1. Who we are
This Privacy Policy explains how Astra CRM Pty Ltd, ABN 34 074 841 062 (“Astra CRM”, “we”, “us”, “our”) collects, uses, discloses, and protects personal information in connection with the Astra CRM platform available at astracrm.com (the “Service”).
Astra CRM is a multi-tenant business management application. If you are an individual user accessing the Service on behalf of a business that has subscribed to Astra CRM (a “Tenant”), your use of the Service is also governed by any agreement between us and that Tenant, and by this Policy.
We are committed to complying with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Contact details for our Privacy Officer are at the end of this Policy.
2. Scope of this Policy
This Policy applies to:
- personal information we collect when a Tenant registers for and uses the Service;
- personal information about individual users within a Tenant (staff, contacts, customers of the Tenant) that a Tenant stores in the Service;
- personal information we receive through integrations with third-party accounting platforms, including Xero, MYOB, and QuickBooks Online (Intuit), where a Tenant has authorised such a connection; and
- information collected through our website, astracrm.com.
Where a Tenant uploads or syncs personal information about its own customers, employees, or contacts into Astra CRM, the Tenant is generally the entity responsible for that information under privacy law (as the collector), and Astra CRM acts as a service provider processing that data on the Tenant’s behalf, in accordance with our agreement with the Tenant. Where this Policy refers to “you,” it refers to whichever of these categories applies to your use of the Service.
3. Information we collect
3.1 Account and registration information
Name, business name, email address, phone number, billing address, and login credentials for Tenant administrators and users.
3.2 Tenant business data
Business records that a Tenant enters, uploads, or syncs into Astra CRM in the course of using the Service — for example customer records, contacts, invoices, quotes, jobs, and notes. This may include personal information about the Tenant’s own customers or staff, which the Tenant is responsible for having the appropriate consent to provide to us.
3.3 Information from connected accounting platforms (Xero, MYOB, and QuickBooks Online)
If a Tenant chooses to connect Astra CRM to their Xero, MYOB, or QuickBooks Online (Intuit) account, we access data from that platform via the relevant provider’s API using an authorisation (OAuth2) token that the Tenant grants and controls.
We deliberately limit the scope of data we request to what our integration features need: customer/contact records, product/item records, and invoices (“Connected Platform Data”). We do not request or store general ledger transactions, journal entries, profit-and-loss or balance sheet reports, bank feed data, or banking/payment credentials from any connected platform. If this scope changes in the future we will update this Policy and seek any additional authorisation required.
Note: the MYOB integration is only available to Tenants operating in Australia and New Zealand, consistent with MYOB’s own market availability.
3.4 Technical and usage data
IP address, device and browser type, log data, and usage statistics collected automatically when you use the Service or visit our website.
3.5 Multi-tenant identifiers
To keep each Tenant’s data securely separated, our platform associates data with a tenant identifier, a user identifier, and a data-centre identifier that determines where that Tenant’s data is physically hosted. These identifiers are technical/operational data and are not shared between Tenants.
4. How we use information
We use the information described above to:
- provide, operate, and maintain the Service, including keeping each Tenant’s data logically separated from other Tenants;
- authenticate users and enforce access controls;
- provide the specific integration features a Tenant has connected (e.g., syncing invoices between Astra CRM and Xero or MYOB);
- provide customer support and respond to enquiries;
- send Tenants and users service-related communications (e.g., security notices, service updates);
- with consent, send marketing communications, which you may opt out of at any time;
- improve, secure, and troubleshoot the Service; and
- comply with our legal obligations, including obligations we owe to Xero, MYOB, and Intuit (QuickBooks Online) as platform providers.
5. Our commitments regarding Xero, MYOB, and QuickBooks Online data
Where Astra CRM accesses data through the Xero API, the MYOB API, or the Intuit (QuickBooks Online) API, we make the following specific commitments, reflecting the obligations imposed on us as an accredited App Partner/Developer Partner with each of these platforms:
- We do not use Connected Platform Data to train, fine-tune, or otherwise develop any artificial intelligence or machine learning model. This applies to data obtained from Xero, MYOB, and QuickBooks Online in particular — each of which separately prohibits their developer partners from using platform data for AI/ML training without authorisation — and more broadly we do not use Tenant business data to train general-purpose or third-party AI models without separate, explicit consent.
- We do not sell Connected Platform Data to any third party.
- We do not pass on or aggregate Connected Platform Data to other apps or third parties, except where necessary to provide the integration the Tenant has requested, where the Tenant has separately consented, or where required by law.
- We only access the data scopes necessary for the features a Tenant has actively enabled — in practice, customer/contact, product/item, and invoice records only, as described in Section 3.3 — and a Tenant may disconnect the integration (revoking our access) at any time from within the Service or directly through their Xero, MYOB, or QuickBooks Online account settings.
- We maintain security controls consistent with Xero’s, MYOB’s, and Intuit’s respective developer security requirements, including encrypted transmission and storage of tokens and data, and multi-factor authentication for administrative access.
- Data residency: Connected Platform Data obtained via Xero, MYOB, or QuickBooks Online is stored on our own infrastructure once retrieved (it is not left with the source platform), in the data centre region assigned to the relevant Tenant based on that Tenant’s home market: for Australia and New Zealand Tenants, that customer data is hosted in Australia on AWS. See Section 7 for further detail.
