1. Who we are
Azrastar (“Azrastar”, “we”, “us”) provides software that records browser workflows and turns them into guides, SOPs, training, interactive demos, test cases and an embeddable AI Assistant. Azrastar is operated by CV Muria Mediatech, based in Pati, Central Java, Indonesia.
This Privacy Policy explains what personal data we collect when you visit our website, use the Azrastar web app, the Azrastar browser extension, shared or embedded guides, and the AI Assistant widget — and how we use, share and protect it.
If you have any question about this policy or your data, contact us at privacy@azrastar.com.
2. Our role: controller and processor
For account, billing and website data, Azrastar decides how and why the data is processed and acts as the data controller.
For the content our customers create in their workspace — recordings, screenshots, narration, generated documents and AI Assistant conversations — the customer organization is the controller and Azrastar processes that data on its behalf and on its instructions (as a data processor). If you are an end user of one of our customers (for example, an employee using a guide or a visitor chatting with an embedded assistant), please contact that organization first about your data; we will support them in answering your request.
3. Data we collect
We only collect what we need to provide the service:
| Category | Examples | Source |
|---|---|---|
| Account data | Name, work email, organization name, role and permissions, profile photo (optional), password (stored only as a secure hash) | You, or the admin who invited you |
| Workspace content | Recorded steps (clicks, page addresses, button and field labels), screenshots, optional voice narration and its transcript, generated documents, comments, review history | You and your team, through the app and the extension |
| Usage and view data | Which documents are opened and how often (from the app, share links and embeds), audit log of actions such as publishing or approving | Generated when the service is used |
| AI Assistant data | Questions typed into an embedded assistant (with emails and long numbers masked), whether an answer was found, feedback (helpful / not helpful), the website the assistant runs on | Visitors of our customers’ applications |
| Contact requests | Name, work email, company and message you send us | You, through our contact form or email |
| Technical data | IP address and browser type, used transiently for security, rate limiting and to keep the service running | Your browser or device |
We do not knowingly collect special categories of personal data. Our recorder is designed to keep typed values and sensitive fields out of recordings (see section 4); please avoid recording real patient, customer or citizen records when a test record will do.
4. The browser extension and on-device masking
The Azrastar extension only captures while you are actively recording: you start and stop every recording yourself, and a visible bar shows when recording is on. It does not collect your browsing history outside a recording.
While recording, the extension captures the steps you take (for example “Click Save on the Patient form”), the page address and screenshots. Before anything leaves your browser:
- Password fields and fields detected as sensitive (such as national ID, insurance, card or account numbers and birth dates) are masked in screenshots and their values are not uploaded.
- Values you type into form fields are not used in step text and are never sent to our AI provider.
- Possible personal data the extension notices but cannot mask automatically is flagged so you can redact it in the editor before publishing.
- The on-screen highlight shown while recording never appears in screenshots.
You can edit, crop, redact or delete any step or screenshot afterwards. Shared and embedded guides always show screenshots with redactions permanently applied.
5. How we use data
We use personal data to:
- provide, operate and secure the service, including sign-in, team management, reviews and approvals;
- generate the outputs you ask for (guides, SOPs, training, test cases, interactive videos and demos, AI Knowledge and the AI Assistant);
- show view counts and insights to your team (for example, which guides are used and which assistant questions are not answered yet);
- enforce plan limits, prevent abuse and investigate security incidents;
- respond to your requests and send service messages (such as invitations or important changes);
- meet legal obligations.
We do not sell personal data, do not use workspace content for advertising, and do not build marketing profiles from it.
6. Legal bases
Depending on where you are, we rely on the following legal bases (as set out in Indonesia’s Personal Data Protection Law No. 27 of 2022 and, where applicable, the EU/UK GDPR):
- Performance of a contract — to provide the service your organization signed up for.
- Legitimate interests — to keep the service secure, prevent abuse and improve reliability, balanced against your rights.
- Consent — for optional features such as voice narration and the profile photo; you can withdraw consent at any time.
- Legal obligation — where the law requires us to keep or disclose information.
7. AI processing
To generate documents, answer AI Knowledge questions and power the AI Assistant, we send the relevant text — step titles and descriptions, labels, generated documents, transcripts and the question being asked — to our AI provider, OpenAI. Voice narration audio is sent for transcription when you use voice recording.
- Screenshots are not sent to the AI provider.
- Under OpenAI’s API terms, data sent through the API is not used to train OpenAI’s models by default.
- AI output is a draft: your team reviews, edits and approves documents before they are published.
- The AI Assistant answers only from the workflows an organization has published in that folder, and says so when the guides don’t cover a question.
11. How long we keep data
| Data | Retention |
|---|---|
| Account data | While the account is active; deleted or anonymized after the account is closed, unless the law requires longer |
| Workspace content | Until your organization deletes it or closes its account |
| Screenshots on the Free plan | Screenshots not used by any step are deleted after 30 days; all screenshots of an organization inactive for 180 days are deleted (step text is kept) |
| AI Assistant questions | Kept for insights while the assistant exists; deleted with the assistant or the organization |
| Backups | Rotated and overwritten on a rolling schedule |
12. Security
We protect data with measures appropriate to its sensitivity, including:
- encryption in transit (HTTPS/TLS), and encryption at rest where supported by our hosting infrastructure;
- role-based access inside each organization, with restricted workflows visible only to the people they are shared with;
- strict separation between organizations in every query;
- passwords stored only as salted hashes;
- an audit trail of edits, approvals and publishing;
- isolated, origin-restricted embeds and short-lived tokens for public features;
- rate limits and monitoring to prevent abuse.
No system is perfectly secure. If we become aware of a personal data breach affecting you, we will notify you and the relevant authorities as required by law. Please report security issues to privacy@azrastar.com.
13. International transfers
Some providers, such as our AI provider, process data outside Indonesia. When data is transferred abroad we rely on safeguards required by applicable law, such as contractual commitments that provide an adequate level of protection.
14. Your rights
Subject to applicable law, you have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate or incomplete data (most account details can be changed in Settings › Profile);
- delete your data or ask us to restrict its processing;
- receive your data in a portable format;
- object to processing based on legitimate interests;
- withdraw consent at any time, without affecting earlier processing;
- complain to the data protection authority in your country.
To exercise these rights, email privacy@azrastar.com. We will respond within the period required by law (in Indonesia, generally within 3 × 24 hours for access and correction requests). If your data is part of a customer’s workspace, we may refer you to that organization.
15. Children
Azrastar is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us data, contact us and we will delete it.
16. Changes to this policy
We may update this policy as the service evolves. We will change the “Last updated” date above and, for significant changes, notify account owners by email or in the app before they take effect.
17. Contact
Questions, requests or complaints about privacy: privacy@azrastar.com. General enquiries: hello@azrastar.com. CV Muria Mediatech, Pati, Central Java, Indonesia.