Privacy Policy

This Privacy Policy ("Policy") describes how Appstronauts ("Company," "we," "us," or "our"), operating at 30 N Gould St, STE R, Sheridan, WY 82801, USA, collects, uses, shares, and protects information in connection with Hey Portal, our Attio client portal service (the "Service"), accessible at heyportal.appstronauts.app and any related applications, websites, or platforms.

By accessing or using the Service, you ("User," "you," or "your") acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree to this Policy, you must not use the Service.

1. Information We Collect

We collect information to provide, maintain, improve, and communicate with you about the Service. The categories of information we collect include:

1.1 Account & Authentication Information

You sign in to the Service with your email address, and we send you a single-use link to confirm it. In connection with your account we collect and store:

• Your email address and any name or profile details you provide
• Session and sign-in link identifiers used to keep you signed in
• Your billing and subscription status, held by our payment processor

When you connect your Attio CRM workspace via OAuth 2.0, we receive and store the OAuth tokens and workspace identifiers required to read the Attio data you choose to share through a portal.

1.2 Portal Configuration Data

We collect and store information about the portals you build, including:

• Selected Attio objects, lists, saved views, and attributes
• The columns, filters, and sort order you choose to expose
• Portal titles, branding, content blocks, embeds, and resource links
• Access settings such as portal links, password protection, CSV download permissions, and whether a portal is switched on
• Refresh logs, timestamps, and status information

1.3 Attio Data Rendered in Portals

To display a portal, the Service reads the records and attributes you have selected from your Attio CRM workspace. This data is processed to render the portal and may be cached briefly so pages load quickly. Portals are read-only: nothing a visitor does on a portal page writes back to your Attio workspace. We do not permanently store the contents of your CRM records beyond what is required to serve the portals you have configured and the associated logging.

1.4 Usage & Technical Data

We automatically collect certain technical information when you use the Service, including:

• IP address, browser type, device type, and operating system
• Pages visited, features used, timestamps of interactions
• Referring URL and browsing patterns within the Service
• Error logs and performance data

1.5 Cookies & Tracking Technologies

We use cookies, pixels, and similar tracking technologies to maintain sessions, remember preferences, analyze usage patterns, and improve the Service. You can control cookie settings through your browser, but disabling cookies may impair Service functionality.

1.6 Public Portal Engagement and Responses

When someone opens a public portal, we may record engagement events so the portal owner can understand how the shared material was used. These events can include portal views, time spent, content sections viewed, embeds loaded or opened, resource clicks, task interactions, form submissions, and CSV downloads. We associate events with a random identifier stored in the visitor's browser and may include standard request metadata such as device type, referring page, and approximate country, region, or city. Portal form responses are stored and made available to the portal owner.

1.7 Third-Party Embeds

Public portals can contain embedded material from third-party providers such as video, document, and scheduling services. Loading an embed connects the visitor's browser directly to that provider, which may receive technical information and use cookies according to its own privacy policy. Unsupported links open on the provider's website instead of being embedded.

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Providing & Operating the Service

• Authenticating your identity and managing your account
• Reading the Attio data you selected and rendering it in your portals
• Maintaining portal configurations and enforcing portal access rules
• Providing customer support and responding to inquiries

2.2 Communications and Email Usage

By creating an account, signing in with a link we email you, or otherwise providing your email address to us, you affirmatively consent to our collection and use of your email address for ongoing communication. Specifically, we may utilize your email address to:

• Solicit Product Feedback: Reach out to you directly to request your insights, feedback, and suggestions regarding your experience with the Service, which helps us iterate and improve our offerings.
• Provide Product Updates: Send periodic announcements regarding new features, enhancements, platform modifications, and other product-related developments.
• Deliver Service-Related Notices: Send critical operational communications, including account notifications, portal status updates, error alerts, security notices, and administrative messages.
• Share Promotional Content: Send informational materials or promotional content concerning related products, services, or offerings by Appstronauts that we believe may be of interest to you.

You acknowledge that our ability to gather feedback and inform our user base of updates is a material part of how we continuously evaluate and improve the Service. While service-related operational notices (such as security alerts, billing notices, and critical service updates) are mandatory for the operation of the Service and cannot be opted out of while your account is active, you may opt out of non-essential promotional communications, product updates, and feedback requests at any time.

