Privacy Policy

Privacy requests go to hello@adstronomical.com. Account and product support also uses support@adstronomical.com. Billing questions can go to billing@adstronomical.com.

Postal address: [Placeholder: not published in the product yet — add a postal address before legal review].

Account information

When you create an account we collect your email address and password through Supabase Auth. The password is handled by the authentication provider; we do not store it in our own application tables. Signup also asks for your first name and last name, which we store as your name on the profile, and an optional choice to receive marketing email. The profile can also hold a phone number and an avatar address if you provide them, plus the subscription tier and the Stripe customer and subscription identifiers for a paid plan.

Business profile

If you set up a business we store the details you enter: business name, trade or industry, description, location, service areas, website, and phone number. You can also ask the product to read a website you supply and suggest business details. That page content is sent to Anthropic so a draft profile can be proposed. You decide what to keep.

Work you record

The product is built around job cards and action cards: a record of a completed job or a marketing moment. Depending on what you type or upload, that can include descriptions, outcomes, locations, captions, and photos or other media. Media you upload is stored in our file storage so it can be shown in the product and, where a publish path exists, attached to a post. Chat and field suggestions you submit can be sent to Anthropic’s Claude models to interpret a job, suggest a field, or draft wording.

TikTok, when you connect it

Connect TikTok starts TikTok’s login in your browser. We ask TikTok for two permissions: user.info.basic (basic account information TikTok defines for that scope) and video.publish (permission to publish a video). TikTok then sends our server an authorisation code. We exchange that code for an access token and, when TikTok provides one, a refresh token.

We store those tokens in Supabase Vault, which keeps them as a secret the browser cannot read. The connection row stored for your account records that TikTok is connected, when the token expires, and which business profile it belongs to. We do not currently call TikTok to download or store your display name, avatar, follower list, or video library. Publishing a video to TikTok from Adstronomical is not built yet. The publish permission is requested so that posting can be added later, only for content you choose to send. You can disconnect TikTok in the product. Disconnect deletes the connection row and the vault secret for that TikTok login.

A short-lived login state is created so the return from TikTok can be matched to your account. It contains your user id, an expiry of about ten minutes, and a random value. It is signed on our server. It is not a TikTok profile.

Other connected platforms

The connections page can start login for other networks when that network’s app credentials are configured. Facebook is the one that is fully wired today. A Facebook login can also cover an Instagram professional account and a WhatsApp Business number on the same Meta login. If that login succeeds we store, in the connection record, the Facebook Page id, the Page name, an Instagram account id, and a WhatsApp phone-number id when Meta returns them. The Page access token and user access token are stored in the vault, not in the browser. If you later publish, the current publish path can send a caption and a photo from an action card to a connected Facebook Page or Instagram account. WhatsApp feed publishing is not available.

Other listed platforms, including directories such as Checkatrade, Angi, and hipages, appear so you can find them. Connect only starts a real login when we hold that platform’s developer credentials. Until then the button reports that login is not configured, and we do not receive a token.

Payments

Paid plans are billed by Stripe. We store Stripe’s customer and subscription identifiers on your profile. Card numbers and similar payment credentials are entered in Stripe’s flow. We do not store your full card number in Adstronomical.

Device, browser, and country

The site is hosted on Vercel. Like most hosted websites, the host and our server receive standard request data such as IP address, browser type, and the page requested, in order to deliver the site and keep it reliable. Vercel Web Analytics counts page views and visitors. Vercel Speed Insights records how quickly pages load. Neither uses a cookie, and neither includes your name, email, or account contents. We do not run an advertising tracker.

The connections page asks our server for a country so the platform list can put local services first. The server reads a country code supplied by the host (Vercel or Cloudflare) when one is present. If it is not, and the request comes from a public IP, we send that IP to ipwho.is to obtain a country code. The response we keep in the page is the country code only. We do not write the IP address into your account. If you are on a private network, or the lookup fails, the page shows major platforms first and you can still pick a country yourself. We do not ask the browser for GPS location.

Cookies and similar storage

Supabase Auth uses cookies so you stay signed in. A banner stores your cookie choice (“accepted” or “declined”) in the browser’s local storage under the key cookie_consent. We do not set third-party advertising cookies. Declining the banner stores that choice; the sign-in cookies are still required to use a signed-in account.

Email

We send service email through Resend, from noreply@adstronomical.com, with replies directed to hello@adstronomical.com. That includes messages needed to run the account. Marketing email is sent only if you opt in at signup. Follow-up marketing email includes an unsubscribe link. You can also turn marketing email off in settings, or use /unsubscribe.

