Astra's Privacy Policy

Effective: 10/10/2025

Astra, Inc. (“Astra” “we” “us” “our”) is committed to protecting and respecting your privacy. We understand that keeping your financial and personal information secure and confidential is critical to earning and keeping your trust. It is important that you know that your trust is paramount to us.

This Privacy Policy describes the specific policies and procedures we use to collect, use, disclose, and share with others personal information we collect from you and about you through our website located at www.astra.finance or through our web-based or mobile applications (collectively, the “Site”) and any related services. We take these policies and procedures seriously.

In this Privacy Policy, the term “Personal Information” means information that relates to an identified or identifiable natural person and, where applicable, a household. By accessing or using the Site, you agree to be bound by the terms and conditions of this Privacy Policy and Astra’s Terms of Service (into which this Privacy Policy is incorporated by reference), as they may be amended from time to time in the future.

Information We Collect

To offer the Site, we collect information you provide to us, information that we collect automatically when you use or access the Site, or that we collect from you and your financial accounts as you use our Site.

Astra also collects identifiers, electronic network activity information, location information, professional information, such as company name and title, and other types of information, such as the content you disclose to use in support messages or other communications with us.

Information you provide to us

To access our services through the Site, you are required to sign up for an account. When you sign up for an account, we may ask you to provide us with Personal Information about you, like your name, e-mail address, mobile phone number, or an avatar for your account.

During the account setup, you will be asked to provide certain information about you from third-party financial institutions or third-party payments providers with which you have a legally binding customer relationship (each, a “Third-Party Financial Institution”). To enable us to access your financial data with Third-Party Financial Institutions, you will need to provide (as applicable): the name of the Third-Party Financial Institution, the username or email associated with that institution, the password for your financial account, and other similar information.

We collect this information to establish a connection with your financial accounts and gain access to information and data we need to provide you with the services you request, including your bank account and routing number with that institution. We do not store your bank account and routing number in our systems.

We may also be required to verify your identity to comply with certain obligations and laws. In such an event, we will ask you to provide us with information like your name, date of birth, your social security number, images of your government-issued identification, biometric information, and mailing address. With the exception of your name and mailing address (which we will use and store in accordance with this Privacy Policy), we will not store the other information you provide in such an event after it has been used for these purposes.

We also collect information you may provide when you create a developer account, update your profile, fill out our “contact us” form, sign up for our emails, request customer support, enroll in billing, execute a services agreement, complete a compliance questionnaire, or otherwise communicate with us.

Information we collect from your use of our Site or App

In addition to the information you provided when creating your account, we may collect technical information from you during your use of the Site. For instance, we may collect information from you about the device you use to access the Site, what operating system or internet browsing software you use for that access, access times, and your IP address. We also may collect information about how you use our Site, including what links you may click on or whether you have visited our Site in the past and when. We may also derive the approximate location of the device your use to access our Site from your IP address.

When you authorize us to access information from your financial accounts with Third-Party Financial Institutions, we may also collect information about those accounts, including the balance of those accounts, what type of institution is holding the account, and what type of account is involved (i.e., checking or savings and credit or depository). We also collect information about the transactions that have taken place with that financial account, including, but not limited to, the amount of the transaction, where the transaction took place, and the time of the transaction.

Cookies and Google Analytics

We and our partners may use various technologies to collect and store information when you visit our Site. This technology may include the use of cookies or similar technology. We use these cookies and similar technology through Google Analytics to better your experience with our Site. Google Analytics is a web analysis service provided by Google. Google utilizes the data collected from our Site, through cookies and similar technology, to track and examine the use of the Site, to prepare reports on these activities and share them with us. We use these cookies and the Google Analytics information to improve the delivery and performance of our Site by:

• better understanding how you use our Site;
• detecting and defending against fraud and other security risks; and
• better presenting advertisements, products, and/or services of interest to you.

To learn more about how Google Analytics collects and processes data, please visit “How Google uses data when you use our partners’ sites or apps”, located at www.google.com/policies/privacy/partners/.

Information we collect from other sources

We also collect information about you from other sources. For example, we may collect information from other members of your company and from vendors that help us identify new customers, including identifiers, such as your name, email address, and social media profile URL.

Depending on the applicable law of your jurisdiction, we may ask for your consent for the placing of cookies on your device, with the exception of strictly necessary cookies.

You can change your settings for cookies and similar technologies here by visiting the preference center in the cookie banner of the site you are viewing. If you have already closed the cookie banner, you may need to select the cookie icon on the site to access the cookie banner and preference center.