Because we often reach out directly rather than through an automated mailing list, you can simply reply to any such email with "not interested," "unsubscribe," or a similar request, and we will promptly honor your preference. Furthermore, as a matter of good faith and respect for your inbox, if you do not respond to our optional communications after a few attempts, we will automatically assume you are not interested and cease sending them. Opting out of optional communications does not affect our ability or right to send you essential service-related messages.

2.3 Improvement & Analytics

• Analyzing usage patterns to improve the Service
• Diagnosing technical issues and monitoring performance
• Developing new features and functionality
• Conducting research and analytics

2.4 Legal & Safety

• Complying with applicable laws, regulations, and legal processes
• Enforcing our Terms and Conditions and other agreements
• Protecting the rights, property, and safety of Appstronauts, our users, and the public
• Detecting and preventing fraud, abuse, or security incidents

3. How We Share Your Information

We do not sell your personal information. We may share information in the following circumstances:

• Third-Party Service Providers: We share data with service providers who assist us in operating the Service, including hosting providers, analytics services (e.g., Microsoft Clarity), and email delivery services. These providers are contractually obligated to use your data only for the purposes we specify.
• Attio: By using the Service, your data is transmitted to and from Attio in accordance with its terms of service and privacy policy. We encourage you to review them.
• Legal Requirements: We may disclose your information if required by law, subpoena, court order, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of such transaction. We will notify you of any such change in ownership or control of your personal information.
• With Your Consent: We may share information for any other purpose with your explicit consent.

4. Data Security

We implement commercially reasonable administrative, technical, and physical security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL protocols
• Secure storage of OAuth tokens with encryption at rest
• Access controls limiting data access to authorized personnel only
• Regular security assessments and monitoring

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You acknowledge and accept this inherent risk.

5. Data Retention

We retain your account information, portal configurations, engagement records, and associated data for as long as your account is active or as needed to provide the Service. We may also retain certain information as required by law, to resolve disputes, enforce our agreements, or for legitimate business purposes (such as analytics and record-keeping).

Upon account deletion or disconnection of your third-party accounts, we will delete or anonymize your personal information within a commercially reasonable timeframe, except where retention is required or permitted by law.

6. Your Rights

Depending on your jurisdiction, you may have certain rights regarding your personal information:

6.1 General Rights

• Access: You may request a copy of the personal information we hold about you.
• Correction: You may request that we correct inaccurate or incomplete personal information.
• Deletion: You may request that we delete your personal information, subject to certain exceptions.
• Revocation of Access: You can disconnect your Attio workspace at any time through the Service interface, which revokes our access to it and stops your portals from loading new data.
• Opt-Out of Communications: You may opt out of non-essential communications as described in Section 2.2.

6.2 For EEA/UK Residents (GDPR)

If you are located in the European Economic Area or the United Kingdom, you have additional rights under the General Data Protection Regulation, including the right to data portability, the right to restrict processing, and the right to object to processing. Our legal bases for processing include your consent, performance of a contract, and our legitimate interests in operating and improving the Service.

6.3 For California Residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, the right to request deletion, the right to opt out of the sale of personal information (we do not sell personal information), and the right to non-discrimination for exercising your privacy rights.

To exercise any of these rights, please contact us at hello@appstronauts.shop. We will respond to your request within the timeframe required by applicable law.

7. Third-Party Services

The Service integrates with Attio CRM, with our payment processor, and with the third-party providers whose material you choose to embed in a portal. Your use of these platforms is governed by their respective terms and privacy policies. We are not responsible for the privacy practices or content of third-party services.

We may also use third-party analytics and monitoring tools (including but not limited to Microsoft Clarity) to understand how users interact with the Service. These tools may collect information about your usage patterns and browsing behavior.

8. International Data Transfers

Your information may be transferred to, stored, and processed in the United States or other countries where our service providers maintain facilities. These countries may have data protection laws that differ from those in your jurisdiction. By using the Service, you consent to the transfer of your information to the United States and other countries as described in this Policy.

9. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly.

10. Do Not Track Signals

Our Service does not currently respond to "Do Not Track" (DNT) browser signals. We will update this Policy if our practices change in response to DNT technology.

11. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. When we make changes, we will update the "Last Updated" date at the top of this page. For material changes, we may also notify you via email or through a notice within the Service. Your continued use of the Service after any changes constitutes your acceptance of the updated Policy. We encourage you to review this Policy periodically.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

• Email: hello@appstronauts.shop
• Address: Appstronauts, 30 N Gould St, STE R, Sheridan, WY 82801, USA