• To create and authenticate your account, keep you signed in, and reset access.
• To run the product you asked for: business profile, job and action cards, captions and suggestions, and the connections manager.
• To complete a TikTok, Facebook, or other platform login you start, to store the resulting token securely, and to show connection status.
• To publish to Facebook or Instagram when you use a publish path that is actually available.
• To take payment, apply the plan you chose, and keep a record of the subscription.
• To send service email, and marketing email where you have agreed.
• To choose a sensible default country on the connections list.
• To count page views, measure page speed, keep the service reliable, and diagnose errors. We do not sell personal information.

Where UK data protection law applies, we rely on contract (running the account and the features you use), legitimate interests (security, a country default that you can override, and service messages), consent (optional marketing email and optional platform connections), and legal obligation where a law requires us to keep a record.

We use these processors and platforms to run the product:

• Supabase. Account authentication, database storage, file storage, and Vault storage of platform tokens.
• Stripe. Subscription checkout and payment details.
• Anthropic. Text and, where you submit them, job or website details sent to Claude to interpret a card, suggest a field, or draft business information.
• Resend. Delivery of service and marketing email.
• Inngest. Background jobs for product workflows such as scheduled email.
• Vercel. Hosting of the website, server logs needed to serve it, and cookieless page-view and page-speed measurements.
• ipwho.is. A country lookup from a public IP when the host does not already supply a country code.
• TikTok. When you click Connect TikTok, you leave our page for TikTok’s login. TikTok receives the login, the permissions we request, and the redirect back to https://adstronomical.com/api/social/tiktok/callback. Information TikTok collects on its own sites and apps is governed by TikTok’s privacy policy, not this one.
• Meta (Facebook, Instagram, WhatsApp). When you connect Facebook, Meta’s own policies apply to data Meta collects during that login and to content you publish there.

A platform you connect receives the content you choose to publish there, under that platform’s rules. We do not sell personal information, and we do not allow the providers above to use your Adstronomical records for their own advertising.

We keep account, business, job, and action-card information while your account exists and you are using the service. A TikTok or other platform token is kept until you disconnect that platform, until the token expires and is not refreshed, or until we delete it because you asked us to. Disconnect removes that platform’s connection row and its vault secret.

Settings include deletion of the signed-in account. That action deletes the profile row and the Supabase Auth user. It does not, by itself, walk every related record. Job cards, business details, uploaded media, and any connection secrets that were not disconnected first may still exist until they are removed. Email hello@adstronomical.com if you want those remaining records deleted as well. We will delete or anonymise the personal information we still hold within 30 days of a request we can verify, unless we have to keep a specific record for tax, fraud prevention, or another legal duty. Payment records Stripe must keep are kept by Stripe under Stripe’s rules. Server logs kept by the host rotate on the host’s schedule.

If UK or EU data protection law applies to you, you can ask us to:

• Access the personal information we hold about you.
• Correct information that is wrong. You can also edit your profile and business details in the product.
• Delete your information, using in-app account deletion and, for anything it does not remove, an email request.
• Restrict or object to particular uses, including marketing.
• Receive a copy of information you provided, where the right to portability applies.
• Withdraw marketing consent. Use unsubscribe, settings, or an email to us. Withdrawal does not affect email we must send to run the account.
• Disconnect TikTok or another platform, which deletes the token we stored for it.

We may need to confirm it is you before we act. You can complain to the Information Commissioner’s Office at ico.org.uk. We would like the chance to put a problem right first.

Adstronomical is a business tool for adults. You must be 18 or over to create an account. We do not intend the service for children, and we do not knowingly collect personal information from anyone under 18. The signup form does not ask for a date of birth. If you believe a child has given us personal information, email hello@adstronomical.com and we will delete the account. TikTok has its own age rules. Connecting TikTok does not change ours.

Platform tokens are written to Supabase Vault and are not selected by the connections page. The page reads connection status and, for Facebook, the Page, Instagram, and WhatsApp identifiers needed to show what was linked. Login state is signed, and a PKCE verifier, where a provider requires one, is sealed inside that state rather than sent in the clear. Access to vault storage is limited to the server role. No method of transmission or storage is perfectly secure. Use a unique password and disconnect a platform you no longer want linked.

We are based in the United Kingdom. Supabase, Stripe, Anthropic, Resend, Vercel, TikTok, Meta, and ipwho.is may process information in the United States and other countries. Where we transfer personal information out of the UK, we use a provider that offers an appropriate safeguard, such as the UK extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum, or we transfer it because you asked us to connect a named platform. TikTok’s own international transfers are described in TikTok’s privacy policy.

We will post changes on this page and update the date above. If a change materially affects how we use TikTok data or marketing email, we will also send a service email to the address on the account.