Privacy Policy

Effective date: October 14, 2026

This Privacy Policy explains how Astraea Galactic, LLC ("we", "us") collects, uses, shares and protects personal data when you use DEVI (the "Platform"), a website builder. It applies to our marketing site, dashboard and editor. It also explains our role when we handle data for sites that our customers build.

1. Our Role: Controller and Processor

The Platform has three kinds of users, and our role is different for each:

• Site owners (account holders). For the account, billing and site data of our customers, we are the controller (or "business" under US state laws). This policy applies directly.
• Visitors and buyers of a site built on the Platform. For their data (orders, form submissions, quiz submissions), the site owner is the controller and we act as a processor (or "service provider"), handling the data on the owner's behalf. The owner's own privacy policy governs that data. If you are a visitor or buyer, please contact the site owner first about your data. We will help owners respond.
• Theme creators. We are the controller of your account and payout-related data. Stripe handles identity checks and payouts.

2. Data We Collect

2.1 Site owners and theme creators

We do not store your card details. Card data is entered into Stripe's payment form and held by Stripe.

2.2 Buyers (on behalf of site owners)

Checkout is guest-only, with no buyer accounts. For each order we store the buyer's email and name, the order total, currency and items, the order number, the Stripe payment identifier, the billing name and address (as provided to Stripe), and order and fulfillment status. For subscription products we store the buyer's email and name, Stripe customer and subscription identifiers, and status. Card details are collected and held by Stripe on the site owner's connected account, and we do not see them. Digital products are delivered by a time-limited link emailed to the buyer. Order summaries are emailed to the buyer and to the site's administrators. A visitor's shopping cart is kept in their own browser (see our Cookie Policy).

2.3 Form and quiz submissions (on behalf of site owners)

• Forms. Whatever a visitor types into a form is emailed through our email provider to the address the site owner chose. We also store each accepted submission (the field labels and values, the destination address, and whether the email was sent or failed) so the owner can see what came in and a failed email is not lost. Submissions rejected as spam are not stored. The owner decides what the form asks for.
• Quizzes. We store the respondent's answers and details, the computed result, whether an optional webhook delivered, and the respondent's IP address, which we also use for rate limiting. If the owner configured a webhook, the submission is also sent to the owner's chosen web address, which is a third party that we do not control.

2.3a Abuse prevention

To limit spam, card testing and mail-bombing, we rate limit forms, checkout, discount-code checks and invite links. For this we store a one-way hash of the requester's IP address (or, for invite links, email address) with a counter, not the address itself. Quiz submissions are the exception: they store the IP address itself, as described above.

2.4 Visitors browsing a site

We do not currently run analytics on sites built on the Platform. Our hosting and content delivery providers keep standard server logs (IP address, browser information, requested URL and time). Cloudflare, which delivers images and other assets for sites, and Vercel, which hosts them, receive each visitor's IP address and browser details when a site loads, and keep them in their logs under their own retention schedules. Sites may load Google Fonts, which exposes the visitor's IP address and browser details to Google, and sites that embed media (for example SoundCloud, Spotify, YouTube or Vimeo) load those providers' content, which can collect data under their own policies. Site owners may also add their own analytics or other scripts, which we do not control.

2.5 Dashboard and editor monitoring

On the Platform's own pages (the dashboard, editor, sign-in and marketing pages), and only if you accept analytics in our cookie banner, we use PostHog (US region) to track errors and to understand how the product is used, including through interaction heatmaps, surveys and in-product chat, and, during testing, session recordings. Recordings capture what appears on screen and how you interact with it (clicks, scrolling, page views and navigation). We configure it to scrub personal data from error reports and to mask password and payment fields. When you are signed in and have accepted, we link this data to your account ID, email address and name. Messages you send through chat or survey features are stored with PostHog and linked to your account, so please do not include sensitive information in them. If you decline, PostHog does not load and stores nothing, and you can change your choice any time from "Cookie preferences" in the account menu. We do not use this tooling on sites built on the Platform or to track visitors to them. Testers who take part in our testing program are covered by the Tester Terms, which describe recordings in more detail.

