Privacy Policy | Astryven

Effective November 3, 2026

Who we are

This policy covers astryven.tech and the products you use through your Astryven account, including Sheet Studio, AI Studio, RSAI, the RSAI Agent and RSAI Live (together, the "Services"). The Services are run by Astryven, Inc., a United States corporation ("Astryven", "we", "us").

Your spreadsheet files

Sheet Studio opens and processes your files in your web browser. The contents of your files are not uploaded to our servers, and we do not see or use them. If you save a project file, it is saved to your own computer. If Sheet Studio keeps a working copy, it is stored only in your own browser.

Very large files (big file mode). Big file mode also works in your browser: the file is read from your own disk and is not uploaded. For Parquet and JSON files, your browser downloads a free file reader once from DuckDB's website (extensions.duckdb.org); nothing from your file is sent to it.

Data from a web link. If you choose "Get data" from a web link (for example Google Sheets, OneDrive, SharePoint, Dropbox, a JSON address or an OData service), browsers do not allow Sheet Studio to open most other websites directly, so our server opens that link for you and passes what it returns straight to your browser, where it is read. We do not keep the file or its contents; we record only that a link was opened and the name of the website. If you enter a sign-in for that link, it is used for that request only and is not stored or saved in your project.

When you use RSAI

RSAI is optional. When you use it, what you send is processed on our servers and by Cloudflare's AI service to produce the answer:

your chat messages and the conversation so far;
if you ask RSAI about a spreadsheet, a summary you can see first: column names, types, totals and a few example values, and sample rows only if you tick that option. To answer from every row, RSAI asks your browser to work figures out or writes Python code that runs in your browser on your file; only the results (what the code prints, its charts and the files it makes, which stay in your browser) are used, never the file itself;
if you attach a document (Word, PowerPoint, PDF, OpenDocument, RTF or text), its text (the text of scanned pages is read on your device by text recognition), and if you attach a photo or screenshot, or choose to send pictures of scanned pages, a resized copy; you see both before they are sent;
if you use RSAI Lens, a resized picture of the part of your screen or camera view you choose, taken only when you ask, or, while you have Live mode switched on, each time the picture changes (at most as often as you choose); screens you share are never recorded, and Live mode stops when you switch it off, stop sharing or close Lens. While you talk with RSAI in Lens, your browser turns your speech into text (in Chrome and Edge this is done by the browser maker's speech service) and each sentence is sent with the picture at that moment; answers are read out by your device's own voice. If you switch on Track people, the people and faces in view are found and followed on your device only: no picture is sent for this, nothing is stored, nobody is recognised, and no age, gender or emotion is worked out. Only a short line such as "2 people in view, Person 2 came in 5 s ago" is sent with your questions while tracking is on. Lens pictures, and the questions and answers of Lens, are never used for RSAI's learning;
if you use RSAI Code, what you ask for and the code RSAI writes; your projects (their chat, notes RSAI keeps about the project and up to 25 earlier versions) are stored encrypted in your account;
if you use the RSAI Agent, what you ask it, the Astryven page you are on and the recent conversation with it. Contacts you let it know stay only in your browser on that device and are never sent to Astryven;
if you use RSAI Live and ask RSAI about what is on screen, a summary of the readings or the chart (for example recent prices and the indicator summary), like any RSAI message. In RSAI Live Market, the symbols you look at (such as a share or an index) are sent from our server to public market data sources to get prices, never with your account details; your watchlist and price alerts are kept in your browser;
if you ask for a security review of code, configuration or logs, the files are first scanned in your browser with fixed rules, and any passwords, keys or tokens found are masked before anything is sent, so RSAI receives only their first and last characters. For a dependency check, only the names and versions of the software packages are sent to the public vulnerability database below;
if you ask RSAI to explain a dashboard in Sheet Studio, the figures shown on its charts (labels and totals, with the filters in use), not the rows of your data;
if you talk to RSAI, a recording of what you say, made only while the microphone button is on, which is turned into text; RSAI's spoken reply is made from its written answer.

When RSAI needs current information it may search the web. Only the search words RSAI chooses are sent to our web search provider or to public sources such as Wikipedia and news indexes, never your files or account details, and pages it reads are fetched by our servers (pages that need a browser to show their text are opened in Cloudflare's browser service).

