Privacy policy
Who we are
Abhimanyu Singh, sole proprietor, A-63 Kribhco Shyam Nagar, Piprola, Shahjahanpur, Uttar Pradesh 242001, trading as TryOnAstra and running the app astra. For a store's customers, the store is the data fiduciary and we process her data for the store as its service provider; for owners and staff, we are the fiduciary. Contact and grievances: at the end of this page.
This website
This site sets no cookies, runs no analytics and loads no third-party script or font. If you write to us, we keep your email to answer it.
Owners and staff
| What | Why | Where | How long |
|---|---|---|---|
| Your Google account's name, email, account ID and photo | To sign you in; astra holds no passwords and sends no text codes | Google's Firebase sign-in service, United States; a copy in Firestore, Mumbai | Until you leave or are removed from the store, or the store is deleted |
| Your WhatsApp number (required for owners, optional for staff) | To prefill a join message, the verification reply, and for support to check who it is talking to | Firestore, Mumbai | As above |
| Your role, hours and what you do in astra (product events without customer data) | To run the store's team and keep astra working | Firestore and Cloud Logging, Mumbai | As above; logs 90 days |
| The owner's purchases: order, amount, receipt | To bill, to send receipts, and to meet the accounts and tax laws | Firestore, Mumbai; Razorpay holds the payment details | Until store deletion, then anonymised for the statutory period |
| A phone's push registration | To send the owner's and staff's notifications | Firestore, Mumbai; Google's messaging service | Until you sign out on that phone, leave, or are removed |
| News-and-offers consent, if you tick it | astra's own news and offers; the only basis for any other use | Firestore, Mumbai | Until you withdraw it |
| Error reports | To fix faults | Sentry, with personal data switched off | 90 days |
Your preview person: an adult member of the store who agrees, photographed once on their own phone, so the store's designs can be tested on a real person. They can remove the photo at any time from their own screen; it is deleted when they leave the store or the store is deleted.
Customers: the data-processing schedule
The consent card shows her these promises, in the store's name, before the camera opens. No photo is taken from the gallery, and nothing is kept for anyone under 18.
| What | Why | Where | How long |
|---|---|---|---|
| Her photo, taken on the staff phone after her agreement | To make her looks and to check them | Cloud Storage, Mumbai; the AI provider, outside India, for the seconds of generation | Deleted from astra's servers 60 seconds after the session ends. The AI provider may keep a flagged copy for abuse review for the number of days stated on the consent card |
| Her looks, each with a visible AI label and astra's ID | For her own purchase decision, shown on the staff phone and, after approval, on hers | Cloud Storage, Mumbai | Looks she did not save: deleted when the session ends. Looks she saved: deleted 4 hours after she unlocked them |
| Her phone number, only if she asks for the unlock code on her own phone | To send the WhatsApp code that unlocks her pictures | A keyed hash in Firestore, Mumbai; the code is delivered by Meta (WhatsApp), outside India | Deleted when her pictures expire, unless she ticked Offers |
| Her number as a consented contact, if she ticked Offers on her own phone | The store's own offers, and astra's | Firestore, Mumbai, under the store; exportable by the owner only | Until she withdraws it on the stop page linked from every message |
| Her device's random id, in one cookie on her own phone | So her own phone can re-open its pictures for 4 hours | Her phone | Until her pictures expire |
Her name is never asked. Her page has no analytics and no third-party script. We never train an AI model on her photo or her looks, never keep an image without its AI label, and never let a clean image leave astra's systems.
Who else touches the data
- Google Cloud (Mumbai region) hosts everything at rest and runs astra's servers; Google's Firebase sign-in service, in the United States, processes sign-in for owners and staff.
- Our AI image provider makes the looks from her photo and the design's photographs, outside India, for the seconds of generation; the consent card names its abuse-review retention.
- Razorpay takes the owner's payments; astra never sees card or bank details.
- Meta (WhatsApp) delivers her unlock code, outside India.
- Sentry receives error reports with personal data switched off.
Your rights
You may ask what we hold about you, have it corrected, have it erased where the law allows, nominate someone to act for you, and complain. Owners and staff: "Delete my account" in the app is the erasure route; deleting the store is in Settings. Customers: ask your store first, since it holds your consent; or write to us with the store's name.
Grievances
Grievance officer: Abhimanyu Singh, founder@tryonastra.com, +91 88159 65127, Monday to Saturday, 10:00 to 19:00 IST. We acknowledge within 7 days and resolve within 30. Every grievance and its outcome is logged without images or numbers. If we do not resolve your complaint in that time, you may complain to the Data Protection Board of India.
If something goes wrong
If personal data is exposed, we contain it the same hour, assess it the same day, and notify the affected stores, owners and staff and the Data Protection Board of India as the rules require, in plain language: what was affected, what we did, and what to tell customers.
Changes
Changes to this policy are announced in the app with 30 days' notice, and this page shows the version and date at the top.