- Once data is disconnected or a Tenant’s subscription ends, we handle deletion of Connected Platform Data in accordance with Section 9 (Data retention and deletion) below.
Your use of Xero, MYOB, or QuickBooks Online remains subject to that provider’s own terms of use and privacy policies, which you should also review. Connecting Astra CRM to Xero, MYOB, or QuickBooks Online does not change your obligations to those providers.
6. How we disclose information
We do not sell personal information. We may disclose information to:
- Sub-processors and service providers who help us run the Service (e.g., cloud hosting/data centre providers, email delivery, payment processing), under contractual obligations to protect the information and use it only for the purposes we specify;
- Xero, MYOB, and Intuit (QuickBooks Online), to the extent necessary to operate an integration the Tenant has authorised;
- Professional advisers (lawyers, accountants, auditors) where reasonably necessary;
- Regulators, courts, or law enforcement, where required or authorised by law; and
- A purchaser or prospective purchaser of our business or assets, subject to confidentiality obligations, in the event of a merger, acquisition, or sale.
A current list of our key sub-processors is available on request from our Privacy Officer.
7. Where your data is stored
Astra CRM operates a multi-tenant, multi-datacentre architecture. Each Tenant’s business data (including contacts, companies, activities, and Connected Platform Data synced from accounting integrations) is hosted in a specific data centre, identified internally by a data-centre identifier, determined by that Tenant’s home market:
- Australia and New Zealand Tenants: customer data is hosted in Australia on AWS (ap-southeast-2, Sydney).
This applies equally to Connected Platform Data obtained through Xero, MYOB, and QuickBooks Online integrations — for example, an Australian Tenant’s QuickBooks Online data (or Xero or MYOB data) is hosted in Australia on AWS. We do not move a Tenant’s data between regions except as necessary to support that Tenant’s own change of home market, with notice.
The Astra CRM web application interface may be delivered via a content delivery network for performance; that delivery layer does not change where your Tenant business data is stored.
Because Xero, MYOB, and Intuit are themselves international businesses, and because our infrastructure and sub-processors may involve entities based outside your country, some limited cross-border handling of data may still occur (for example, during authentication or support). Where we transfer personal information outside Australia, we will take reasonable steps to ensure the overseas recipient handles it consistently with the Australian Privacy Principles, as required by APP 8.
8. Security
We use industry-standard technical and organisational measures to protect personal information, including:
- encryption of data in transit (TLS) and at rest;
- JSON Web Token (JWT)–based authentication, with tokens scoped to a specific tenant, user, and data centre;
- role-based access controls restricting Astra CRM personnel access to Tenant data on a need-to-know basis;
- multi-factor authentication for administrative and developer access to production systems; and
- regular security review of our integrations with Xero, MYOB, and QuickBooks Online, consistent with each provider’s respective security requirements for developer partners.
No method of transmission or storage is completely secure. If we become aware of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme, and will notify Xero, MYOB, and/or Intuit where the breach involves their respective Connected Platform Data, consistent with our obligations to them.
9. Data retention and deletion
We retain personal information for as long as needed to provide the Service to the relevant Tenant, and afterwards for as long as necessary to comply with our legal, accounting, or reporting obligations, resolve disputes, and enforce our agreements. When a Tenant closes its account or disconnects a Xero, MYOB, or QuickBooks Online integration, we will delete or de-identify the corresponding data within 90 days, except where we are required to retain it by law or for legitimate business purposes (such as financial records).
10. Your rights
Subject to some exceptions under the Privacy Act, you may:
- request access to the personal information we hold about you;
- request correction of inaccurate or out-of-date information;
- opt out of receiving marketing communications at any time; and
- make a complaint about how we have handled your personal information.
To exercise these rights, contact our Privacy Officer using the details below. If you are not satisfied with our response, you may contact the OAIC at www.oaic.gov.au.
If you are an individual whose information has been entered into Astra CRM by a Tenant (for example, as one of that Tenant’s customers or contacts), you should generally direct access and correction requests to that Tenant in the first instance, as they control that data; we will assist the Tenant to respond where required.
11. Cookies and website analytics
Our website, astracrm.com, uses cookies and similar technologies for essential site functionality and analytics. Specifically, we use Google Analytics to understand overall site traffic and usage patterns, including which pages and referral sources (such as YouTube videos) bring visitors to our site. We have not linked Google Analytics to Google Ads or any remarketing product, so this data is not currently used to show you ads on other websites. If we later run Google Search or YouTube advertising, we will update this Policy to describe how those campaigns use cookies, including any conversion tracking. You can opt out of Google Analytics tracking using the browser add-on at https://tools.google.com/dlpage/gaoptout, or by adjusting your browser’s cookie settings.
12. Children’s privacy
The Service is intended for business use and is not directed at children. We do not knowingly collect personal information from children.
13. Changes to this Policy
We may update this Policy from time to time. We will post the updated version on this page with a revised “Last updated” date, and where changes are material, we will notify Tenants by email or in-app notice.
14. Contact us
If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact:
Email: support@astracrm.com.au
Post: Astra CRM Pty Ltd, Level 25, 100 Mount Street, North Sydney NSW 2060
This Privacy Policy should be read together with our Terms of Use.