Your brand’s data, and how we look after it

What we store

• Your account: name, email, brand name, site URL, specialty, main goal and timezone.
• What you give the crew, such as writing samples and competitor URLs, and what the bots produce for you.
• Your support conversations with Halo, plus short notes Halo keeps so it remembers you.
• Your subscription status and how much of each monthly limit you’ve used.

We don’t store your card number. Stripe handles payment on its own checkout page, and we only see whether a payment went through.

Where it lives

• Account data and bot outputs sit in a Postgres database hosted by Supabase.
• Payments run through Stripe. Email goes out through Resend.
• The bots run on Anthropic’s Claude models. The text a bot needs for a job is sent to Anthropic to produce its answer.
• The site and app are hosted on Vercel.

Who can see it

You. Every table in the database is locked so an account can read and change only its own rows. The database keys that bypass that lock live only on our servers, never in your browser.

Halo can only reach your own records, and that limit is set in our code, so a clever message can’t talk it into another customer’s account. When Halo hands a problem to Jake, he sees your account and the conversation so he can help.

How the bots handle your pages

When Quill learns your voice or Scout studies a competitor, our server fetches the page, not your browser. It only fetches secure https addresses, refuses private and internal network addresses, stops after ten seconds and reads at most 2 MB.

Anything the bots read, whether a web page or a message you send, is treated as material to work with, never as instructions to follow. No bot has a tool that can touch another customer’s data.

Other safeguards

• Every request to the app checks that you’re signed in and validates what it receives.
• Payment and email events are only accepted when their signatures check out.
• Sign-in, bot runs and support messages are rate limited.
• Pages are served with standard security headers, including HSTS and a content security policy.
• Each account has a monthly cap on AI usage.

What we don’t do

• No ad trackers. The only analytics is Vercel Analytics, which doesn’t use cookies.
• We don’t sell your data or share it with advertisers.
• The crew never sends, posts or publishes anything for you.

Export or delete everything

From Settings you can download all your data as a JSON file at any time. Deleting your account removes your rows from our database and cancels your subscription. Stripe keeps its own payment records, as the law requires, and copies can remain in our hosting provider’s backups until those backups expire.

Found a problem?

If you think you’ve found a security issue, email support@astrobotai.io with “Security” in the subject. Jake reads those himself. More detail is in the privacy policy.