Privacy Policy

DeepAstra LLC ("Company", "we", "us", or "our"), registered in the Sultanate of Oman, operates the DeepAstra platform ("Platform") and the website at deepastra.ai. This Privacy Policy explains how we collect, use, store, share, and protect your personal data in accordance with the Personal Data Protection Law of Oman (Royal Decree No. 6/2022) and other applicable legislation.

By using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of our Services.

• "Personal Data" means any information relating to an identified or identifiable natural person, as defined under Omani law.
• "Processing" means any operation performed on personal data, including collection, recording, storage, retrieval, use, disclosure, or deletion.
• "Data Subject" means the individual to whom the personal data relates.
• "Services" means the DeepAstra platform, website, APIs, and all related products and services.

Information You Provide

• Account information: name, email address, organization name, job title, and phone number when you register or contact us
• Communication data: messages, feedback, and inquiries submitted through contact forms, email, or support channels
• Payment information: billing details and transaction records (processed by secure, PCI-compliant payment providers)
• Service data: content, prompts, configurations, and files you submit through the Platform

Information Collected Automatically

• Device & browser data: IP address, browser type, operating system, device identifiers, and screen resolution
• Usage data: pages visited, features used, session duration, referral sources, and interaction patterns
• Log data: server logs, error reports, and API call metadata
• Cookies & similar technologies: we use essential and analytics cookies as described in Section 10

We process personal data based on one or more of the following legal grounds under Omani law:

• Consent: where you have given explicit consent for specific processing activities
• Contract performance: where processing is necessary to fulfil our contractual obligations to you
• Legitimate interest: where processing is necessary for our legitimate business interests, provided these do not override your fundamental rights
• Legal obligation: where processing is required to comply with Omani law or regulations

We use your personal data to:

• Provide, maintain, and improve the Services
• Process transactions and send related communications (invoices, receipts, support messages)
• Respond to your inquiries and provide technical support
• Send service announcements, security alerts, and product updates
• Analyse usage patterns to improve platform performance and user experience
• Ensure platform security and prevent fraud, abuse, or unauthorized access
• Comply with legal obligations and regulatory requirements in the Sultanate of Oman
• Enforce our Terms of Service and protect our legal rights

Google user data is handled only as described in Section 11; the uses listed above do not apply to it.

We do not sell your personal data. We may share your data only in the following circumstances:

• Service providers: trusted third-party vendors who assist with hosting, analytics, payment processing, and customer support, bound by confidentiality obligations
• Legal requirements: when required by Omani law, court order, or request from competent governmental authorities
• Business transfers: in connection with a merger, acquisition, or sale of assets, with appropriate data protection safeguards
• With your consent: for any purpose you have explicitly authorized

Google user data is shared only as described in Section 11.

DeepAstra offers deployment on local infrastructure and through data centre partners in Oman and the wider Middle East and North Africa (MENA) region. These options support governments and local enterprises that require control over where their data is stored and processed, including dedicated and fully air-gapped environments.

Each deployment is configured to support the customer's data residency, security, and operational requirements, and compliance with applicable national laws and sector-specific regulations. Hosting locations, network isolation, permitted integrations, and data handling responsibilities are defined in the applicable deployment and service agreements. In a fully air-gapped environment, processing remains within the isolated infrastructure and external cloud or API integrations are unavailable.

DeepAstra is designed with data sovereignty as a core principle. We prioritize storing and processing data within the Sultanate of Oman. Where international transfer is necessary, we ensure:

• The receiving country provides an adequate level of data protection as recognized under Omani law
• Appropriate contractual safeguards are in place (such as standard data protection clauses)
• Explicit consent is obtained from the data subject where required
• Transfers comply with the requirements of the Personal Data Protection Law (Royal Decree No. 6/2022)

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by Omani law. Specifically:

• Account data: retained for the duration of your account and for a reasonable period thereafter for legal and audit purposes
• Transaction data: retained for the period required by Omani commercial and tax law
• Usage & log data: retained for up to 24 months for analytics and security purposes
• Communication records: retained for up to 36 months or as required for ongoing support or legal matters

When data is no longer needed, it is securely deleted or anonymized in accordance with industry best practices. Google user data is retained only as described in Section 11.

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Access controls, role-based permissions, and multi-factor authentication
• Regular security assessments and penetration testing
• Incident response procedures aligned with Omani cybersecurity standards
• Employee training on data protection and confidentiality

While we take all reasonable precautions, no system is completely secure. In the event of a data breach, we will notify affected individuals and relevant authorities as required by the Personal Data Protection Law.

We use the following categories of cookies:

• Essential cookies: required for the Platform to function properly (authentication, security, preferences)
• Analytics cookies: help us understand how visitors interact with our website to improve performance and user experience

We do not use advertising or third-party tracking cookies. You can manage cookie preferences through your browser settings. Disabling essential cookies may affect Platform functionality.

This section applies to data DeepAstra receives from Google APIs ("Google user data"). Where it differs from the rest of this Policy, this section governs. These protections also apply to copies, summaries, search queries, and other data derived from Google user data, including aggregated or anonymized data.

What We Access

• Sign in with Google: your Google account identifier, name, email address, and profile image.
• Google Workspace apps in Kwnx: when you connect Gmail, Google Drive, Google Docs, Google Sheets, Google Slides, or Google Calendar in Kwnx, DeepAstra's desktop assistant, Kwnx can read your emails and drafts, search and read your Drive files, create Drive files, read and edit your documents, spreadsheets, and presentations, and read, create, edit, delete, and respond to your calendar events and check your availability. Kwnx creates email drafts; it does not send email.

