ASTRO is a rights-management platform for music rightsholders — songwriters, artists, labels, publishers, and the people who administer their catalogs. This policy explains what we collect, why, who we share it with, and how you get it deleted.
ASTRO is operated by Noah-Milan Investments LLC, doing business as ASTRO (“ASTRO”, “we”, “us”). Questions about anything below go to contact@astrorights.com.
1. What we collect
Account information
Your name, email address, and sign-in credentials, handled by our authentication provider. If you sign in with Google or Apple, we receive your name and email address from them — never your password.
Catalog and rights data
The works, recordings, releases, ownership shares, identifiers (ISWC, ISRC, IPI, UPC), societies, territories, and contributor credits you enter or import. This is your business data. It is the reason the product exists.
Financial and royalty data
Royalty statements you upload, income and payout records, agreement terms and fee percentages, bank or payout details, and tax documents such as a W-9 or W-8. Tax forms and payout details are visible only to you and to people you have explicitly granted access.
Files you upload
Audio masters, artwork, contracts, and supporting documents, stored in our file storage provider.
Connected platform accounts
When you connect an outside account — Instagram, a Facebook Page, Threads, a streaming service — we store the access tokens that connection produces, together with the account’s public identifiers, so we can keep the data current without asking you to sign in again.
Technical information
Standard server logs: IP address, browser type, pages requested, timestamps, and error traces. We keep an audit log of significant actions inside your account — who changed what, and when — because rights administration requires a defensible record.
2. Meta platform data
This section covers data obtained through Instagram, Facebook Pages, and Threads. It applies only if you choose to connect one of those accounts. ASTRO works without connecting any of them.
When you connect, we may access and store:
- Your connected accounts — the Facebook Pages and Instagram professional accounts you administer and select during the connection flow, including their names, IDs, and profile pictures.
- Audience metrics — follower counts, post counts, and engagement figures for those accounts, so your artist and company records in ASTRO show current numbers.
- Public content metadata — captions, timestamps, permalinks, and public engagement counts of posts on those accounts.
- Publicly available business account information — where permitted by Meta, public profile details and follower counts for Instagram professional accounts belonging to artists in your catalog, retrieved by username so your catalog stays current.
- Access tokens — stored encrypted at rest and used only to make the requests described above.
We use this data for one purpose: to display and keep current the social presence of the artists and companies in your catalog. We do not use Meta data for advertising, do not sell or license it, do not build cross-site profiles of any person, and do not share it with other ASTRO customers. We do not read your Instagram direct messages.
You can disconnect at any time from Account → Integrations in ASTRO, or by removing ASTRO from your Facebook settings. Disconnecting revokes our tokens immediately; see section 6 for deletion.
3. How we use your information
- To operate the product — store your catalog, match royalty lines, compute payouts, and generate registrations and reports.
- To authenticate you and keep your account secure.
- To produce industry deliverables you ask for, such as CWR registrations and DDEX deliveries, sent to the societies and services you designate.
- To keep an audit trail of changes to rights and money.
- To support you when you contact us.
- To bill you, if you are on a paid plan.
- To meet legal, tax, and accounting obligations.
4. Who we share it with
We do not sell your personal information, and we do not share it with advertisers. We use the following service providers to run ASTRO. Each processes data only on our instructions.
| Provider | What it does |
|---|---|
| Clerk | Sign-in and account authentication |
| Neon | Database hosting (United States) |
| Cloudflare | Application hosting and file storage |
| Meta Platforms | Instagram, Facebook Page, and Threads data — only for accounts you connect |
| Public metadata lookups for catalog enrichment | |
| Anthropic | AI-assisted drafting and classification, where you use those features |
| DocuSeal | Electronic signature of agreements you send |
| Payment processor | Subscription billing, on paid plans |
Where you use AI-assisted features, the relevant text is sent to our AI provider to produce the result. It is not used to train their models.
We also disclose information when you direct us to — for example, sending a registration to a performing rights organization or a statement to a client — and when required by law, subpoena, or to protect our rights or someone’s safety. If ASTRO is ever acquired or merged, your data may transfer as part of that transaction, and this policy will continue to apply until you are given notice of a replacement.
5. How long we keep it
Catalog, royalty, and agreement records are kept for as long as your account is active, because rights and income records need history to be useful. After you close your account we delete or anonymize your data within 90 days, except where we must keep records longer for tax, accounting, or legal reasons — typically financial records for seven years. Server logs are kept for up to 12 months. Meta platform data is deleted when you disconnect the account, or within 30 days of your account closing, whichever comes first.
6. How to delete your data
You have three options, and none of them require talking to us:
- Disconnect one platform. In ASTRO, go to Account → Integrations and disconnect the account. Its tokens and the data retrieved through it are deleted immediately.
- Remove ASTRO from Facebook. In Facebook, go to Settings → Business Integrations, select ASTRO, and remove it — connections that reach Pages and Instagram are listed there rather than under Apps and Websites. This revokes our access and triggers deletion of the Meta data we hold for you.
- Delete your whole account. Email contact@astrorights.com from your account address with the subject “Delete my account”. We confirm within 5 business days and complete deletion within 30 days, subject to the legal retention noted in section 5.
You may also request a copy of your data before deleting it, in a portable format, at the same address. Step-by-step instructions live on our data deletion page.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete, or port your personal information; to object to or restrict certain processing; and to withdraw consent. Exercise any of these by writing to contact@astrorights.com. We respond within 30 days. We will not discriminate against you for exercising a right. Residents of the European Economic Area and the United Kingdom may also complain to their local supervisory authority.
We do not sell or share personal information as those terms are defined under California law.
8. Security
Data is encrypted in transit and at rest. Access tokens are stored encrypted. Access to production systems is restricted and logged. Each customer’s data is isolated at the database level, so one account cannot read another’s. No system is perfectly secure; if a breach affects your personal information, we will notify you and any required regulator without undue delay.
9. Where your data is held
ASTRO is operated from the United States, and our providers store data in the United States. If you use ASTRO from elsewhere, you are transferring your information to the United States, where privacy laws differ from those in your country.
10. Children
ASTRO is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, write to us and we will delete it.
11. Changes to this policy
We will post any change here and update the date at the top. If a change materially affects how we handle your information, we will email account holders before it takes effect.
12. Contact
Noah-Milan Investments LLC d/b/a ASTRO
contact@astrorights.com