We do not keep your chat messages, recordings, photos, screen or camera pictures, documents or data summaries after the answer is produced, except for the memory and the sharing described below. We keep a count of what you used (messages, tasks, credits and the processing cost), with no content, to run credits and the hourly and weekly usage limits. AI Studio keeps your conversations, and the files you attach to them (a spreadsheet as the file, a document as the text read from it), only in your own browser, and signing out clears them.

RSAI memory. After a conversation, RSAI saves short notes of lasting things you told it, such as your name, your work, your goals and how you like answers, so it can help you in later chats. They are stored encrypted, linked to your account, and seen only by you and RSAI. RSAI does not save passwords, codes, card, bank or ID numbers, or sensitive topics such as health, religion or politics. You can see, change or delete them in AI Studio → Memory, ask RSAI to "forget" something, or switch memory off in My account → Security. They are included when you download your data and deleted when you delete your account.

How RSAI learns from conversations. Like most AI services, RSAI learns from the conversations people have with it. After an answer, general knowledge and good answers from the chat (for example how an Excel formula works), and answers you rate, are stored without your name, account or personal details, checked by Astryven or confirmed by several people, and used to teach and train RSAI, including Astryven's own AI models. It is on by default, and you can switch it off at any time in My account → Security ("Use my conversations to help train RSAI"); people in the EU and UK have a legal right to object to this use, and the switch works for everyone. Personal facts about you are never shared this way (they stay in your own memory, above), and neither are your files, photos, recordings or summaries of your data. Items that are not approved are deleted after 90 days.

What we collect

Information	Why
Name and email address (stored encrypted)	To create and identify your account, confirm your email and send you security messages.
Your password and recovery code, in a one-way form that cannot be read back	To let you sign in and reset your password. We never store the password or code itself.
Credit balance, plan, credit history, coupons redeemed	To provide what you paid for and show you your history.
Activity records: sign-ins, account changes, payments and app events (for example "exported a report"), with network (IP) address, approximate location and browser type. Never the contents of your files.	To protect your account, show you your history, prevent misuse of free credits and help when something goes wrong. Deleted after 30 days.
A random device identifier in a cookie, and one-way codes derived from your email address and network	To recognise new-device sign-ins, allow one device at a time and give free credits only once per person and device.
Payment records (amount, date, item) from Stripe, for plans the record that you agreed to automatic renewal (date, plan and price), and for donations the thank-you coupon made	Billing, refunds, coupons and accounting. We never receive your full card number.
Free trial records: when your Sheet Studio and RSAI Live trials started, and when you accepted the RSAI Live beta terms	To run the free trials once per account and keep a record of what you accepted.
RSAI usage counts: free messages used, messages in the current hour and week, tasks run, credits and processing cost. Never the content.	To apply free messages, credits and the hourly and weekly usage limits, and to show you your usage.
Short notes RSAI remembers about you (stored encrypted), unless you switch memory off	To help you in later RSAI chats. You can see, change and delete them at any time.
SAP documents you have: which ones, when you got them and when you first opened them; your personal access codes (stored encrypted, and in a one-way form to check them)	To give you access to what you bought and to stop others from opening it. Your email address is shown on each page while you read.
Messages you send through the contact form or the Enterprise form, including any company and team details you give (stored encrypted)	To answer you and, for Enterprise, to prepare a proposal.
Support requests you send with "Report a problem": what you write, our replies, any pictures you choose to add (stored encrypted) and, if you leave it ticked, technical details of the page (browser, screen size, the part of the app you were in, how many tables and rows were open, recent error messages). You see the technical details before sending. Never the contents of your files or chats.	To understand and fix the problem and to answer you.
Technical request data processed by Cloudflare	To deliver the website and protect it from attacks.

We do not sell personal information, do not use it for advertising and do not use third-party analytics or advertising cookies.

Cookies and browser storage

We use two essential cookies: one keeps you signed in, and one holds a random device identifier used for account security. Sheet Studio may store a copy of your work in your browser's storage (IndexedDB) so it is not lost on refresh; you can turn this off in Sheet Studio, and signing out clears it. Fonts are served from our own domain.

