Privacy Policy

This policy explains how Astreus AI (“Astreus”, “we”, “us”) handles personal information when you visit our website or use our platform (the “Service”). It applies to visitors, registered users and subscribers.

We are the controller of that personal information. It does not cover third-party sites we link to, which have their own policies.

We collect only what we need to operate the Service.

Information you give us

Information created when you use the Service

Under Canadian privacy law we rely on your consent, and, for users in the EU/UK, on the corresponding lawful bases noted in brackets.

• To provide the Service — create and authenticate your account, deliver the features you ask for, and save your watchlists and workspaces. [Performance of a contract]
• To take payment — manage subscriptions, process charges and renewals, and prevent payment fraud. [Performance of a contract; legal obligation]
• To keep the Service secure and working — detect abuse, enforce usage limits, diagnose faults, and protect our infrastructure and our users. [Legitimate interests]
• To communicate with you — send service and billing notices, respond to support requests, and (only if you opt in) send product updates. [Performance of a contract; consent for marketing]
• To understand and improve the product — with your consent, measure which features and datasets are used and for how long, so we can decide what to build and fix. [Consent — you can withdraw it in Settings at any time]
• To meet legal obligations — including tax, accounting and lawful requests. [Legal obligation]

You can withdraw consent to marketing at any time, without affecting the Service itself.

To be specific, rather than merely reassuring:

• We do not sell your personal information, and we never have.
• We do not share it with advertisers or data brokers, and we do not use it for behavioural advertising.
• We do not run any advertising pixels or cross-site trackers, and we run analytics only if you say yes — nothing is measured before you accept, and declining costs you nothing.
• We do not use your personal information, your watchlists, or your workspaces to train machine-learning models.

If this ever changes, we will update this page and, where the law requires it, ask for your consent first.

Essential cookies and storage. These hold the authentication tokens issued by Amazon Cognito that keep you signed in, your in-product preferences, and your cookie choice itself. They are strictly necessary to deliver the service you asked for, so they do not require consent. Without them, you could not log in.

Optional analytics (opt-in). When you first visit we show a consent banner. Only if you accept do we enable: (a) our own first-party usage measurement, which sends events to our servers and stores a random device identifier in your browser; and (b) PostHog, a product-analytics service, which may also record anonymised sessions (inputs are masked) to help us find usability problems. If you decline, neither runs.

You can change your choice at any time in Settings → General → Privacy, and you can clear or block cookies in your browser settings, though the Service will not work while signed out.

We share personal information only with service providers who process it on our behalf, under contract, and only as needed to run the Service:

We may also disclose information if required by law, court order, or a lawful request by a public authority; to enforce our Terms of Use; or to protect the rights, safety or property of Astreus or others. If we are involved in a merger, acquisition, or sale of assets, personal information may be transferred, and we will notify you before it becomes subject to a materially different privacy policy.

Most of what Astreus analyses is public corporate disclosure — regulatory filings, earnings-call transcripts, market prices and public economic statistics. This material is about companies, not about you.

That material can contain the names and statements of company executives, spoken in their professional capacity on public earnings calls and quoted verbatim with attribution. We process this limited professional information to analyse and evidence what public companies have said, which is a legitimate interest in research and financial transparency. It is drawn from sources those individuals and their companies published publicly. If you are such an individual and wish to raise a concern, contact us at saif@astreus.ai.

Our infrastructure is hosted with providers whose facilities are located in the United States (AWS, primarily the us-east-1 region). Your personal information may therefore be stored and processed outside your province or country, and may be accessible to courts and law enforcement in those jurisdictions under their local laws.

Where we transfer personal information out of the EEA or the UK, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum.

• Account and profile data — for as long as your account is open, and then deleted or anonymised within 90 days of closure.
• Content you create (watchlists, workspaces) — deleted with your account.
• Chat messages and chat profile — kept while your account is open, including the original text of messages you edited or deleted. When you delete your account, we delete your chat profile, your contacts and blocks, your conversation memberships, and every message you sent, with its edit history, reactions and attachments. Messages other people sent stay in their conversations. Reports made by or about you are kept as moderation records, no longer linked to your account.
• AI chat — your conversations, files and AI memory are kept while your account is open so you can come back to them. When you delete your account, we delete our records of your AI chats and usage, and our AI service destroys the encryption keys for your conversations, files and memory, which makes them permanently unreadable; if that cannot happen at the moment of deletion, it is done within 90 days. Anthropic, Perplexity and Parallel keep what they receive only as their terms with us allow.
• Withdrawing AI consent and deleting your data — in the iOS app, turn off Settings › AI data sharing at any time; the app then sends nothing more to the AI providers. To delete your account and all of the data above, use Settings › Delete account in the app, or on the web Settings › Account Controls.
• Billing and tax records — retained for as long as required by tax and accounting law (typically six to seven years), even after account closure.
• Usage analytics — kept while your account is open to power features like your activity history; deleted or anonymised on account deletion or on request.
• API usage records — kept as billing records for as long as required for accounting purposes.
• Security and server logs — retained for a short period for security and debugging, then rotated out.

You have the right to:

• ask what personal information we hold about you and get a copy of it;
• have inaccurate information corrected;
• have your information deleted;
• withdraw consent, including to marketing, at any time;
• ask us to restrict or object to certain processing; and
• receive your data in a portable, machine-readable format.

To exercise any of these, email saif@astreus.ai. We will respond within 30 days. We may need to verify your identity first. We will not charge you or degrade your service for exercising your rights.

If you are in the EU or UK, you also have the right to lodge a complaint with your data protection authority. If you are in Canada, you may complain to the Office of the Privacy Commissioner of Canada — but we would appreciate the chance to resolve it with you first.

We protect personal information with measures appropriate to its sensitivity, including encryption in transit (HTTPS/TLS), encryption at rest for our databases and object storage, managed authentication through Amazon Cognito, and access controls that limit which personnel can reach production data.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach occurs that poses a real risk of significant harm, we will notify you and the relevant regulator as the law requires.

The Service is not directed at anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

We may update this policy as the Service evolves. If we make a material change — for example, adding a new category of data, a new sub-processor, or a new purpose — we will update the “Effective” date and take reasonable steps to notify you, such as by email or an in-product notice. Where the law requires it, we will ask for your consent.

Privacy questions, access requests and complaints go to saif@astreus.ai, addressed to our Privacy Officer.