Legal
Privacy Policy
Effective July 16, 2026
This policy explains how Astrail, operated by Riza Mohamed, handles information when you use the website, dashboard, hosted MCP runtime, and related services.
Data we collect
We collect account identifiers, contact details, billing state, imported API contracts, configuration metadata, usage records, audit events, error traces, and support messages. When you connect a provider, Astrail stores the authorization data needed to operate that connection.
Credentials and provider grants
Provider secrets and OAuth tokens are encrypted before storage and are not returned in plaintext after creation. Runtime logs are designed to redact authorization headers, cookies, tokens, client secrets, and sensitive credential query parameters.
How we use data
We use data to authenticate users, generate and run MCP endpoints, enforce permissions and plan limits, refresh or revoke provider grants, investigate failures, prevent abuse, provide support, and improve reliability.
Service providers
Astrail relies on infrastructure, database, authentication, payment, email, monitoring, and API providers to operate the service. Those processors receive only the data needed for their role and are governed by their own terms and privacy commitments.
Retention
We retain account and operational data while your account is active and as reasonably needed for security, dispute resolution, legal compliance, backups, and service integrity. Retention controls may vary by plan and data type.
Your choices
You can revoke connected provider grants, delete stored connections, and request account data access, correction, export, or deletion. Some records may be retained where required for security, billing, fraud prevention, or law.
International processing
Astrail and its service providers may process data outside your country. By using the service, you understand that privacy protections may differ across jurisdictions.
Changes
We may update this policy as the product and providers change. Material updates will be posted here with a revised effective date.
Privacy requests
Send privacy or deletion requests to codewithriza@gmail.com. We may need to verify account ownership before acting.