Privacy Policy
- We collect what we need to run Niyati for your business, and nothing more.
- Before any message reaches an AI model, names, phone numbers, emails and ID numbers are replaced with placeholders. ID documents are never sent to an AI model.
- Data from Google is used only to provide the features you connect, is never sold, is never used for advertising, and is never used to train AI models.
- Your data is stored in India, encrypted with a key that belongs to your business alone.
- You can ask us to show, correct or delete your data at any time: connect@astraspace.in.
1. Who we are
Astra Space AI is a brand of Inkrypt Labs (“we”, “us”, “our”). This policy covers the website at astraspace.in, the Astra Space AI application at app.astraspace.in, and Niyati, our AI assistant, on every channel it works on: WhatsApp, email, website chat and the customer portal.
2. Whose data, whose decisions
We handle personal data in two different roles, and this policy explains both.
- Our own customers and prospects. When you talk to Niyati about Astra Space AI, sign up, or pay for a plan, we decide why and how your data is used. Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), we are the data fiduciary for this data.
- Your guests, patients and customers. When a hotel, clinic or lab uses Astra Space AI, Niyati talks to that business's own guests and patients. That business decides what happens to their data, and we process it on the business's behalf and under its instructions. If you are a guest or patient, the business you dealt with is your first point of contact. We will help them respond to you.
3. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Contact and business details | Name, phone number, email address, business name, address, GST number | You, when you talk to Niyati or sign up |
| Conversations | Messages and attachments sent to Niyati on WhatsApp, email, website chat or the portal | You, or your guests and patients |
| Bookings and records | Room and appointment bookings, dates, guests and companions, preferences, feedback and ratings | Your guests and patients, your staff, and booking sites connected through the channel manager |
| Identity documents | Aadhaar, passport or other ID shared for check-in, and business KYC documents shared at onboarding | Your guests, or you |
| Payment status | Whether a payment link was paid, the amount and the reference. We never see or store card or bank details. | Razorpay |
| Connected-account data | See Data from Google and Who we share it with | The services you connect |
| Technical data | IP address, device and browser type, sign-in times, error logs | Your device, when you use our website or app |
4. How we use it
- To provide the service: answering enquiries, taking and changing bookings, sending payment links and confirmations, collecting check-in details, and asking for feedback.
- To set up and run your workspace, and to send you your login, invoices and receipts.
- To hand conversations to the right person on your team when Niyati can't help.
- To keep the service secure: preventing abuse, investigating problems, and keeping audit records of what happened and who did it.
- To meet legal, tax and accounting obligations.
- To tell you about Astra Space AI, if you have asked us to or are already a customer. You can tell Niyati or email us to stop at any time, and we will.
We do not sell personal data. We do not use it for advertising, and we do not build advertising profiles.
5. AI and your data
Niyati uses large language models (AI models) to understand messages and write replies. Because that means sending text to an AI model provider, we built these protections:
- Masking before the AI sees anything. Before each request, names, phone numbers, email addresses, UPI IDs, card numbers, Aadhaar and PAN numbers are replaced with placeholders such as
<PERSON_1>. The real values are put back only after the reply comes back, on our servers. The map between placeholders and real values exists only for that one request and is never stored. Name detection runs on our own servers. - ID documents are never sent to an AI model. They are stored for your staff to check.
- No training, no retention. We route AI requests only to providers that do not store prompts or use them to train models. We do not use your data, your guests' data or data from Google to train AI models.
- Checks before anything is sent. Replies are checked so they never include ID or card numbers, passwords or keys, and so they don't promise things that didn't happen. Sensitive actions such as refunds wait for a person's approval.
- An audit trail of AI calls, stored encrypted and deleted after 14 days, so we can verify that masking worked.
No automated system is perfect. Masking is very reliable for numbers and email addresses, and less reliable for names written in Devanagari script. AI replies can contain mistakes, which is why sensitive actions need human approval.
6. Data from Google
Businesses can connect Google services to Astra Space AI. We access only what each feature needs, and only after the business owner signs in with Google and approves access.
| Feature | Google permission | What we access and why |
|---|---|---|
| Google reviews | Google Business Profile (business.manage) | The list of Business Profile accounts and locations you manage, their names and their review link. We use it so you can choose your property and so Niyati can send guests a one-tap link to review you on Google. We do not post, edit or delete anything on your Business Profile. |
| Sign-in identity | openid, email | The email address of the Google account that granted access, shown on your settings screen so you know whose access is connected. |
| Calendar and Meet (if connected) | Google Calendar | Creating calendar events and Meet links for demos and appointments, and checking availability on the calendar you choose. |
| Email (if connected) | Gmail | Reading and replying to customer emails in the inbox you connect, so Niyati can answer them. |
How we handle Google user data
- Use: only to provide and improve the user-facing features listed above, which you chose to turn on.
