not keep a separate archive of those PDF files on our servers for our own use.
• Branding images (device-only): if you choose images for a company logo, payment QR, signature, or stamp for PDFs, those files are saved locally on your device by the App. We do not store those image files in our cloud databases.
• Payments: the App does not process charges, capture cards, or move money for your customers. If you use Stripe, PayPal, bank apps, or similar, those companies handle payments under their own terms when your clients follow links or codes you added. We may store the link or payload you entered so it appears on your invoice PDF—we do not receive visibility into authorization, refunds, or settlement on behalf of those providers. If you buy an AstraDesk license on web, Windows, or Android, that one-time payment is processed by Stripe under Stripe’s terms. iPhone, iPad, and Mac purchases go through Apple.

Technical & device data

• Hosting / backend: the App uses cloud infrastructure for authentication and sync (Supabase) in AWS region eu-north-1 (Stockholm, Sweden — EU) so your account data and encrypted traffic can operate.
• Biometrics: biometric unlock (Face ID / Touch ID) uses device APIs; biometric data stays on your device and is not sent to our servers.
• Camera / scanner: used when you scan QR codes or barcodes where supported; scanned content is processed to support invoicing workflows.
• Photos / library: used when you choose a logo image from your library where permitted by the OS.
• Diagnostics: we may rely on vendors (including Apple’s systems) that collect limited technical or analytics data governed by Apple’s ecosystem policies.

How we use information

We use information to authenticate you, synchronize the records you entered (invoices, contracts, documents, contacts) across devices where applicable, help you export PDFs, CSV, or Excel, send optional notifications, comply with law, secure the App, and improve reliability. We do not use your information to operate payment processing for your customers—that is entirely between you and your payment providers.

Legal bases (EEA/UK readers)

Where applicable: performance of contract, legitimate interests (security and service improvement), and consent where required (e.g. certain notices or cookies on web).

Retention

We do not use your information for advertising or profiling decisions. We retain only what is needed to run the App while you use it (for example, sign-in and documents you create in the App). When you delete your account or delete your content, we remove it from our active systems; we do not keep separate marketing or analytics copies of your personal data. Copies in provider backups may disappear on a short automated schedule and are not used for any purpose after deletion.

Optional AI features (Google Gemini)

If you use optional AI features (including AI Draft Studio, invoice/contract drafting, document generation, Ask AI / Desk AI, or microphone dictation on those screens), we send your prompt or chat message and limited business context (such as company name and client details you already stored) through our servers to Google Gemini — or to the trusted AI provider whose API key you saved — so a draft or reply can be generated. If you use the microphone on those screens, we also send that audio clip for transcription. Nothing is sent until you tap Allow in the in-app permission dialog. You can avoid this processing by declining, turning AI off in Profile, or using offline templates — built-in templates work without Google.

• AstraDesk does not use your drafts to train our own models.
• Google processes the request under the Gemini API terms. See also Gemini API documentation.
• AI output is a starting point only and is not legal advice. You review and edit drafts before saving or sending them for signature.

Plain-language summary: Trust & security — AI Draft Studio. How to turn AI off: Support.

Sharing

We do not sell your personal information and we do not share it with third parties for their own marketing or unrelated products. Information is processed only by infrastructure strictly necessary to operate the App: our cloud and sign-in providers acting as processors under our instructions, and — only if you use optional AI drafting — Google Gemini as described above. We do not intentionally disclose your personal information except where required by law or to protect rights and safety.

Security

We use commercially reasonable safeguards, including HTTPS for network traffic where applicable and industry-standard protections on infrastructure. No method of transmission over the Internet is perfectly secure.

Controller / processor

For your AstraDesk account (email, sign-in, license) we are the controller. For personal data of your clients that you store or send through AstraDesk, we are your processor. Those terms are in the public Data Processing Addendum.

International transfers

Core workspace data is stored in the EU (Supabase, AWS eu-north-1, Stockholm). Optional AI drafts (Google Gemini) and support email may be processed outside the EEA. Those transfers rely on the provider’s GDPR terms.

Your choices & rights

• Export invoices as PDF, CSV, or Excel from the app anytime. Signed PDFs and audit trails stay in your workspace for download.
• Access, correction, deletion, portability, restriction, or objection may be available depending on your jurisdiction — contact Support or support@astradesk.org.
• iOS notifications can be adjusted in Settings or App settings where available.

Children

AstraDesk® is intended for adults running a business. It is not directed at children under 13 (or applicable age).

Changes

We may update this policy. Updates will appear on this page with a revised date. Important changes may additionally be surfaced in-app or by email.

Contact

Questions about this policy can be addressed through the contacts listed on our Support page.

Use this page’s HTTPS URL in App Store Connect → Privacy Policy.