2.6 Communications

If you email us, or send a message through the contact form on our Help page (name, email address and message, which we email to our support inbox and do not store elsewhere), we keep the message and our reply so we can help you. We send service emails (receipts, trial and billing reminders, security notices). We do not send marketing emails without a lawful basis, and you can opt out of any marketing message.

2.7 Site members, email subscribers and gated posts (on behalf of site owners)

A site owner can make some posts available only to signed-in members or paying subscribers. This is how the Platform handles the data involved.

• Member accounts. A visitor signs in to a site with an emailed one-time link. We store the email address, whether the account is active, and the time of the last sign-in, per site. An account on one site is separate from an account on another. A person who pays for a subscription also gets a member account for the email they paid with. We set a single sign-in cookie on that site (see our Cookie Policy). Members have no passwords.
• What a member can see. Whether a member can read a gated post is decided on our servers from their subscription status. Locked content is not sent to anyone who has not unlocked it.
• Email subscribers. A signed-in member can choose to receive emails about new posts. We store the address, when they subscribed, and whether they have unsubscribed. Every email has an unsubscribe link, and a person who unsubscribes, complains or whose address bounces permanently is not emailed again. Each email contains a post's title, description and a link, never the content of locked sections.
• Email tracking (optional, set by the site owner). If the owner turns on tracking for their sending domain, our email provider records when a message is opened or a link in it is clicked and tells us. We keep, for each event, the type, the time, which link, and an anonymous per-message identifier. We do not store the recipient's address, IP address or browser details with these events, and by default no event is tied to a named subscriber. Unsubscribe links are never counted. The numbers are shown to the site owner only as totals per post and per link. Opens are approximate, because some mail apps load images automatically. Our email provider keeps its own per-recipient delivery and tracking records, under its own policy.
• Per-subscriber attribution (off by default). A site owner can choose to have opens and clicks tied to individual subscribers. If they do, they are responsible for telling their subscribers and for getting consent where the law requires it. Anyone who has unsubscribed is never attributed.
• Conversion attribution. When a visitor starts a paid subscription from a gated post's paywall, we record which post it came from on that subscription, once, when it is created. It is never changed afterwards. Visitors are not tracked before they start checkout, and no identifier follows them between visits.
• Paywall views. We keep a daily count, per post, of how many times the paywall was shown. The count has no visitor identifier. Crawlers are not counted.
• Member totals. Each day we record, per site, the number of members, paid and free, new members and cancellations. These are totals; the dashboard shows the site owner counts, not lists of people.

3. How We Use Data and Our Legal Bases

If you are in the EEA, the UK or a similar jurisdiction, we rely on these legal bases:

For visitor and buyer data that we process for site owners, the owner is responsible for its legal basis. We do not sell personal data, and we do not use visitor or buyer data for advertising. We do not make decisions about you based solely on automated processing that has legal or similarly significant effects.

4. Who We Share Data With

We use these service providers (subprocessors) to run the Platform:

We also share data where required by law or legal process, to protect rights, safety and the security of the Platform, with professional advisers under confidentiality, and in connection with a merger, acquisition or sale of assets. Site owners receive the order, form and quiz data from their own sites, and owners may configure webhooks that send data to third parties.

5. International Transfers

Our providers are mostly based in or operate from the United States, so your data may be processed outside your country. Where the law requires, we rely on appropriate safeguards for these transfers, such as standard contractual clauses or an adequacy framework, as provided by our providers. You can contact us for details.

