─────────────────────────────────────────────

Version 1.0 | Last revised: May 20, 2026

Astra Concierge, LLC (“Astra,” “we,” “us,” or “our”) is committed to handling personal information responsibly and transparently. This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights with respect to that information.

This Privacy Policy applies to:

– Visitors to our website at astra-concierge.com (“Website”);

– Businesses and individuals who enter into a services agreement with Astra (“Clients”); and

– Individuals who receive telephone calls placed by Astra’s AI voice agent on behalf of our Clients (“Called Parties”).

Please read this policy carefully. If you have questions, contact us at privacy@astra-concierge.com.

─────────────────────────────────────────────

SECTION 1 — WHO WE ARE

─────────────────────────────────────────────

Astra Concierge, LLC is a Delaware limited liability company. We provide AI-powered B2B voice sales concierge services. Our AI voice agent places outbound telephone calls to consented business contacts on behalf of our Clients, for the purpose of qualifying sales prospects and booking meetings.

For purposes of applicable privacy law:

– Astra is the controller of information collected from Website visitors and Client account holders.

– Astra acts as a processor on behalf of our Clients with respect to Called Party data contained in Client-uploaded contact lists.

– Clients are the controllers of their contact databases and bear primary responsibility for the legal basis on which those contacts are called.

─────────────────────────────────────────────

SECTION 2 — INFORMATION WE COLLECT

─────────────────────────────────────────────

2.1 Website Visitors

When you visit our Website, we may collect:

– Usage data: Pages visited, time spent on pages, referring URLs, browser type and version, device type, operating system, and IP address.

– Contact form data: If you submit a contact, waitlist, or inquiry form, we collect your name, business email address, company name, job title, and the content of your message.

– Cookie data: See Section 11 (Cookies) below.

2.2 Clients

When you enter into a services agreement with Astra or use our platform, we collect:

– Account information: Legal entity name, authorized signatory name and title, business email address, billing address, and payment method (processed by our payment processor; Astra does not store full payment card numbers).

– Order and campaign data: Service tier, campaign configuration, minutes usage, call outcomes, and other operational data.

– Communications: Emails, messages, and support requests you send to Astra.

– Platform usage data: Login activity, feature usage, and session data.

2.3 Called Parties

When our AI voice agent places a call to a telephone number in a Client’s contact list, we may collect or generate:

– Contact identifiers: Name, telephone number, company name, and job title, as provided by the Client.

– Call audio: A recording of the telephone call, including the Called Party’s voice.

– Call transcript: A text transcription of the call.

– Call metadata: Date, time, duration, call outcome, and disposition notes.

– Opt-out status: Whether the Called Party requested to be removed from future calling.

Important note for Called Parties: Astra processes your information on behalf of the Client who instructed us to call you. The Client is responsible for the legal basis on which you were contacted. If you wish to exercise rights with respect to your information, contact us at privacy@astra-concierge.com.

─────────────────────────────────────────────

SECTION 3 — HOW WE COLLECT INFORMATION

─────────────────────────────────────────────

– Directly from you (Website visitor): Contact form submissions, waitlist sign-ups

– Automatically (Website): Analytics, cookies, server logs

– From Clients: Called Party contact lists, campaign configuration

– Generated during service delivery: Call audio, transcripts, call metadata, outcomes

– From Sub-Processors: Call audio and transcription data processed by ElevenLabs and Telnyx

We do not purchase, rent, or acquire Called Party contact data from data brokers or third-party list providers. All Called Party data originates from Client-uploaded contact lists.

─────────────────────────────────────────────

SECTION 4 — HOW WE USE INFORMATION

─────────────────────────────────────────────

4.1 Website Visitors: To operate and improve the Website; respond to inquiries; send requested information; analyze traffic.

4.2 Clients: To provide, operate, and support the Services; invoice and process payments; communicate about accounts and campaigns; comply with legal obligations; enforce agreements.

4.3 Called Parties: To execute calls on behalf of the Client; qualify prospects and book meetings; generate call transcripts; record and honor opt-out requests; maintain compliance records.

