Privacy Policy

Depending on how you use the Services, we may collect:

• Account information, such as your name, email address, user identifier, authentication details, and account settings. If you sign in through Google, we receive the account information Google makes available for authentication.
• Instagram information, when you choose to connect a professional Instagram account, including your Instagram account identifier, username, display name, biography, account type, profile image, follower and following counts, media count, posts, captions, media, alt text, permalinks, timestamps, and engagement counts made available through Meta's APIs. We also receive an access token so the connection can operate.
• Website and project content, including source URLs you ask us to import, uploaded files, images, videos, copy, site files, website settings, domains, contact-form delivery addresses, edit history, prompts, chat messages, and AI-generated output.
• Billing and domain information, such as subscription status, Stripe customer and subscription identifiers, transaction status, selected domain names, and domain registration or DNS details. Payment card details are collected directly by Stripe and are not stored by Asterisks Studio.
• Collaboration and support information, including invitee email addresses, membership roles, support requests, and other communications with us.
• Technical information, such as IP address, browser and device information, timestamps, requested pages, session and security events, error information, and service-usage records generated by our systems and infrastructure providers.

Websites created with Asterisks Studio may include contact or enquiry forms. When a visitor submits a form, Asterisks Studio processes the fields they provide, which may include their name, email address, phone number, message, or other information requested by the website owner.

We process that submission to deliver it by email to the website owner or the recipient they selected. The website owner is responsible for explaining how they use the submission after receiving it. Visitors should review the privacy notice on the relevant published website where one is provided.

We collect information:

• directly from you when you create an account, upload content, edit a site, buy or connect a domain, or contact us;
• from services you connect or use, including Google, Meta and Instagram, and Stripe;
• from collaborators who invite you to a site or add information to a shared project;
• from public webpages or public social content you ask us to import; and
• automatically through essential cookies, local storage, server logs, and similar technologies.

We use personal information to:

• create and manage accounts, sessions, subscriptions, and access permissions;
• import content, generate and edit websites, store assets, publish sites, connect domains, and maintain backups;
• operate Instagram connections and refresh imported account content when requested;
• process subscription payments, prevent fraud, and keep financial records;
• deliver website contact-form submissions and collaboration invitations;
• provide support, communicate service information, and respond to requests;
• secure, troubleshoot, monitor, and improve the Services; and
• comply with law, enforce our agreements, and protect Asterisks Studio, our users, and others.

Where applicable law requires a legal basis, we rely on performance of our contract with you, our legitimate interests in operating and securing the Services, your consent, and compliance with legal obligations, as appropriate.

Asterisks Studio uses artificial intelligence to generate and edit website content. Your prompts, project files, imported webpage content, connected Instagram content, and uploaded media may be sent to AI service providers, including Anthropic, so they can produce the requested output and support the feature.

AI output can be inaccurate and may reproduce information contained in your inputs. Review generated content before publishing it. Do not submit sensitive personal information, confidential information, or third-party material unless you have the right and a genuine need to use it. Asterisks Studio does not use your content to train an Asterisks Studio-owned general-purpose AI model.

We may disclose information:

• to service providers that help us operate the Services, including Supabase for authentication and data storage, Google for sign-in, Meta for Instagram connections, Anthropic for AI processing, Stripe for billing, Cloudflare for storage, deployment, domains and DNS, GitHub for private source backups, and Resend for email delivery;
• to site owners, collaborators, and invitees as needed to provide shared-site features;
• when you direct us to publish content or connect an external service;
• to professional advisers, regulators, courts, law enforcement, or other parties where required or permitted by law;
• to protect rights, safety, security, and the integrity of the Services; and
• as part of a merger, financing, acquisition, reorganisation, or sale of assets, subject to appropriate safeguards.

We do not sell personal information. We also do not share personal information for cross-context behavioural advertising.

We use strictly necessary cookies and browser storage to keep you signed in, protect authentication flows, remember active editor sessions, coordinate editing access, and preserve short-lived workflow state. These technologies are required for core features and security.

We do not currently use third-party advertising cookies. Your browser may let you block or delete cookies and local storage, but doing so may prevent account and editor features from working correctly.

We keep personal information for as long as reasonably necessary to provide the Services, maintain your account and sites, meet legal and financial obligations, resolve disputes, prevent abuse, and enforce agreements. Retention depends on the type of information, the reason it was collected, and applicable legal requirements.

Deleting a site removes associated project records from active systems, subject to technical processing time and limited retention in backups, security records, or records we must keep by law. Disconnecting Instagram stops future access through that connection, but content already imported into a site may remain until you remove the site or content.

We use reasonable technical and organisational safeguards designed to protect personal information. These include access controls, secure session cookies, encrypted transport, restricted service credentials, and encryption of stored Instagram access tokens.

No online service can guarantee absolute security. You are responsible for protecting access to your account and for ensuring that collaborators and published content are appropriate.

Asterisks Studio and its service providers may process information outside your country, including in the United States and other locations where our providers operate. Privacy laws in those countries may differ from those in your location. Where required, we take reasonable steps to use appropriate contractual, organisational, and legal safeguards for international transfers.

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of your personal information; object to certain processing; withdraw consent; or complain to a privacy regulator. We will not discriminate against you for exercising a privacy right.

You can manage billing through the billing portal, disconnect Instagram from the relevant site, remove sites and content through the Services, or contact us for assistance with an account-level privacy request. We may need to verify your identity before completing a request, and legal exceptions may apply.

Australian users may complain to us about a privacy concern. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner. Residents of California and other US states may exercise the privacy rights available under their local law. We do not sell or share personal information in a way that requires a sale or targeted-advertising opt-out.

You can remove specific data or request deletion of your Asterisks Studio account:

1. Delete a website: open the site in your dashboard, use the delete option, and confirm the deletion.
2. Remove Instagram access: open the relevant site and disconnect Instagram. You can also remove Asterisks Studio from your connected apps in Meta or Instagram settings.
3. Request account deletion: use our contact form and choose “Data deletion”. Submit the request from the email address connected to your Asterisks Studio account.
4. We may ask you to verify your identity. After verification, we will delete or de-identify data that is no longer required, subject to limited legal, billing, fraud-prevention, security, and backup retention requirements.

Disconnecting Instagram does not automatically delete content already imported into a Asterisks Studio site. Delete that site or include it in your account-deletion request if you want the imported copy removed.

The Services are intended for business and professional use and are not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided personal information to us, contact us so we can investigate and take appropriate action.

We may update this Privacy Policy as the Services or legal requirements change. We will post the updated version here and revise the “Last updated” date. If a change is material, we may provide additional notice through the Services or by email.

For privacy questions, requests, or complaints, email hello@asterisks.studio. Please include enough detail for us to understand and respond to your request.