We access this data only after you approve Google's consent screen, and only to carry out a request you make in Kwnx. Accepting our Terms or reading this Policy does not grant access to your Google account or replace your consent to data sharing.

How We Use It

We use Google user data only to provide and improve the user-facing features you request: to show the data to you and to let the AI assistant you selected read, draft, create, or edit items on your behalf. We do not use Google user data for analytics, product research, advertising, marketing, determining creditworthiness, or any purpose other than providing those features.

AI Models

To answer your request, Kwnx includes relevant Google user data in the context sent to the AI model you selected. Content retained in your conversation may be included in later requests in that conversation. Some models are self-hosted by DeepAstra on its own infrastructure; for those models, inference takes place on DeepAstra's infrastructure and Google user data is not sent to the model's developer. This does not mean that all Kwnx processing happens on your device.

Kwnx also offers models through third-party APIs, including Alibaba Cloud Model Studio for hosted Qwen models and Z.ai for GLM models. Hosted Qwen requests are sent to Alibaba Cloud; they are distinct from Qwen models hosted on DeepAstra's own infrastructure. A model's availability does not by itself authorize sharing Google user data with its provider. Our policy requires that, before such sharing, the applicable API terms or a binding agreement restrict processing to the requested service and exclude use of Google user data for model training or secondary purposes. Google user data must not be sent to a provider where those protections cannot be established.

Provider-side processing and retention are described in the Alibaba Cloud Model Studio retention policy and the Z.ai API Data Processing Addendum. The DeepAstra search retention periods below do not set provider retention periods. A provider's no-training commitment does not mean that it retains no data. Zero data retention must be confirmed for the workspace, model, and API feature used before we represent a request as covered by it.

DeepAstra does not use Google user data, whether raw, aggregated, anonymized, or derived, to create, train, or improve generalized or foundational artificial intelligence or machine learning models. We do not permit providers processing that data on our behalf to do so either. User consent does not waive this restriction.

Storage & Retention

• Your Kwnx conversation history, including Google content returned to the conversation, is stored on your device. You can remove local conversation content by deleting the conversation in Kwnx. Disconnecting Google does not itself delete content already saved in a conversation.
• The Google connector gateway and model API relay Google content to provide your request without keeping prompt or response bodies as conversation history. This does not exclude the search query storage described below or processing by a third-party provider under its applicable API agreement. OAuth tokens used to reach Google on your behalf are stored encrypted at rest and deleted when you disconnect the app or delete your account.
• If web search is used to answer your request, the query is sent to DeepAstra's search service and the search engines or search API providers used to retrieve results, including Bing, DuckDuckGo, and Z.ai when enabled. The query can contain text from your request or Google content; it is not necessarily anonymous. When search history logging is enabled, query text and limited result metadata are stored separately from billing records to provide search history. Our retention policy limits active query logs to 90 days and temporary query buffers and search-result caches in active service storage to 24 hours, unless a longer period is required by law. Google-derived queries remain subject to this section's use and sharing restrictions.
• Basic profile data from Sign in with Google is kept for as long as your account exists.

Sharing

We do not sell Google user data. We share it only with your consent to provide the features you request, including the AI processing and web search described above; when necessary for security purposes; to comply with applicable law; or as part of a merger, acquisition, or sale of assets after obtaining your explicit prior consent. A general acceptance of our Terms is not consent to a business transfer of Google user data. DeepAstra personnel do not read Google user data unless you give documented, explicit consent to view specific data for a support request, it is necessary for security purposes, or it is required by law.

Your Controls

Disconnect a Google app in Kwnx under Settings, or revoke DeepAstra's access from your Google Account's third-party connections page. To delete your account and associated data, email [email protected]. You may also use this address to request deletion of search query logs containing your Google data. Revoking Google access stops future access through that authorization; it does not automatically remove existing local conversations or search records. Data retained to meet a legal obligation is restricted to that purpose.

Limited Use

DeepAstra's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

Under the Personal Data Protection Law of Oman, you have the following rights:

• Right of access: request a copy of your personal data that we hold
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure: request deletion of your personal data, subject to legal retention requirements
• Right to restrict processing: request that we limit how your data is used
• Right to data portability: receive your data in a structured, commonly used format
• Right to withdraw consent: withdraw previously given consent at any time, without affecting the lawfulness of prior processing
• Right to object: object to processing based on legitimate interests

To exercise any of these rights, contact us at [email protected]. We will respond within thirty (30) days as required by law.

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18, we will take steps to delete it promptly. If you believe a minor has provided us with personal data, please contact us at [email protected].

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal data.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be communicated through the Platform or via email at least thirty (30) days before they take effect. The "Last updated" date at the top identifies the latest revision, not a substitute for any required notice or consent. Before using Google user data for a new purpose or sharing it in a new way, we will disclose the change and obtain your affirmative consent where required. Continued use alone does not provide that consent.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the competent authority in the Sultanate of Oman, including the Ministry of Transport, Communications and Information Technology (MTCIT), in addition to any other legal remedies available under Omani law.

For questions, concerns, or requests regarding this Privacy Policy or your personal data: