1. Scope and operator
This policy covers processing on platform.astragpt.net: sign-in through AstraGPT, console, keys, model requests, payments and support. The main website has a separate policy. The operator uses the designation “Администрация сервиса AstraGPT”. Direct personal-data requests to @AstraAgentsSUP_bot.
We process data to provide the API, perform paid requests, maintain accounts and security, answer support and meet applicable duties. Where separate consent is required, we use the corresponding choice; API use alone does not replace required regulator notifications.
2. Data we receive
The linked account supplies user ID, username, first name and language. The platform stores session-token hashes and expiry, API-key hashes, names, prefixes, last characters, limits, dates and status. The secret key is shown at issue and cannot be recovered from its hash.
Server logs process IP address, User-Agent, time and request URL. Accounting records request ID, model, status, measured usage and cost. Payment records contain order ID, currency, amount, credit or refund event and Platega transaction ID. Support receives what you put in a support request.
3. Request content and recipients
Text, prompts, attachments, input or reference images and video pass through our gateway and relay to OpenRouter and the selected model provider to fulfil a request. They may apply their own processing and moderation rules. The local text-gateway ledger stores metadata and cost, not complete prompt or response text; content nevertheless passes through our systems.
A media request also leaves operational job metadata, status, model, provider job IDs and usage. Output may remain with the provider and its URL can expire. We do not publish requests or results to other users. An outside app holding your key receives the requests and responses it makes. Platega processes payment operations; card details are entered on its payment side.
4. Location and transfers
AstraAPI’s primary account and financial database runs in Germany. Requests reach the provider through a relay in Finland; a Russian edge and replicas may participate in delivery and recovery. Routing through a Russian edge does not mean the first database recording happens in Russia. Linked AstraGPT sign-in uses its own infrastructure.
Transfers to model and payment providers may cross borders and depend on the selected model and method. We do not claim that foreign infrastructure constitutes Russian data localization. If your input contains another person’s data, ensure you have a lawful basis for the transfer.
5. Cookies and partner links
The AstraAPI session cookie is HttpOnly, Secure and SameSite=Lax and is needed for sign-in. A short-lived login-flow cookie completes authentication. Optional first-party partner attribution starts only after a separate choice in the version 2 cookie notice. Before consent, a partner-link visit increments only an aggregate click count; the counter stores no IP, User-Agent or visitor ID.
After consent, the first valid partner link for each product may set a 30-day visitor cookie. Only its token hash is stored server-side. A later sign-in may associate the visit with an account; restricted administrator reports count new registrations, payments and refunds separately for AstraGPT and AstraAPI. Declining sets no attribution cookie; withdrawal stops future attribution. Partners do not receive visitor records and this system makes no payouts.
6. Retention and deletion
An AstraAPI session lasts up to 7 days and an unfinished login up to 10 minutes. Settled, acknowledged media-relay job metadata is purged 30 days after acknowledgment; unresolved cost records may remain until reconciled. Provider video links expire on their schedule.
AstraAPI request history, payment events and financial ledger are not currently purged on one automatic calendar schedule. Records may be kept for service accounting, refunds, complaints and legal duties. Deleting a main-site account does not mean immediate erasure of these records or backups. Access, correction, restriction and deletion requests are reviewed by data category and applicable retention duties.
7. Rights and contact
You may request information and access, correction, restriction or termination of processing, withdraw consent where it is the basis, and seek erasure where law allows. Mandatory financial records may remain after optional consent is withdrawn. You may complain to the competent authority or court.
Operator designation: Администрация сервиса AstraGPT. Contact: @AstraAgentsSUP_bot. The current edition is published here with its date.