6. How Long We Keep Data

• Account and site data: kept while your account is active. A deleted Site is first marked deleted and then permanently removed on request or during our maintenance. We aim to complete permanent deletion within 30 days of a verified request.
• Member accounts and email subscribers: kept while the account or subscription exists and the Site does. Detailed email open and click activity is deleted after the retention period the site owner chooses (90 days by default); the totals are kept. Paywall counts and daily member totals are kept as totals.
• Quiz submissions: kept until the Site is permanently deleted or the site owner asks us to remove them.
• Billing, tax and transaction records: kept as long as the law requires (typically up to 7 years).
• Form submissions: kept until the Site is permanently deleted or the site owner asks us to remove them. Copies also exist in the email accounts of the recipients.
• Rate-limit records: hashed identifiers and counters, kept only as long as needed to enforce the limits.
• Server logs and provider-held data: kept by our providers on their own schedules.
• Backups: deleted data may remain in backups for a limited period before it is overwritten.
• Email and support messages: kept while needed to help you, and as the law requires.

Order data on a site belongs to the site owner, who decides how long to keep it.

7. Your Rights and How to Use Them

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, withdraw consent, and complain to a regulator. We do not currently have a self-service tool for deleting an account or exporting data, so we handle requests manually. Email privacy@devi.works from your account email address. We may need to verify your identity, and we aim to respond within 30 days (or sooner if the law requires). If a request concerns a visitor or buyer of a site, we may direct you to the site owner or pass it to them.

Regional notes

• EEA and UK: you can complain to your local data protection authority (in the UK, the Information Commissioner's Office).
• Canada: we handle personal information consistent with PIPEDA. You can ask for access to or correction of your information, or ask about our practices. You may complain to the Office of the Privacy Commissioner of Canada.
• Australia: we handle personal information consistent with the Australian Privacy Principles. You can ask to access or correct your information, and you can complain to us and then to the Office of the Australian Information Commissioner. Disclosures to overseas providers are described in section 5.
• California and other US states: you may have the right to know, access, correct, delete and obtain a copy of your personal information, and not to be discriminated against for exercising these rights. We do not sell personal information or share it for cross-context behavioral advertising.

8. Cookies and Similar Technologies

We use cookies and local storage as described in our Cookie Policy. We ask for your consent to analytics with a banner on the Platform's own pages, and you can change your choice at any time. We do not set advertising or marketing cookies. We do not respond to "Do Not Track" signals because we do not track visitors across sites.

9. Security

We use reasonable technical and organizational measures to protect personal data, including encrypted connections (HTTPS), access controls on site data, and the security features of our infrastructure providers. No system is completely secure, and we cannot guarantee absolute security. Tell us promptly at privacy@devi.works if you believe your account has been compromised.

Reporting a security vulnerability

If you believe you have found a security vulnerability in the Platform, please email security@devi.works. Include what you found, the steps to reproduce it, and the affected page or endpoint, and send only the data needed to show the problem. We aim to acknowledge reports within 5 business days and to keep you updated until the issue is resolved. Our contact details are also published in our security.txt file.

We will not pursue legal action against anyone who reports a vulnerability in good faith, makes a reasonable effort to avoid harming other people's data or the availability of the Platform, and gives us a reasonable time to fix the issue before disclosing it publicly. Please do not access, change or delete data that is not yours, run denial-of-service or spam attacks, or test against other people's sites beyond what is needed to demonstrate the problem. We do not currently run a bug bounty program.

10. Children

The Platform is for people 18 and older. We do not knowingly collect personal data from children under 18 for our own purposes. Site owners are responsible for how their own sites handle children's data. If you believe a child has given us data, contact us and we will delete it.

11. Site Owners' Responsibilities

Site owners are responsible for the privacy policy, cookie notice and consent mechanisms on their own sites, for the data they collect through forms, quizzes, checkout, custom code and embeds, and for responding to their visitors' and buyers' requests. Our Terms of Service contain the data-processing terms that apply between us and site owners. Owners who need a separate data processing agreement can contact privacy@devi.works.

12. Changes to This Policy

We may update this policy. We will post the new version here with a new effective date, and for material changes we will notify account holders by email or in the dashboard.

13. Contact

Astraea Galactic, LLC
4539 N 22nd St, Ste. N, Phoenix AZ 85016, United States
Privacy: privacy@devi.works
Security: security@devi.works