English
Responsible company
ASTRA VIA LTD, Israeli company number 517182911, Ha-Imahot Street, Ness Ziona, Israel, operates these services. Contact support@astra-via.com for privacy, access, correction or deletion requests. Where an organization supplies data for its own purposes, our service agreement determines its instructions and our processing responsibilities.
Information and purposes
We process account and contact details, role and organization permissions, authentication and security records, uploaded files and extracted text, selected public sources, review instructions, AI-assisted outputs, saved reports and usage records. This supports the requested service, account administration, source verification, troubleshooting, security and necessary business records. Submit only information you are authorized to use. Providing account details is voluntary, but the private services require an approved account.
AI-assisted review
Selected source text and review instructions are sent to Google Cloud Vertex AI through its European Union processing endpoint. Google states that customer data is not used to train its managed models without permission or instruction. Project input caching is disabled. Provider safety and abuse-monitoring terms can still apply; we do not represent this configuration as a contractual zero-retention guarantee. AI outputs can be incomplete or wrong and require human verification before consequential use. These services do not provide investment advice.
Providers and locations
Our service-provider list identifies the providers and current processing locations. Primary application hosting and private file storage use Google Cloud in Israel; text AI processing uses the EU endpoint. Supabase account and application database hosting is in London, United Kingdom. Microsoft 365 provides business email, including account and investor communications. Provider support, security operations and authorized staff access can involve international processing under the applicable service arrangements. This is not a promise that all information remains in Israel or the EU.
Public evidence publication
Evidence Validation includes an optional public IPFS publication action for public review tasks. It requires a separate confirmation. Published claims, source references and reviews can be retrieved and copied by others; account IDs are omitted from the public bundle. The current node and its backups are in the United States, and peer copies can be global. Do not publish confidential, personal or restricted-location material. Removing a local record cannot recall copies held by others.
Investor room
We process invitations, approval and document permissions, confidentiality acceptance, document delivery and copy IDs, questions, sharing requests and security events. Authorized investor-room administrators can inspect these records. Personalized document copies include the recipient email and delivery timestamp. Revoking portal access cannot recall downloaded copies. Room access is individual and subject to approval and the current confidentiality agreement.
Cookies and browser storage
Private products use essential session cookies or browser storage for authentication and preferences. Workspace can keep account tokens and local source data in the browser; use a trusted device and sign out when finished. The public marketing pages do not use advertising or analytics trackers. Optional tracking will require updated notices and any applicable choice controls before activation. External links and public media are governed by the destination provider’s terms and privacy notice.
Retention and requests
Saved sources, reports and account records remain available for the requested service until removed through available controls or an authorized deletion process, subject to necessary legal and security records. You can request account or source erasure by email; we verify identity, assess applicable exceptions and confirm the result. Deleting a review does not necessarily delete its original sources. Private backups follow recovery schedules, including daily copies for 30 days and weekly copies for 14 weeks; operational request logs are normally held for 30 days and the regional security audit log for 365 days. Product, investor and correspondence records are reviewed when their purpose ends or a request is received; no automatic account-wide deletion period is implied.
Your rights and changes
You may ask to access, correct, delete or restrict information, or raise an objection, to the extent applicable law provides those rights. We may need proportionate identity verification. We do not sell personal information or use uploaded documents for advertising. HTTPS, access controls and backups reduce risk but do not guarantee uninterrupted service or complete security. Material changes to processing will be reflected here; browsing is not blanket consent to unrelated uses.