Privacy Policy
1. Who we are and our role
Asteryx is a corporate travel and expense governance service operated by [Legal entity name], [Registered office address] (“Asteryx”, “we”). When your employer (our customer) uses Asteryx, your employer decides why and how your personal data is processed — it is the data fiduciary (India's DPDP Act 2023) or controller (GDPR). Asteryx processes that data on your employer's instructions as its data processor, under our Data Processing Addendum. For our own account administration, billing and security records we act as a data fiduciary / controller ourselves.
2. What we process
- Account data: name, work email, phone (optional), job title, department, manager, role.
- Travel data: trip purpose, destinations, dates, itineraries, travel class, cost estimates, vendor quotes and bookings.
- Expense data: amounts, merchants, categories, receipts you upload, mileage and per-diem inputs, GST details, reimbursements.
- Approvals and audit records: who approved, rejected or changed what and when, kept in a tamper-evident audit log.
- Security data: sign-in and MFA events, IP address and browser details, rate-limit counters.
- AI assistant inputs (only if your organization enables AI features): the text or receipt image you submit.
3. Why
To provide the service your employer subscribed to (policy checks, approvals, bookings, expense review and reporting); to secure it (authentication, MFA, fraud and abuse prevention, audit trails); to meet legal obligations (tax and accounting records); and to support you when you or your employer ask for help.
4. Who sees it
- People in your organization, according to the roles your administrators assign.
- Travel vendors your organization sends requests to, for the trip details needed to quote and book.
- Our sub-processors (hosting, database, email, SMS, monitoring, optional AI).
- Asteryx staff, under strict controls: support and billing staff can view your organization's data only inside a time-boxed, reason-required support session, and can change it only with a one-time override approved by an Asteryx administrator. Every such access is logged, recorded in your organization's audit log and shown to your administrators.
We do not sell personal data or use it for advertising. We use only cookies that are strictly necessary to keep you signed in and secure.
5. Where it is stored
Primary storage: [Primary data region, e.g. AWS ap-south-1 (Mumbai)]. Some sub-processors operate in other countries (listed on the sub-processor page); transfers follow applicable law, including standard contractual clauses where required.
6. How long we keep it
For as long as your organization's account is active, then as set out in your organization's agreement. Tax, expense and audit records are kept for the statutory period (by default 7 years for audit logs) and then archived and deleted automatically. Sign-in and security events are kept for 2 years by default; read notifications for 90 days.
7. Your rights
You can access and download your data (Settings → Security → Your data), correct your profile, and ask for your account to be erased (Request account deletion). Because your employer controls your work data, these requests go to your organization's administrators, who can export or erase it in the product. Records that must be kept by law are anonymised instead of deleted. You may also nominate another person to exercise your rights, and complain to the Data Protection Board of India or your local supervisory authority.
8. Security
Encryption in transit and at rest, per-organization isolation enforced in the database, multi-factor authentication, a hash-chained tamper-evident audit log, least-privilege staff access, and regular security testing. If a personal-data breach affects you, we notify your organization without undue delay so that it, and we where required, can notify you and the authorities.
9. Contact and grievances
Grievance Officer: [Grievance Officer name], privacy@asteryx.io. We acknowledge grievances promptly and resolve them within the period required by law.
10. Changes
We will post updates here with a new version date and tell administrators about material changes.