In addition, you can avoid cookies being placed by configuring your browser settings as such. Please refer to http://www.allaboutcookies.org/manage-cookies/index.html for information on commonly used browsers. Additionally, if cookies are disabled, not all features of our Site may operate as intended.

How We Use the Information We Collect

We use the information we collect for a variety of purposes, including:

• Providing the Site and all related services to you;
• Improving the Site and all related services, as well as to research and develop new services, determine customer demand for new or improved services, and specifically tailoring or customizing our services for you and other customers;
• Communicating with you regarding your account, changes to the Site or services we provide, and promotional material about new services or products we may be offering;
• Responding to requests or inquiries from you;
• Providing customer support or technical assistance;
• Creating or administering your account, including identifying you with your account;
• Billing you, as applicable, and to transmit payment;
• Maintaining the Site, including by ensuring compatibility with software and hardware you or our customers typically use;
• Securing the Services and our systems and networks, and protecting your information and data, including detection and prevention of fraud, malicious activity, and other illegal activities;
• Sharing or disclosing to others in accordance with this Privacy Policy;
• To verify your identity and the identities of other members of your company;
• To comply with law, such as for tax reporting purposes;
• To send you technical notices, updates, security alerts, and administrative messages;
• To help personalize the Services experience for you;
• To communicate with you about products, services, offers, and events offered or sponsored by Astra, and to provide news and other information we think may be of interest to you;
• To protect the rights, privacy, safety, or property of Astra and others; and
• For any other purpose described to you when the information was collected.

In addition to the above, we may use Personal Information about your transactions (including their amount, where they take place, and when they occurred) (“Transaction Information”) to provide you with summaries, reports, or trends regarding your spending, including information on the categories or frequency of purchases. We may use your Transaction Information to help show you trends in your spending, to predict future spending, or to highlight opportunities for savings. We may use Transaction Information to highlight unusual spending trends – like spending associated with a business trip/vacation or major purchases – to improve your record keeping and budgeting. We may use Transaction Information to show you the way such transactions may have affected your financial goals.

Information We Share with Others

We do not disclose your personal or financial information to companies, organizations, or individuals outside of Astra, subject to the following exceptions.

We may share information about our developers for limited purposes, as follows, or as otherwise described in this Privacy Policy:

• With our data processors and other service providers, partners, contractors, or vendors in connection with the services they perform for us, including collection agencies in the event of delinquent payments from our developers;
• If we believe in good faith that disclosure is appropriate to comply with applicable law, regulation, or legal process (such as a court order or subpoena), including in connection with requests from law enforcement or other governmental authorities;
• In connection with a change in ownership or control of all or part of our business (such as a merger, acquisition, reorganization, or bankruptcy);
• Between and among Astra and our current and future parents, affiliates, subsidiaries and other companies under common control or ownership; and
• With your consent or at your direction.
• We also collect, use, and share aggregated, de-identified, or anonymized information for any purpose permitted under applicable law.

We do not sell or rent personal information that we collect.

Information Disclosed to Vendors in Order to Provide our Services

We may share your Personal Information to the extent necessary to provide the Site and services. This includes, but is not limited to, updating, securing, and troubleshooting, as well as providing support. Some examples of entities to whom we disclose information are as follows:

Plaid – As part of providing you with the Site and related services concerning your financial accounts, we work with a partner, Plaid Technologies, Inc. (“Plaid”), who is also authorized to access financial accounts. We use Plaid to gather your data from financial institutions. By using our service, you grant us and Plaid the right, power, and authority to act on your behalf to access and transmit your Personal Information from the relevant financial institution. You agree to your Personal Information being transferred, stored, and processed by Plaid in accordance with the Plaid Privacy Policy (https://plaid.com/legal). We give Plaid the following information about your financial accounts that you provided during account setup:

• Name of the financial institution where your account is held;
• Your username;
• Your email address; and
• Password for that financial account.

Plaid receives this information and establishes a connection to those financial accounts. Once the connection is established, we delete the financial account information from our system.

Google Analytics – As indicated above, we also provide information regarding your use of our Site, or clicks on links to other sites on our Site, to Google Analytics.

Persona – In certain circumstances, we may share your Personal Information with vendors who help us verify your identity by performing biometric analysis to help us verify your identity and detect and prevent fraud. We use Persona to perform identity verification through facial geometry analysis.