4.4 What We Do Not Do:

– We do not sell, lease, trade, or otherwise profit from Called Party personal information or call recordings.

– We do not use call recordings or transcripts to train, fine-tune, or improve any AI model without the Client’s prior written consent.

– We do not use Called Party information for any purpose other than providing the Services to the Client that authorized the call.

– We do not engage in behavioral advertising using any personal information collected through the Services.

─────────────────────────────────────────────

SECTION 5 — AI VOICE CALLING AND CALL RECORDING

─────────────────────────────────────────────

5.1 AI-Powered Voice Agent

Astra’s Services use an AI-powered voice agent to conduct telephone calls on behalf of Clients. The AI agent:

– Identifies itself as an AI assistant at the start of every call (non-bypassable; required by FCC Declaratory Ruling FCC 24-17 and applicable state law including Tex. Bus. & Com. Code § 305.053).

– Does not impersonate any named human individual or deny being an AI if asked.

– Provides an automated opt-out mechanism on telemarketing calls as required by 47 C.F.R. § 64.1200(b)(3).

– Only places calls within the legally permitted calling window of 8:00 a.m. to 9:00 p.m. local time of the Called Party.

5.2 Call Recording

Calls placed by Astra’s AI agent may be recorded. A disclosure that the call may be recorded is provided at the start of each call. Astra only places calls in states where it has confirmed its recording practices comply with applicable law. The states in which Astra currently operates are listed in the State Authorization Schedule at astra-concierge.com/state-schedule.

5.3 Speech Processing

Call audio is processed through Astra’s AI infrastructure to generate real-time speech recognition and AI voice synthesis. These functions are performed by our Sub-Processors (see Section 6). Astra does not use called-party voice data to create voice profiles, speaker embeddings, or biometric identifiers for identification purposes.

5.4 Opt-Out

If a Called Party requests to be removed from future calls during a call, Astra will: log the opt-out request immediately; transmit the telephone number to the relevant Client within 24 hours; remove the number from any future Astra-managed Campaign for that Client. Called Parties may also submit opt-out requests directly to Astra at privacy@astra-concierge.com.

5.5 Google User Data (Google Calendar Integration)

Astra Concierge offers an optional integration that lets you connect your Google
Calendar so Astra can schedule meetings (product demos) on your behalf.

Scope we request. We request a single, limited scope:
https://www.googleapis.com/auth/calendar.events.owned (“See, create, change, and
delete events you own on Google calendars”). We do NOT request access to view
your other calendar events, your contacts, your email, or your
availability/free-busy information.

Write-only access. Our calendar integration only CREATES events on your behalf
(e.g., a demo meeting with a Google Meet link and the participant invited). We do
not read, list, or retrieve any existing data from your Google Calendar.

What we store. To create events on your behalf, we securely store the OAuth
tokens issued by Google (Google Cloud / Firestore), plus references to the events
we create (event ID and Meet link). We do not store any other calendar contents.

AI and machine learning. We do NOT use Google user data to train, retrain, or
improve any generalized or foundational AI/ML models, and we do NOT transfer
Google user data to any third party for such purposes. Any AI features in Astra
(which may use third-party providers such as OpenAI and ElevenLabs) operate on
data from your sales conversations — never on Google user data. The use of raw or
derived user data received from Google APIs will adhere to the Google API
Services User Data Policy, including the Limited Use requirements.

Limited Use. Astra Concierge’s use and transfer to any other app of information
received from Google APIs will adhere to the Google API Services User Data Policy
(https://developers.google.com/terms/api-services-user-data-policy), including the
Limited Use requirements. We only use Google user data to provide the
calendar-scheduling feature; we do not sell it, do not use it for advertising, and
do not allow humans to read it except with your consent, for security, to comply
with law, or in aggregated/anonymized form for internal operations.

Your controls. You can disconnect at any time in Astra or revoke access at
https://myaccount.google.com/permissions. On disconnect/revocation we delete the
stored OAuth tokens and stop accessing your calendar.

Contact. admin@astra-concierge.com

─────────────────────────────────────────────

SECTION 6 — SUB-PROCESSORS AND DATA SHARING

─────────────────────────────────────────────

6.1 Sub-Processors

– ElevenLabs, Inc.: AI voice synthesis (TTS) and speech recognition (STT). Processes call audio (inbound), AI-generated audio (outbound), call transcripts. Location: United States.

– Telnyx LLC: Telephony infrastructure, call routing, number management. Processes call metadata, audio streams (in transit), call detail records. Location: United States.

Astra will notify Clients of any change to its Sub-Processor list with 30 days’ written notice.

6.2 Other Sharing

Astra may share personal information with: Clients (call recordings, transcripts, outcomes); professional advisors under confidentiality obligations; for legal compliance if required by law; in connection with a business transfer. Astra does not sell personal information.

─────────────────────────────────────────────

SECTION 7 — DATA RETENTION

─────────────────────────────────────────────

Call audio (recordings): 24 months from date of call

Call transcripts: 24 months from date of call

Call metadata: 5 years from date of call

Opt-out records: 5 years from date of opt-out request

Client account data: Duration of the agreement + 7 years

Website analytics: 26 months

Contact form submissions: 24 months from submission

─────────────────────────────────────────────

SECTION 8 — SECURITY

─────────────────────────────────────────────

Astra implements and maintains reasonable administrative, technical, and physical safeguards including: encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256); access controls and role-based permissions; sub-processor diligence; regular review of data handling practices.

Breach Notification: In the event of a security breach affecting personal information, Astra will notify affected Clients without unreasonable delay, and in no event later than 72 hours after becoming aware of the breach, consistent with Georgia’s data breach notification statute (O.C.G.A. § 10-1-912 et seq.) and other applicable law.

─────────────────────────────────────────────

SECTION 9 — CHILDREN’S DATA

─────────────────────────────────────────────

Astra’s Services are designed exclusively for B2B use. We do not knowingly collect personal information from individuals under the age of 18.

─────────────────────────────────────────────

SECTION 10 — YOUR RIGHTS

─────────────────────────────────────────────

Depending on your relationship with Astra and the laws applicable to you, you may have the following rights: Access, Correction, Deletion, Opt-out of calls, Portability, Restriction. Contact privacy@astra-concierge.com to exercise any right. Astra will acknowledge receipt within 5 business days and respond substantively within 30 days.

─────────────────────────────────────────────

SECTION 11 — COOKIES

─────────────────────────────────────────────

Strictly necessary: Website functionality, session management (Session duration)

Analytics: Understanding how visitors use the Website, e.g., Google Analytics (Up to 26 months)

Preference: Remembering your settings and preferences (Up to 12 months)

Astra does not use advertising or tracking cookies for behavioral advertising purposes.

─────────────────────────────────────────────

SECTION 12 — THIRD-PARTY LINKS

─────────────────────────────────────────────

Astra’s Website may contain links to third-party websites or services. Astra is not responsible for the privacy practices of those third parties.

─────────────────────────────────────────────

SECTION 13 — INTERNATIONAL TRANSFERS

─────────────────────────────────────────────

Astra is a Delaware LLC. Our operations and Sub-Processors are located in the United States. Astra does not currently place calls to Illinois telephone numbers. Astra does not currently process data of individuals in the EEA, United Kingdom, or Canada.

─────────────────────────────────────────────

SECTION 14 — CHANGES TO THIS PRIVACY POLICY

─────────────────────────────────────────────

Material changes will be communicated to Clients via email at least 30 days before taking effect. Non-material changes take effect upon posting.

─────────────────────────────────────────────

SECTION 15 — CONTACT US

─────────────────────────────────────────────

Astra Concierge, LLC

Privacy Inquiries

Email: privacy@astra-concierge.com

Website: astra-concierge.com

─────────────────────────────────────────────

Astra Concierge, LLC — Privacy Policy — v1.0 — May 20, 2026