Data Processing Agreement

This Data Processing Agreement ("DPA") describes how Astrina.io processes personal data on behalf of a customer who uses our analytics, session recording, SEO monitoring and review services. It is written to describe what our service actually does today, not what we might do later.

It should be read together with our Privacy Policy, Terms of Service, Security page, Subprocessors list and Data Retention page.

1. Roles of the parties

For personal data collected from visitors to the websites you track with Astrina.io, you are the data controller and Astrina.io is the data processor. You decide which sites are tracked, whether the session recorder is installed, and what the data is used for. We process that data to provide the service to you.

For your own account with us — your email address, password hash, role, plan, balance and support tickets — Astrina.io acts as the controller. That processing is described in our Privacy Policy, not in this DPA.

You are responsible for having a lawful basis for the tracking you enable, and for telling your own visitors about it. We cannot do that for you, because we do not control your website.

2. Subject matter and duration

The subject matter of the processing is the operation of the Astrina.io service for you. This DPA applies for as long as you have an Astrina.io account and we hold personal data processed on your behalf.

Individual categories of data are kept for the periods set out in section 8 below. When you delete a tracked site from your panel, the data for that site is removed. When your account is deleted on request, we stop processing on your behalf.

3. Nature and purpose of the processing

• Website analytics — counting and describing visits to the sites you track, and producing reports and aggregated statistics for you.
• Session recording — optional. If you install the recorder script, it captures page interaction so you can replay sessions on your own site.
• SEO and page monitoring — crawling pages you ask us to monitor and keeping a history of the results.
• Reviews — accepting, moderating and publishing reviews, including the abuse controls needed to keep them usable.

We do not sell personal data and we do not share it with advertisers. Analytics uses only a first-party visitor id. We set no third-party cookies, no cross-site tracking cookies and no advertising pixels.

4. Types of personal data

Analytics (one row per hit)

• Timestamp.
• Visitor id — the first-party "_astr" id stored on your own domain (localStorage with a cookie fallback), or, where that is unavailable, a fallback id derived as md5(ip + user-agent + date).
• The visitor's IP address. See the note below — this is important.
• URL, page title, referrer and referrer host.
• Browser, operating system, device, screen size.
• Country, taken from Cloudflare's CF-IPCountry request header.
• Language.
• Campaign parameters: utm_source, utm_medium, utm_campaign.

About the IP address — plainly stated

The IP address is stored in raw form. It is not anonymised and it is not truncated. It is used for two things: (a) deriving the fallback visitor id, and (b) detecting probable bots, by classifying datacenter and hosting IP addresses through reverse DNS. A job runs every five minutes over the IP addresses seen in the last four days, and the classification results are kept in a table called "ip_intel". The IP address is retained for as long as the raw hit row exists — see section 8.

If storing raw visitor IP addresses is not acceptable for your use of the service, you should take that into account before deploying the tracking script.

Session recordings

Masking is on by default and is enforced in the browser, before data is sent to us:

• Password, email and telephone input fields never transmit a value — not even its length.
• Payment-card fields are treated the same way.
• All other input text is masked to bullets.
• Any subtree you mark with [data-astr-mask] is redacted before it leaves the browser.

Reviews

• Author (a signed-in member or a guest), rating, review text and moderation status.
• The submitter's IP address, used only for abuse rate-limiting.
• Guest reviews are published after moderation; reviews from signed-in members publish immediately.
• Evidence images and video for some review types are stored outside the web root and served only through a gated endpoint, which returns 403 unless the review is approved, or you are its author or an administrator.

Other data processed for you

• SEO reports and per-page monitoring history.
• API: one key per member (prefix ak_) and a per-day call counter holding member id, date and number of calls.
• Support desks: tickets and messages.
• "Login with Astrina": for each linked identity we store the provider, the provider's user id, and whatever the provider returns to us — typically email address, display name and avatar.

5. Categories of data subjects

• Visitors to the websites you track with Astrina.io, including anyone whose session is captured by the optional recorder.
• Your own users — the people who hold accounts with you or sign in on your site and are seen by the tracking script.
• People who submit reviews, and people who contact your support desk.

6. Our obligations as processor

• Documented instructions. We process personal data on your behalf only to provide the service, and only on your documented instructions. Your instructions are this DPA, our Terms of Service, and the choices you make in your panel — which sites you track, whether you install the recorder, and which parts of your pages you mask.
• Confidentiality. We keep data processed on your behalf confidential. Access is limited to what is needed to operate the service. We do not sell it and we do not share it with advertisers.
• Security. We apply the technical measures described in section 7 and on our Security page.
• Subprocessors. We use only the subprocessors listed in section 9 and on our Subprocessors page.
• Assistance with data-subject requests. If one of your data subjects contacts you and you need our help to answer, locate or remove their data, write to support@astrina.io and we will assist.
• Deletion. We delete data processed on your behalf on request — see section 10.
• Making information available. We answer reasonable questions about how we process your data. See section 11 for what we can and cannot provide.

