ASTROMENTS privacy policy

Controller and contact

Carlos Talavera Serradilla, an individual resident in Spain, owns ASTROMENTS and is the controller for processing whose purposes and means he determines. Contact for privacy, support, rights and account closure: hola@astroments.com.

ASTROMENTS is a free beta of POLARIS, ATLAS and RETICULUM, with no payments, advertising or current monetisation. Free and Pro plans are capacity tiers, not paid subscriptions.

Data processed

- Account and access: the name provided, email, identifiers, verification, credentials managed by the authentication system, session, workspace, plan and access status. Google is a sign-in option; this does not mean it receives ASTROMENTS conversations.
- Content: POLARIS projects, messages, results and reviews; ATLAS processes, activities, areas, references to people, proposals and history; RETICULUM journeys, connections, variants and shared references. History may retain previous values, author, date and revision.
- Usage and security: AI attempts, dates, execution status, technical identifiers and token counts when available, and operations necessary for quotas, diagnosis and protection. Infrastructure providers may also process IP addresses and other technical connection data.
- Contact: sender, content and delivery data of emails you send and access or recovery messages. Do not send passwords, identity documents or entire conversations to initiate a request.
- Acceptances: when an approved version is published and activated, account identifier, version, server date and source of acceptance. This record does not add collection of IP addresses or device fingerprints by ASTROMENTS.
- Historical beta access: requests, decisions and audit records from the previous system may remain. They are no longer a condition for accessing ATLAS or RETICULUM with Free.

Data necessary for your chosen access method allow the account to be verified and maintained; that access cannot be provided without them. You provide content for the function you request. You are not required to provide other people's personal data. The beta does not offer file uploads or collect payment data.

Purposes and legal bases

Account management, storage of your work, AI responses, process organisation and necessary support are carried out to provide the service you request and perform its terms, in respect of the user's necessary data.

Quotas, abuse prevention and diagnosis rely on the legitimate interest in maintaining a secure and available service. Information is limited to what is necessary; you may object where applicable. This basis does not authorise reusing conversations for advertising or retaining records indefinitely.

Handling rights requests and actions required by data protection rules rely on legal obligations. The minimum evidence necessary to handle a claim may be retained with restricted access to establish or defend claims for the period applicable to the case.

Accepting the terms does not mean consenting to all processing. Your contract with ASTROMENTS does not automatically legitimise third-party data either. If an organisation determines the processing of those data, a sufficient legal basis and, where applicable, a data processing agreement must exist before entering them. This beta does not provide that agreement through generic acceptance.

AI and providers

To respond or prepare proposals, ASTROMENTS transmits to the OpenAI API the messages and context required by each flow. Responses may be incorrect; review them before use. ASTROMENTS does not itself make decisions with legal or comparable effects on people based on these responses.

The integration requests that responses not be saved as retrievable API state (`store:false`). This does not mean zero retention: OpenAI documentation provides for abuse-prevention logs, by default up to 30 days unless legal obligations apply. The API does not use data for training by default; this rule allows voluntary sharing options, so it is not presented as an unconditional guarantee for every account configuration. OpenAI data controls (https://developers.openai.com/api/docs/guides/your-data).

The following services are involved:

- Supabase: database and authentication; account, credentials, sessions, content and usage metadata.
- Vercel Hobby: hosting and execution; requests, server-processed content and technical logs. Data processing contractual coverage for Hobby has not been established; it is not presumed from the existence of a DPA for other plans.
- OpenAI API: responses and proposals based on the messages and context sent.
- Resend: transactional email delivery; recipient, message and delivery data.
- ImprovMX Free: forwarding messages received at hola@astroments.com and their delivery data.
- Google: free personal Gmail receives and stores forwarded email, including sender and content; it is not Google Workspace. Separately, Google authenticates those who choose that sign-in option. The mailbox's private address is not published.

The owner retains obligations concerning purposes, information to users, configuration, choice of providers and handling rights requests. Providers assume obligations according to their service and applicable agreement. They may act as processors for some operations and controllers for their own purposes in others; no single role is attributed to all their processing.