Additionally, we may provide access to your information to other third-party vendors who may be assisting us with the operation, maintenance, or security of our Site.

Information Disclosed to our Service Providers

We also share Personal Information with our Essential Service Providers as necessary to provide the Site and the services to you. For example, we use Google Cloud Platform (GCP) as a cloud server provider, and as such we necessarily share Personal Information with GCP. Information shared with such essential service providers is strictly limited to the purposes of providing the Site and the services to you. These Service Providers may be located in a country whose data protection legislation is different from your country, and they will have access to your Personal Information as necessary to perform their functions, but they may not share that Personal Information with any other third party or use that data for any other purpose.

Information Disclosed in Connection with Business Transactions

We may disclose Personal Information to a third party in the event of reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any of our business, assets, or stock, including in connection with bankruptcy or similar proceedings.

Information Disclosed for Our Protection and the Protection of Others

We may disclose your Personal Information if legally required to do so, pursuant to a request from a governmental entity, or if we believe in good faith – after considering your privacy interests and other factors – that such action is necessary to:

• Comply with legal process or requirements, including notification obligations;
• Respond to requests from public and government authorities or regulators (including those outside your country of residence);
• Enforce our contractual rights and comply with our contractual agreements;
• Protect the rights, privacy, safety, or property of you, Astra, and others; and
• Stop any activity that we consider illegal, unethical, or legally actionable.

We may disclose Personal Information to third parties if you consent to such disclosure.

Information You Share with Others

Our Site may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for their policies. Please check these policies before you submit any personal data to these websites.

Your Options

We attempt to provide you with accurate information about your financial accounts. To do so, we need accurate information from you about yourself and those accounts. If you find that information we have about you is outdated, missing, or incorrect, we would ask that you notify us at help@astra.finance of these errors so that they can be addressed. We may ask you to verify your identity before we act on any request to change your information. We may also reject requests that are unreasonably repetitive, require extraordinary or disproportionate technical effort or cost, risk the privacy or security of others, or would be extremely impractical.

Retention Period

We will retain information we collect about you for the period necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by applicable law.

Data Security

We take security seriously and employ appropriate technical and organizational security measures consistent with the sensitivity of the personal data we process. Methods of transmission and storage of personal information are never perfectly secure, however, and therefore we cannot guarantee the absolute security of personal information. Developers End Users are responsible for the security of their devices and passwords.

Children’s Privacy

Our Site is not intended for children or minors. We do not knowingly collect data related to minors, and we hold no responsibility for data sent to us by Developers or End Users if they collect data from minors.

How to Request the Deletion of Personal Information We Collect

You may request your account be deleted by our support department by emailing privacy@astra.finance from the email address associated with your account, indicating “CANCEL” in the subject line of the message. After confirming you are the account owner we will remove Personal Information from our records and will only continue to retain such information as required by law.

State Specific Information and Rights

Information for California Residents

Overview

This section of our privacy policy describes the Personal Information we collect or process about California residents in connection with our provision of certain services to our consumers, how we use, share, and protect that Personal Information, and what your rights are concerning Personal Information that we collect or process.

In this privacy notice, “Personal Information” has the same meaning as under the California Consumer Privacy Act, as amended by the California Privacy Rights Act and accompanying regulations (collectively, the “CCPA”), California Civil Code Section 1798.100 et seq.: information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Information does not include information that has been de-identified or aggregated.

If there are any conflicts between this section and any other provision of this Privacy Policy and you are a California resident, the portion that is more protective of Personal Information shall control to the extent of such conflict. If you have any questions about this section or whether any of the following rights apply to you, please contact us at privacy@astra.finance.

Personal Information We Collect and Disclose, and for What Purposes

In the past 12 months, we have collected the Personal Information discussed above in the section titled Information We Collect and have used it for the purposes described in the section titled How We Use the Information We Collect.

We have also disclosed the following Personal Information for a business purpose in the past 12 months to the following categories of entities:

Please note that some of the Personal Information we have collected and/or disclosed in the past 12 months qualifies as Sensitive Personal Information under the CCPA (i.e., Biometric information for the purpose of uniquely identifying an individual). We do not use or disclose Sensitive Personal Information for purposes other than that which is necessary and proportionate to accomplish the objectives set forth in Cal. Code Regs. tit. 11 §7027(m). Specifically, in the past 12 months, we have collected and/or disclosed the following categories of Sensitive Personal Information:

• Social Security Numbers, drivers’ licenses, state identification card information;
• Financial account information;
• Precise geolocation information;
• Biometric information for the purpose of uniquely identifying an individual.