- Storage: access tokens are stored encrypted with your business's own key. Only the location details listed above are kept in your workspace.
- Sharing: we do not sell Google user data or share it with anyone, except the service providers we need to run the feature (for example, our hosting provider), when you ask us to, or when the law requires it. Text from Gmail that Niyati answers is masked as described in AI and your data before any AI model sees it.
- No advertising, no AI training: we never use Google user data for advertising, and never use it to develop, improve or train generalised AI or machine-learning models.
- People: our staff do not read Google user data unless you ask us to for support, it is needed for security, or the law requires it.
- Disconnecting: you can disconnect Google at any time in your workspace settings. You can also remove our access at myaccount.google.com/permissions. When you disconnect, we revoke the token and delete it, along with the stored location details.
Astra Space AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7. Who we share it with
We share personal data only with service providers that help us run Astra Space AI, under contracts that limit how they use it, and with the services a business chooses to connect.
| Provider | What for |
|---|---|
| Amazon Web Services | Hosting, databases and storage, in the Mumbai (India) region |
| Meta (WhatsApp Business Platform) | Sending and receiving WhatsApp messages |
| Razorpay | Payment links and payment confirmation |
| The Google features a business connects (see section 6), and email delivery | |
| Aiosell channel manager, and the booking sites a hotel connects through it (such as Booking.com, MakeMyTrip, Goibibo, Agoda and Expedia) | Keeping rates and availability in sync, and receiving bookings made on those sites |
| AI model providers, through OpenRouter | Understanding messages and writing replies, receiving masked text only (see section 5) |
We may also disclose data if the law requires it, to protect people's safety, or as part of a merger or sale of our business. In a merger or sale, this policy would continue to apply.
8. Where it is stored
We store data in India, on Amazon Web Services in Mumbai. Some service providers, including AI model providers, may process data outside India. AI providers receive masked text only. Where data is processed outside India, we do so as the DPDP Act permits.
9. How we protect it
- Each business has its own encryption key. Personal details such as names, phone numbers, ID numbers and notes are encrypted field by field.
- Each business's workspace is kept separate, so one business can never see another's data.
- Everything is encrypted in transit (HTTPS/TLS) and at rest.
- Access is role-based, and every change is recorded in an audit trail.
- AI actions pass permission checks in code before they run, and sensitive actions need human approval.
If a breach affects your personal data, we will tell you and the authorities as the law requires.
10. How long we keep it
- Workspace data is kept while the business's account is active. After the account closes, it is deleted or anonymised within 90 days, unless the law requires us to keep it longer.
- Invoices and payment records are kept as long as tax and accounting law requires.
- AI call audit records are deleted after 14 days.
- Google tokens and Business Profile location details are deleted as soon as Google is disconnected.
11. Your rights
Under the DPDP Act and other applicable law, you can:
- ask what personal data we hold about you and how we use it;
- ask us to correct, complete or update it;
- ask us to delete it, where we no longer need it or you withdraw your consent;
- withdraw consent at any time, which doesn't affect anything done before;
- nominate someone to exercise these rights for you if you die or become unable to;
- raise a grievance with us, and then with the Data Protection Board of India if you are not satisfied.
To stop messages from Niyati, just tell her, for example “stop” or “don't message me”, and she will stop. To use any other right, email connect@astraspace.in. If you are a guest or patient of a business that uses Astra Space AI, you can contact that business or us, and we will help them respond.
12. Cookies
This website (astraspace.in) sets no cookies and uses no analytics or advertising trackers. It loads fonts from Google Fonts, so your browser connects to Google's servers. The app at app.astraspace.in uses only the essential cookies needed to keep you signed in and remember your preferences.
13. Children
Astra Space AI is a service for businesses and is not meant for children. A business that serves a child, such as a clinic booking an appointment for a child, must collect a parent's or guardian's consent where the law requires it.
14. Changes to this policy
We will update this page when our practices change, and change the “Last updated” date above. If a change is significant, we will tell customers by email or in the app before it takes effect.
15. Contact and grievances
We will acknowledge a grievance within 48 hours and aim to resolve it within 30 days.