No established specific DPA is claimed for ImprovMX Free or the personal Gmail mailbox. General privacy policies do not replace a processing contract where one is necessary. Receipt of email in that mailbox does not mean accepting unlimited use of its content. ImprovMX privacy (https://improvmx.com/transparency/privacy-policy/) and Google privacy (https://policies.google.com/privacy?hl=es).

On 24/10/2026 the owner disabled Vercel's option for improving models using project data. This measure has no retroactive effect and does not establish what processing took place previously; nor does it imply additional guarantees or resolve the Hobby contractual limitation stated above. Vercel terms (https://vercel.com/legal/terms).

Location and transfers

It is not guaranteed that all processing takes place in Spain or the European Union. A European database region does not determine the location of all services, support access, logs or subprocessors.

Official Supabase, OpenAI and Resend agreements provide contractual safeguards for the transfers they cover, including standard contractual clauses where applicable. They do not automatically extend to other services or plans. You may request information and a copy of applicable safeguards at hola@astroments.com, without disclosure of secrets or other people's data.

Retention and deletion

The owner will manually review its own AI-attempt, usage, diagnosis and beta-audit records once a month. Records no longer needed will be deleted or anonymised; for those that must be retained, the reason and next review date will be recorded. Deletion requests will also be handled within legal time limits. This is a manual management commitment; there is no general automatic age-based purge.

| Category | Retention criterion |
| --- | --- |
| Account and active content | While the account is active or until you delete the corresponding content, subject to the linked history and references explained below. Full account closure is handled manually under the rights and retention criteria in this policy. Retention is not automatically extended because an unused account remains if you request its erasure. |
| ATLAS, RETICULUM and history | While they form part of saved work. They may remain after the source project is deleted; they are included in full closure of the personal workspace. Archiving is not erasure. |
| AI attempts and own usage records | During quota checks and necessary diagnosis. Monthly reviews will delete or anonymise those no longer needed, except records linked to an open incident. Technical storage capacity does not justify indefinite retention. |
| Previous beta requests and audit records | Only while necessary to explain current rights or resolve access incidents. They will be reviewed to remove obsolete material after Free opens; deletion does not revoke rights. |
| Acceptance receipts | While the account exists and proof of the accepted version is necessary. The current mechanism deletes them with the account; permanent contractual evidence is not promised. |
| Support and rights emails | Until the enquiry and resulting actions are resolved. Unnecessary content will then be deleted, retaining only minimum evidence where a specific obligation or claim exists, with a documented reason and period. |
| Provider logs and backups | According to the function, configuration and terms applicable to each service. Necessary requests will be made; deleting active data is not promised to remove them simultaneously from every copy. |
| Local recovery copies | Only while necessary to recover service or verify a change. Superseded copies no longer needed will be removed; copies will be restricted and not used as indefinite archives. If a copy is restored, pending deletions will be reapplied before use of affected data resumes. |

Each provider's retention periods are not presented as additional promises by ASTROMENTS. In particular, closing a provider account does not mean closing a person's ASTROMENTS account. Exceptional retention must be limited to the necessary data, reason and applicable period, without keeping the rest of deleted content operational.

Your rights

You may request access, rectification, erasure, restriction, objection and portability where applicable at hola@astroments.com. If processing relies on specific consent, you may withdraw it without affecting prior lawfulness. Identity verification will be proportionate; identity documentation will not be requested by default.

A response will be provided without undue delay and, as a general rule, within one month of the request. If an extension is appropriate due to complexity or the number of requests, its reasons will be communicated within that first month. These legal response periods do not constitute a promise of simultaneous technical deletion from all copies and records. You may complain to the Spanish Data Protection Agency: https://www.aepd.es/.

Particularly sensitive data and secrets are excluded during the beta. Prefer fictional or genuinely anonymised data. Authentication and workspace separation reduce risks but do not provide an absolute guarantee against incidents. The cookie notice explains technical browser storage.