While we do not sell Personal Information in the way the term “sell” is commonly used, we do disclose limited cookie data with our business partners in order to provide and maintain our Site. Such a disclosure may constitute a “sale” for purposes of the CCPA. We have made such disclosures in the past 12 months.

In the past 12 months, we have not “shared” Personal Information as the term is defined by the CCPA.

Your Rights

Access

You have the right to request certain information about our collection and use of your Personal Information over the past 12 months. In response, we will provide you with the following information:

• The categories of Personal Information that we have collected about you;
• The categories of sources from which that Personal Information was collected;
• The business or commercial purpose for collecting or selling your Personal Information;
• The categories of third parties with whom we have shared your Personal Information; and
• The specific pieces of Personal Information that we have collected about you.

Deletion

You have the right to request that we delete the Personal Information that we have collected about you. Under the CCPA, this right is subject to certain exceptions: for example, we may need to retain your Personal Information to provide you with the Site or certain services or complete a transaction or other action you have requested. If your deletion request is subject to one of these exceptions, we may deny your deletion request.

Correction

You have the right to request that we correct inaccurate Personal Information that we have collected about you.

Right to Opt Out of Sale or Sharing

You have the right to opt out of the sale or sharing of your Personal Information. You may do so by contacting us via one of the methods provided above or click our “do not sell or share my Personal Information” link on our Site. To our knowledge, we do not sell or share the Personal Information of minors under 16 years of age.

Right to Limit the Use of Sensitive Personal Information

As we do not use your Sensitive Personal Information for purposes other than those set forth in Cal. Code Regs. tit. 11 §7027(m), we do not provide you with a way to limit the use of your Sensitive Personal Information.

Exercising Your Rights

To exercise the rights described above, you or your Authorized Agent (defined below) must send us a request that (1) provides sufficient information to allow us to verify that you are the person about whom we have collected Personal Information, and (2) describes request in sufficient detail to allow us to understand, evaluate and respond to it. Each request that meets both of these criteria will be considered a “Valid Request.” We may not respond to requests that do not meet these criteria. We will only use Personal Information provided in a Valid Request to verify your identity and complete your request. You do not need an account to submit a Valid Request.

We will work to respond to your Valid Request within 45 days of receipt. In certain circumstances, we may require an additional 45 days to complete your request. We will not charge you a fee for making a Valid Request unless your Valid Request(s) is excessive, repetitive or manifestly unfounded. If we determine that your Valid Request warrants a fee, we will notify you of the fee and explain that decision before completing your request.

You may submit a Valid Request by emailing us at privacy@astra.finance or contacting us at (650) 485-3965.

You may also authorize an agent (an “Authorized Agent”) to exercise your rights on your behalf. To do this, you must provide your Authorized Agent with written permission to exercise your rights on your behalf, and we may request a copy of this written permission from your Authorized Agent when they make a request on your behalf.

If you are one of our developers, you can conveniently access your online account information by logging into your account or by contacting us. To otherwise exercise your data protection rights, where applicable, please contact us at the contact information provided below. You may be required to provide additional information necessary to confirm your identity before we can respond to your request.

We Will Not Discriminate Against You for Exercising Your Rights Under the CCPA

We will not discriminate against you for exercising your rights under the CCPA. We will not deny you our goods or services, charge you different prices or rates, or provide you a lower quality of goods and services if you exercise your rights under the CCPA. However, we may offer different tiers of our services as allowed by applicable data privacy laws (including the CCPA) with varying prices, rates, or levels of quality of the goods or services you receive to the extent that that difference is related to the value of Personal Information that we receive from you.

California Do Not Track Disclosures

Do Not Track. Astra does not track its users over time and across third-party websites and therefore we do not respond to Do Not Track signals. However, Astra does recognize Global Privacy Control signals where legally required. A Global Privacy Control (“GPC”) is a browser setting that a user can set in order to send a signal to each website visited regarding the user’s privacy preferences, such as not to share or sell user’s Personal Information. If your browser or browser extension has GPC enabled, our website will automatically recognize that signal and opt you out of the sale of your Personal Information. For more information about GPC and how to implement GPC opt-out preference signals, please visit Global Privacy Control.

Other California Resident Rights

Under California Civil Code Sections 1798.83-1798.84, California residents are entitled to contact us to prevent disclosure of Personal Information to third parties for such third parties’ direct marketing purposes; in order to submit such a request, please contact us at privacy@astra.finance. Astra does not disclose Personal Information to third parties for such third parties’ direct marketing purposes.

