Privacy Policy

Astra Spire Consulting ("Astra Spire," "we," "us," "our") respects your privacy. This Privacy Policy explains what personal data we collect when you interact with our website at astraspireconsulting.com, how we use it, who we share it with, and the rights available to you under applicable data protection law.

Astra Spire Consulting is the consulting brand operated by Astra Spire Trading FZ-LLC, a Free Zone Limited Liability Company operating under trade licences issued by the Ras Al Khaimah Economic Zone (RAKEZ), United Arab Emirates.

Registered address: VUNE2724, Compass Building - Al Hulaila, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates.

Contact: contact@astraspireconsulting.com

As a RAKEZ-licensed entity, Astra Spire Trading FZ-LLC is subject to UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL"). The UAE Data Office acts as the federal data regulator. Where we handle personal data of individuals located in other jurisdictions, for example Saudi Arabia or the European Union, we take relevant local requirements into account as described in Section 9.

Information you provide directly. When you submit a request through our consultation booking form, we collect your name, company, email address, optional phone number or LinkedIn profile, country, service of interest, consultation type, and any description you provide.

Information collected automatically. When you visit our website, our hosting provider's server logs record standard technical data, including IP address, browser type, pages visited, and timestamps, for security and site-operation purposes. We do not currently use third-party analytics or advertising trackers on this website. If that changes, we will update this section and our Cookie Policy before any such tool goes live.

Information entered into Astra. Astra includes a browser-based guide and an optional AI Assistant mode. When AI Assistant mode is used and enabled on our server, the text you submit, together with limited recent conversation context, is sent securely through our website server to OpenAI so that a response can be generated. We do not intentionally write the content of Astra conversations to a website database. Standard hosting and provider security logs may process technical request information. Please do not enter confidential, sensitive, special-category, financial, health, authentication, or other unnecessary personal information into Astra. If you follow a link from Astra to a consultation, contact, or other website form, information you submit on that destination page is handled as described in this Privacy Policy.

Astra is our website navigation and AI assistant. It can help visitors move to relevant pages, explore services, review consultation options, find insights and conversations, and receive general information about Astra Spire Consulting.

The Compact Guide uses predefined website information within your browser. If you choose AI Assistant mode and the service is enabled, your question and limited recent chat context are transmitted through a secure server-side connection to OpenAI for the purpose of generating a response. The OpenAI API key is kept on our server and is not exposed in your browser. We do not use Astra to make decisions about you that produce legal or similarly significant effects.

When Astra sends you to another page, your browser makes the same normal page request it would make if you clicked a standard website link. The assistant does not place the content of your question in the destination URL. Standard hosting and security logs may process technical request information as described in Section 3.

Please do not enter confidential, sensitive, special-category, financial, health, authentication, or other unnecessary personal information into Astra. For enquiries that require personal or confidential information, use the appropriate contact or consultation channel.

OpenAI and our hosting provider may process technical or conversational data as necessary to provide and secure the AI Assistant service under their applicable terms and data controls. We do not intentionally use Astra conversation content for advertising or visitor profiling.

Astra does not set an advertising or profiling cookie and is not designed to create a persistent visitor profile. Limited recent chat context is kept in the open webpage so the assistant can maintain a short conversation.

If we materially change the AI provider, purpose, retention approach, or connected systems used by Astra, we will update this Privacy Policy and any required notice or consent mechanism before relying on the changed functionality.

We use your information to:

• Respond to your consultation request and related correspondence.
• Provide the professional services you engage us for.
• Operate Astra, provide website navigation, and deliver guided information about our services and website content.
• Maintain the security and proper operation of this website.
• Meet our legal and regulatory record-keeping obligations.

We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

We process personal data on the following bases:

• Consent — for information you submit through the consultation booking form, provided via the consent checkbox at the point of submission. You may withdraw this consent at any time by contacting us; this will not affect the lawfulness of processing carried out before withdrawal.
• Legitimate interest — for automatically collected technical data and the operation of our website navigation and Astra guided assistant, to keep the website secure, functional, and easy to use.
• Contractual necessity — where we provide services to you under a professional engagement.
• Legal obligation — where retention or disclosure is required by applicable law or professional record-keeping rules.

We work with a small number of vetted service providers to operate this website and respond to inquiries:

OpenAI — when you use Astra's AI Assistant mode, conversation text and limited recent context may be processed to generate a response.

• Hostinger — website hosting.
• FormSubmit — consultation form processing and delivery.
• Google — used when you choose to enable optional embedded YouTube content via our cookie preferences.
• Any other service provider we engage for the secure operation of this website, each required to process data only for the purpose for which we engage them.

We do not sell, rent, or share your information with third parties for marketing purposes.

• Consultation inquiries: retained for up to 24 months, unless they form part of an active professional engagement, in which case retention follows the terms of that engagement and applicable professional record-keeping obligations.
• Astra chat input: Astra Spire does not intentionally store chat content in a website database. Limited recent conversation context is held in the open webpage while you use Astra. When AI Assistant mode is used, conversation text is sent to OpenAI to generate a response and may be processed or retained in accordance with the provider's applicable API data controls and terms.
• Server/technical logs: website access-log data made available to us through Hostinger hPanel is available for up to 7 days. Hostinger may retain underlying log records, backups, or de-identified records for longer where necessary for security, operations, legal obligations, dispute resolution, or backup integrity in accordance with Hostinger's own retention practices.

As a UAE PDPL-regulated entity, we apply appropriate safeguards when personal data is transferred outside the United Arab Emirates, consistent with UAE PDPL requirements, for example contractual safeguards with our service providers.

When Astra AI Assistant mode is used, chat text and limited recent conversation context may be transferred to OpenAI for response generation and may therefore involve international data processing, depending on the provider infrastructure used.

Data may be processed in jurisdictions outside your country of residence, including the United States or the European Union, depending on where our service providers operate.

For clients based in Saudi Arabia, we take account of the Saudi Personal Data Protection Law where relevant. For clients in or dealing with the European Union, we take account of GDPR principles where applicable. This Privacy Policy describes our data-handling practices; it is not a certification of compliance with any specific foreign law.

We apply reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or disclosure. In the event of a personal data breach affecting your rights, we will notify the UAE Data Office and affected individuals where required by the UAE PDPL and other applicable law.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Restrict or object to certain processing.
• Request portability of your data.
• Withdraw consent at any time, where processing is based on consent.

To exercise these rights, contact us at contact@astraspireconsulting.com. We will respond within the timeframe required by applicable law.

If you are not satisfied with our response, you may have the right to lodge a complaint with the UAE Data Office or with the relevant supervisory authority in your jurisdiction.

We use necessary browser storage to remember your privacy preference and selected website language. Arabic-language pages are built into the website, so selecting Arabic does not load a third-party translation service. Optional embedded YouTube media is loaded only when you enable Embedded Media in your cookie preferences. We do not currently use analytics or advertising trackers. For details and to manage your choices, see our Cookie Policy.

Astra does not use a separate advertising or profiling cookie for chat activity.

This website is not directed to individuals under the age of 18, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Where a change materially affects how we use your data or the rights available to you, we will take reasonable steps to bring it to your attention.

For any privacy-related question or to exercise your rights, use our Data Rights / DSAR channel or contact us at contact@astraspireconsulting.com.