Privacy Policy

Website, purchase, licensing, and support

Our website and related systems may process information such as your email address, purchase details, device and browser information, IP address, information you enter into website forms, payment status, and licence status.

We use this information to operate the website, process purchases, issue and maintain licences, prevent fraud and abuse, provide support, communicate with customers, meet legal obligations, and improve the reliability and security of the Service.

Astralcyte Notes application and clinical content

Astralcyte Notes is designed as a local-first application. Its clinical vault is encrypted and stored on the user's device.

In ordinary use, Astralcyte does not receive or host:

• session audio;
• transcripts;
• generated or edited clinical notes;
• client names or client records;
• therapist-authored prompts or documentation profiles;
• vault passphrases, recovery keys, vault paths, hostnames, or usernames; or
• clinical content in application telemetry, crash reports, diagnostic logs, update requests, or licence requests.

The application uses network access for limited non-clinical functions, such as licence activation or status checks, application updates, and downloading selected local models or runtimes. Those requests are designed not to include clinical content or local vault identifiers.

You are still responsible for protecting your device, passphrase, recovery key, backups, exports, and any text you copy from Astralcyte Notes.

Information we collect

Information you provide directly

We may collect information you provide when you:

• purchase a subscription or perpetual licence;
• create or recover an account or licence;
• contact support;
• subscribe to communications;
• submit a form, feedback, or request; or
• participate in a survey, promotion, or other voluntary activity.

This may include your name, email address, organization name, billing address, country, tax information where required, communications with us, and information you choose to include in a support request. Please do not send client records or other sensitive clinical information to us.

Purchase and payment information

Payments are processed by Stripe. Stripe collects and processes payment card and payment method information under its own privacy policy. We do not receive or store full payment card numbers.

We may receive commercial information from Stripe, such as:

• the Stripe customer and transaction identifiers;
• purchase date, amount, currency, and payment status;
• subscription, invoice, refund, dispute, and cancellation status;
• the product or plan purchased; and
• limited billing and fraud related information needed to administer the purchase.

Licence information

To activate and maintain a paid entitlement, our licensing service may process:

• your licence or entitlement identifier;
• a pseudonymous installation identifier;
• hashes or digests of installation and deactivation secrets;
• application version;
• operating system;
• activation, deactivation, and subscription status; and
• timestamped licence and authorization events.

These records are commercial and technical records. They are not clinical records and are designed not to contain clinical information.

Website and device information

When you use our website or interact with our services, hosting and security providers may automatically receive or log information such as:

• IP address;
• browser type and version;
• operating system and device type;
• referring page;
• pages requested and approximate time of request;
• country or region inferred from network information;
• request identifiers, security signals, and error information; and
• cookie or session information required to operate the website, checkout, or account-recovery flow.

We do not use the application to send behavioural analytics or clinical telemetry to Astralcyte by default.

How we use information

We use commercial and technical information to:

• provide, secure, and maintain the website and Service;
• process purchases, subscriptions, refunds, and payment disputes;
• issue, validate, recover, deactivate, or revoke licences;
• enforce device limits and prevent fraud, abuse, or unauthorized use;
• send transactional messages, including receipts, licence recovery links, billing notices, and service notices;
• respond to support requests;
• comply with accounting, tax, legal, and regulatory obligations;
• investigate security incidents, fraud, or misuse; and
• improve the security, reliability, and performance of our website and commercial systems.

We do not use clinical content to train models, advertise, profile users, or improve our products.

When we disclose information

We may disclose commercial and technical information to service providers that help us operate the Service, including:

• Cloudflare, for website hosting, security, application infrastructure, and data storage;
• Stripe, for payment processing, billing, fraud prevention, and subscription administration;
• Resend, for receipts, account recovery, and service communications;
• professional advisers, such as accountants, lawyers, insurers, and auditors, where necessary; and
• government authorities, courts, regulators, or law enforcement bodies when required by law or necessary to protect rights, safety, security, or property.

We may also disclose information as part of a merger, financing, acquisition, restructuring, insolvency, or sale of all or part of Astralcyte. Any recipient would be required to use the information consistently with this Policy and applicable law.

We do not sell personal information. We do not provide clinical vault content to advertising networks. We do not permit third parties to use our commercial customer data for their own unrelated marketing.

International processing

Our service providers may process commercial and technical information in Canada, the United States, and other jurisdictions where they or their subprocessors operate.

Information processed outside your province, state, or country may be subject to the laws of the jurisdiction where it is processed, including lawful access requirements. This may include access by foreign courts or law enforcement.

This section concerns website, payment, licensing, support, and other commercial information. The local clinical vault is designed to remain on your device unless you choose to export, copy, back up, synchronize, or share its contents.

Retention

We retain commercial and technical information only for as long as reasonably necessary for the purposes described in this Policy. These periods may be shortened when information is no longer needed or extended where required for legal compliance, an audit, an active dispute, fraud prevention, or an unresolved security investigation.

We periodically review records subject to these schedules and delete or de-identify information that is no longer required. Information held by service providers may also be subject to their technical deletion and backup cycles.

We do not set or control the retention period for clinical records stored in your local vault. You control the retention, deletion, export, and backup of those records, subject to your legal, professional, and organizational obligations.

Security

We use reasonable administrative, technical, and organizational measures intended to protect the commercial and technical information we handle.

The application is designed with separate protections for local clinical content, including an encrypted local vault, encrypted temporary audio recovery material, local processing, and content restricted diagnostic paths.

No system is perfectly secure. You are responsible for protecting your device, operating system account, passphrase, recovery key, backups, exported files, and access to any email account connected to your purchase or licence.

If you believe that your licence, account, or information has been compromised, contact us at support@astralcyte.com promptly.

Your choices and rights

Subject to applicable law, you may have the right to request access to, correction of, deletion of, or information about the personal information we hold about you.

To make a request, contact our Privacy Officer at privacy@astralcyte.com. We may need to verify your identity before responding. We may decline or limit a request where permitted or required by law, including where fulfilling it would affect another person's rights, reveal confidential information, interfere with fraud prevention, or conflict with legal recordkeeping obligations.

For local clinical content, Astralcyte cannot provide access, correction, deletion, or export because we do not possess the local vault. Those actions must be performed by the user through the application and the user's own device, backup, and record management processes.

You can opt out of non-essential marketing messages by using the unsubscribe link in the message or contacting us at support@astralcyte.com. We will still send transactional messages that are necessary to provide the Service, such as receipts, billing notices, licence recovery messages, and security notices.

Children's privacy

Astralcyte Notes is intended for licensed professionals and other authorized adult users. Our website and Service are not directed to children.

We do not knowingly collect personal information directly from children. If you believe that a child has provided personal information to us without appropriate authorization, contact us at privacy@astralcyte.com.

Third-party services and links

The website or Service may link to third-party websites, services, or resources. Their privacy practices are governed by their own policies, not this Policy.

Your own use of third-party tools can change where local clinical content goes. For example, copying notes to another application or saving exports to a cloud synchronized folder may cause information to be handled by those third parties.

Changes to this Policy

From time to time we may update this Privacy Policy when our practices, products, legal obligations, or service providers change.

If we make a material change, we will provide reasonable notice through the website, the application, email, or another appropriate method. The updated Policy will identify its effective date.

Contact and complaints

Questions, privacy requests, or complaints can be sent to:

privacy@astralcyte.com

If you are dissatisfied with our response, you may have the right to contact the privacy regulator that applies to you. For Canadian privacy matters, that may include the Office of the Privacy Commissioner of Canada or the relevant provincial privacy commissioner.