7. Security measures

These are the measures that are actually in place today:

• TLS for all traffic: Cloudflare in Full (strict) mode, with a Let's Encrypt certificate on the origin server.
• Passwords are stored only as a hash, using PHP password_hash() with bcrypt (PASSWORD_DEFAULT), and checked with password_verify(). Plaintext passwords are never stored or logged.
• Email-verification and password-reset tokens are stored as a SHA-256 hash, are single-use, and expire.
• The session cookie "astrsess" is HttpOnly, Secure over HTTPS, and SameSite=Lax.
• CSRF tokens on state-changing form submissions.
• API keys are accepted only in a request header (X-Api-Key or Authorization: Bearer). They are deliberately not accepted in the URL query string, so they cannot leak into server logs, proxy logs, browser history or Referer headers. Keys can be regenerated at any time from /my/api.php, which revokes the old key instantly. A per-plan daily quota returns HTTP 429 when exceeded.
• CORS: public API methods are open (Access-Control-Allow-Origin: *). The private analytics method /api/v1/stats sends no Allow-Origin header, so a browser cannot read it cross-origin.
• The SEO crawler is hardened against SSRF: only http and https are allowed, private, loopback and link-local ranges are refused, the resolved IP is pinned, every redirect hop is re-validated, and the response body is capped.
• Review abuse controls: per-IP submission limits plus moderation.
• Bot filtering: user-agent rules plus datacenter-IP classification via reverse DNS.
• The admin area is gated by a role check.

What we do not have. We would rather say this than let you assume otherwise: there is no two-factor authentication and no SSO for the Astrina panel itself, no published penetration test, no ISO, SOC 2 or any other certification, and no bug-bounty programme.

Backups and restoration

The Hestia control panel takes a daily backup of files and database at approximately 05:12 UTC, stored in /backup on the same server. There is no off-site or geo-redundant replication: the backup lives on the same machine as the data it protects. Roughly one daily copy is kept. If the service has to be restored, it is restored from the latest daily backup. No RTO or RPO is guaranteed.

Service levels

No service level agreement is offered publicly. We do not promise uptime figures or response times here. An SLA exists only where a separate individual contract has been concluded — write to support@astrina.io if you need one.

8. Retention

Retention periods are configured by us, the operator, in the admin settings. They are not customer-configurable. Current values:

Raw hits are pruned by a daily job. Note the honest consequence of the last row: the aggregated daily and dimension tables are derived from hits and are kept indefinitely, so they survive the pruning of the raw rows they came from. They do not contain the IP address.

9. Subprocessors

This is the complete list of subprocessors:

• OVH — infrastructure hosting in the EU. Processes everything stored on the server.
• Cloudflare — DNS, CDN, TLS termination and WAF. Processes request metadata, including IP addresses.
• Payora — payment processing (cards and crypto) for balance top-ups.
• Have I Been Pwned (Pwned Passwords) — password-leak checking. Only the first five characters of a SHA-1 hash are sent (k-anonymity). The password itself never leaves the browser or our server, and no personal data is sent.

We also pull public catalog data from CoinGecko, SteamSpy, Open Food Facts and IMDb datasets. These are sources we read from — they receive no personal data from us.

The current list is published at /subprocessors.

10. International transfers

We will state only what is true. Our infrastructure is hosted with OVH in the EU, and the server is managed with the Hestia control panel, with a MariaDB/MySQL database on the same server. Cloudflare sits in front of it as a DNS, CDN and TLS proxy, and in that role processes request metadata, including IP addresses. Outbound email is sent by our own Exim mail server from noreply@astrina.io, with DKIM configured; there is no third-party mail provider.

Beyond these facts we make no further representations about transfer mechanisms. If you need a specific transfer arrangement documented for your own compliance work, raise it at support@astrina.io.

11. Audits and information

There is no third-party audit report, no certification and no published penetration test we can send you, because none exists. We are not going to imply otherwise.

What we can do is answer questions. Write to support@astrina.io and we will describe how a particular part of the system handles data, in as much detail as we can give without weakening the security of the service or exposing another customer's data. The Security page at /security is kept as an accurate description of what is actually deployed.

12. Data-subject requests, deletion and your controls

• There is no self-service account deletion in the panel today. Deletion is done on request: email support@astrina.io and we will delete the account and the data held for it. We are stating this plainly rather than pointing you at a button that does not exist.
• You can delete an individual tracked site from your panel yourself. That removes its data.
• You can regenerate or revoke your API key at any time from /my/api.php.
• If a data subject exercises a right against you and you need us to act on the underlying data, contact support@astrina.io.

support@astrina.io is our only contact address. It is also where you send privacy requests, data deletion requests and security vulnerability reports.

13. Cookies and storage

On astrina.io itself we set "astrsess" (the strictly necessary session cookie: HttpOnly, Secure, SameSite=Lax) and "astr_lang" (which remembers your chosen interface language). Your theme preference is stored in localStorage as "astr-theme", not in a cookie. We set no advertising or third-party tracking cookies on astrina.io.

On your site, the analytics script stores "_astr", a first-party visitor id, in localStorage with a cookie fallback, on your own domain. It is not readable across sites and it is not a third-party cookie.

More detail: Cookie Policy.

14. Status of this document

This DPA is offered as-is. It is our description of how we handle data processed on your behalf, and it applies when you use the service.

If you need a signed data processing agreement, a negotiated version, or specific contractual commitments, that can be discussed — write to support@astrina.io. Nothing on this page is a substitute for your own legal advice.

Related pages: Privacy · Terms · Security · Subprocessors · Retention · Acceptable Use · Cookies · Contact