Privacy policy.

Who we are

astra (astramarketing.gr) is a marketing practice working with aesthetic clinics. This policy explains what personal data we process on this website, in our client portal and in our internal tools, why, and what your rights are. Contact for anything privacy-related: hello@astramarketing.gr.

1. Visitors of this website

Contact form. When you submit the form we store the details you type (name, clinic, email, message) in our own database, hosted in the European Union, and notify our team. We use them only to reply and to prepare the call you requested. We keep them for up to 24 months after our last contact, or delete them earlier on request.

Cookies. The main site sets no analytics or advertising cookies. Our advertising landing pages use the Meta Pixel (Meta Platforms Ireland Ltd), which sets cookies to measure how our ads perform and to show relevant ads on Facebook and Instagram. You can limit this through your browser's cookie settings or your Meta ad preferences (facebook.com/adpreferences). Meta's own policy: facebook.com/privacy/policy.

Booking a call. The "Book a call" page uses Calendly (Calendly LLC) to schedule the call. The details you enter there (name, email, notes) are stored by Calendly and shared with us so we can hold the call; Calendly's policy: calendly.com/privacy.

Hosting. The site is served by Vercel. Standard server logs (IP address, requested page, time) are kept briefly for security and are not used to profile you.

2. Clinics that work with us (clients)

For our clients we operate a client portal and an internal dashboard. We process the clinic's contact details, contract and billing data (including SEPA mandates handled by Stripe), campaign performance data from Meta and Google, and the appointment calendar if the clinic connects its Google Calendar. Legal basis: performance of our contract.

3. Patients and leads of our clients

When a clinic runs campaigns with us, people who fill in a lead form (name, phone, email, the treatment they asked about, the campaign) are recorded so the clinic can follow up. For this data the clinic is the controller and astra acts as processor under a data processing agreement with each clinic. We use it only to schedule and track appointments on the clinic's behalf, never for our own marketing, and we never sell or share it with other clinics. We keep it for the period agreed with the clinic (by default 24 months), after which it is deleted or anonymised. Requests about this data can be made to the clinic or to us; we will coordinate the answer.

4. Google user data (Calendar, Drive, Gmail)

Our team, and clinics that choose to, can connect a Google account. We request only the access needed: calendar to show and book appointments, drive.file to store files our app creates (reports, receipts), gmail.send to send reports from our own account, and the account's email address to label the connection. We read and write calendar events solely to display and manage appointments inside the portal. We do not use Google data for advertising, do not sell it, and do not let humans read it except for support with your permission. The connection can be revoked at any time from the portal or from your Google account settings.

astra's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Push notifications

If you enable notifications on a device, we store that device's push endpoint and your login email so we can deliver them. Notifications are sent through Apple's and Google's push services, which see only the encrypted message. Turn them off from the app's settings; the record is deleted automatically when a device unsubscribes.

6. Where data lives and who helps us

Our database and authentication run on Supabase (EU region), hosting on Vercel, payments on Stripe, email and calendar on Google Workspace, and advertising platforms are Meta and Google. Each acts under its own data processing terms. We do not transfer data outside the EU except where these providers do so under standard contractual clauses.

7. Your rights

Under the GDPR you can ask for access to, correction or deletion of your personal data, restriction of processing, portability, and you can object to processing based on legitimate interest. Write to hello@astramarketing.gr; we answer within one month. You can also complain to the Hellenic Data Protection Authority (dpa.gr).

8. Changes

We update this page when our tools change. The date at the top shows the current version. See also our Terms of use and Cookie policy. Greek version: Πολιτική απορρήτου.