Security

We are committed to protecting Astra and our users from unauthorized access to, or unauthorized alteration, disclosure, or destruction of, information we may possess. To provide for the security of information in our possession, we implement reasonable technical, physical, and administrative safeguards. These safeguards may include, but are not limited to:

• Encrypting Personal Information in our possession;
• Offering or requiring multi-step authentication when you access your account;
• Reviewing our Personal Information collection, storage, and processing practices, including physical security measures, to guard against unauthorized access; and
• Restricting access to personal or financial information to Astra employees, contractors, partners, or agents who need to know that information in order to process it for us and are subject to confidentiality obligations.

However, please not that no method of transmitting information over the internet is 100% secure and we therefore cannot guarantee the absolute safety of the Personal Information we maintain.

Updates and Changes

We may revise this Privacy Policy from time to time based on changes to applicable laws and regulations or other requirements applicable to us, changes in technology, or changes to our business. In the event of a material change, we will post the updated Privacy Policy on this page and update the date at the top of this page. Your use of the Site following these changes means that you accept the revised Privacy Policy. If you do not wish to accept the revised Privacy Policy, your sole recourse is to terminate your account.

We encourage you to review the Privacy Statement whenever you access the Services or otherwise interact with us to stay informed about our data practices and the choices available to you.

Questions About Our Privacy Practices

Questions about our Privacy Policy or our privacy practices can be sent to privacy@astra.finance.

Collection of Sensitive Personal Information

Please note that some of the information we collect may constitute sensitive information for purposes of the Applicable Laws. To the extent required by the Applicable Laws, we will not process such sensitive information without your prior consent.

Disclosure of Personal Information to Third Parties

To learn how we disclose your information to third parties, please visit the section titled “Information we Share with Others” above. All categories of Personal Information discussed may be disclosed to third parties (e.g., service providers, our affiliates, etc.).

Additional Privacy Notice to Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia

This Privacy Notice (“Notice”) applies to individuals who reside in the states of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia. . This Notice describes additional rights you may be entitled to pursuant to Applicable Laws in these states, including:

• request access to specific pieces of personal information collected about you;
• request to know the personal information we process, share or sell about you;
• request corrections of inaccuracies in your personal information;
• request deletion of personal information about you;
• request data portability, your requested information will be provided in a readily usable format to allow transmission to other organizations.
• request to opt out of a “sale” or “sharing” of your personal information, please see the section below on how we manage those processes; and
• request to limit the use or disclosure of your sensitive person information.

At this time, we do not sell your Personal Information, use your Personal Information for Targeted Advertising, or process your Personal Information for purposes of profiling in furtherance of decisions that produce legally or similarly significant effects concerning a consumer, and therefore, opt-out rights are not available.

How to Exercise Your Rights

We will not discriminate against you for exercising any of your rights. To exercise the rights described above, please submit a verifiable consumer request to us by either:

• Calling us at: (650) 485-3965
• Email us at: privacy@astra.finance

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to a total of 90 days), we will inform you of the reason and extension period in writing (which may include email). If you would like to appeal our actions in response to your verifiable consumer request, please email help@astra.finance from the email associated with your Astra profile and include “Appeal request” in the subject line. However, please note that you do not need to create an account to exercise this right. We may simply require additional information if you contact us from an account that is not associated with your profile.

As we do not sell your Personal Information, use such information for Targeted Advertising, or use your Personal Information to profile you in furtherance of decisions that produce legal or similarly significant effects concerning you, we do not provide you with a method to opt out.

In order to protect your privacy and the security of your information, we verify consumer requests by requesting identification documents and other documentation necessary to confirm your identity. Any additional information you provide will be used only to verify your identity and not for any other purpose.

Contact Us about this Privacy Policy

If you have any questions or comments about this Notice, the ways in which we collect and use your information described here, your choices and rights regarding such use, or if you wish to exercise your data privacy rights under the Applicable Laws, please do not hesitate to contact us at:

By Email: privacy@astra.finance

By Phone: (650) 485-3965

Authorized Agents in Colorado and Connecticut

If you want to make a request as an authorized agent on behalf of a Colorado or Connecticut resident, you may use the submission methods noted above. As part of our verification process, we may request that you provide, as applicable, proof concerning your status as an authorized agent. In addition, we may require the individual on whose behalf you are making the request to verify their own identity or your permission to submit the request.