Service providers

Cloudflare, Inc.: hosting, database, network security, bot protection and the AI service that runs RSAI.
Our web search provider: receives the search words RSAI uses when it looks something up.
OSV.dev, the public open-source vulnerability database: receives only the names and versions of software packages you ask RSAI to check, from our server, without your files or account details.
Public market data sources: receive the symbols of the shares, indices, funds or currencies you look at in RSAI Live Market, from our server, without your account details.
Stripe, Inc.: payment processing. Stripe's own privacy policy applies to the checkout page.
Our email provider: sends sign-up codes and security emails on our behalf, and holds the emails you send us and copies of contact form messages and support requests.

They process data only to provide their services to us. We may disclose information if the law requires it or to protect our users and the Services.

How long we keep it

Account data and credit history: while your account is open.
Activity records (including network addresses): 30 days, then deleted automatically.
One-way codes used to limit free credits: up to 13 months, even after an account is deleted, so free credits cannot be claimed again. They cannot be turned back into your email address.
RSAI chat messages and data summaries: not kept after the answer is produced. RSAI usage counts: up to 13 months. Answers you choose to share: until reviewed, and at most 90 days if not approved.
RSAI Code projects: until you delete them, or your account. RSAI Video was retired in November 2026, and the records of videos made with it are deleted.
RSAI Live: readings from demos, Bluetooth devices, web links and files are worked out in your browser and not stored by us. Readings your own systems send to an RSAI Live board are stored encrypted for 7 days, then deleted automatically; deleting the board or your account deletes them at once. When you ask RSAI about them, a summary of the readings on screen is sent with your question, like any RSAI message. RSAI Live is for wellness and information and is not a medical device.
Contact messages: up to 24 months.
Support requests and replies: up to 24 months after the last reply. Pictures in them: deleted 90 days after the request is closed. Deleting your account deletes your support requests.
Payment records: as long as tax and accounting law requires (usually up to 7 years).

Your choices and rights

You can see your activity, change your name and password, and delete your account yourself in My account → Security. You can also download a copy of your data there. Deleting removes your account, sessions, activity records and credit history immediately; payment records are kept without your account link where the law requires. You may also ask us to access, correct or export your data through the contact form. Depending on where you live (for example California, the EU/UK or India), you may have further rights, and we will honour them.

Legal bases, signals and complaints

Why we may use your information (EU and UK): to provide the services you asked for (our contract with you), to keep them secure, prevent misuse and improve them (our legitimate interests), with your consent where we ask for it (for example RSAI memory, the camera or the microphone), and to meet legal duties (for example tax records). You can withdraw consent at any time and complain to your local data protection authority.
Do Not Track and Global Privacy Control: we do not track you across other websites and do not sell or share personal information for advertising. We treat these browser signals as a request not to sell or share your information, which we never do anyway.
If you are in India: you can withdraw your consent at any time (for example by switching RSAI memory or learning off, or by deleting your account), ask us to correct or erase your data, and name someone to use these rights for you. Write to our grievance contact, Astryven, Inc., at admin@astryven.tech; we reply within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India.
If something goes wrong: if a security breach affects your personal information, we will tell you and the authorities without undue delay, as the law requires.

How we protect your account

Your password is never stored. We keep only a one-way code made from it with a strong, deliberately slow method and a secret key of ours. It cannot be turned back into your password, by anyone, including us. Your recovery code is also kept only in a one-way form.
Your email address (the name you sign in with) and your name are stored encrypted, and so are the network addresses you sign in from and the notes RSAI keeps about you.
Everything between your browser and our site travels over an encrypted connection.
The sign-in key that keeps you signed in lives on your device; we keep it only in a one-way form.

More measures are described on our Security page. No system is perfectly secure, so please use a strong password that you do not use anywhere else.

Children

The Services are not intended for children under 16, and we do not knowingly collect their information.

International transfers

Astryven is a US company and our providers operate globally, so your information may be processed outside your country, with appropriate safeguards.

Changes

We may update this policy from time to time, for example when we add or change products or features, when the law changes, or as Astryven's needs change. We will update the date above when it changes and post a notice on our website about significant changes before they take effect.

Contact

Astryven, Inc., United States. Contact us at admin@astryven.tech or through the contact form.