Last updated: 31 October 2026
astraHR is operated by 38SHIFT LTD, a company registered in England and Wales, company number 17335669, registered office 128 City Road, London, EC1V 2NX, United Kingdom. 38SHIFT LTD is the controller for the personal data described in “Data about you as our customer” below.
For the employee records your organisation stores in astraHR, your organisation is the controller and we are the processor. We process that data only on your instructions. If you are an employee whose data is in astraHR, your employer is the right first point of contact for access, correction or erasure.
Privacy questions: privacy@astrahr.com.
Legal basis: performance of our contract with you (Art. 6(1)(b)) for account and billing data, and our legitimate interest in operating and securing the service (Art. 6(1)(f)) for usage data. Where we are required to keep billing records, the basis is legal obligation (Art. 6(1)(c)).
You can sign in or sign up with a Google account instead of an email link. If you do, Google sends us a signed sign-in token containing your name, your email address, whether Google has verified it, your Google account identifier, a link to your profile picture and, for a Google Workspace account, your organisation’s domain. This identity data is kept with your account in our authentication system. We use it only to create or find your astraHR account and to check that the address is one Google can vouch for. We do not use or show your Google picture, we ask for no other information, and we do not read your email, contacts or files.
Nothing of Google’s sign-in loads when you open the sign-in or sign-up page. When you press Continue with Google, your browser loads Google’s sign-in button from Google, so Google receives your IP address and the address of the page, and, if you are signed in to Google in this browser, may recognise your Google account. Google’s script also stores a cookie named g_state on astrahr.com, which it uses to run its sign-in button (when the script last loaded, a random identifier for the browsing session and Google’s own settings). It lasts up to six months and we do not read it. Google’s sign-in button loads on no other astraHR page; its script also loads on the invoice page for people who can send invoices from Gmail, as described in Sending invoices from your Gmail. For sign-in, we send Google nothing beyond the sign-in itself. Google is an identity provider that you choose, not our sub-processor: for the sign-in it acts as an independent controller under its own privacy policy. Our legal basis for handling the data it sends us is performance of our contract with you (Art. 6(1)(b)).
If you manage Finance in astraHR and your workspace has it switched on, you can send an invoice from your own Gmail account. For this, astraHR asks Google for permission to send email only. We use that permission only to send the invoice you choose to send, from your own address to the client address shown on the button. astraHR does not read, store or share the content of your mailbox and does not store your Google access: it is held in your browser for the send and never reaches our servers. We keep a record that the invoice was sent (the recipient, the time, who sent it and Gmail’s message identifier), kept with the invoice and deleted when your workspace is erased. Google’s script loads on the invoice page for people who can use this feature. Besides the permission to send, astraHR receives the email address of your Google account and whether Google has verified it. We use them only to confirm that the email goes out from the address you use to sign in to astraHR, and we do not keep them. astraHR only sends: it never receives message content back from Gmail, no person at astraHR reads your email, and information from Google APIs is not used for advertising and not used to train AI models. You can withdraw the permission at any time in your Google Account’s third-party access settings at myaccount.google.com/permissions. astraHR’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
With your consent, our public website uses Google Analytics to see how visitors find and use it: which pages are viewed and for how long, from which country and on what kind of device, and which site referred you. Google Analytics sets the cookies _ga and _ga_<id> for this, which last up to two years. We do not use it for advertising. The legal basis is your consent (Art. 6(1)(a)). Google Ireland Limited provides the service, and data may be transferred to Google LLC in the United States under the EU-US Data Privacy Framework.
Google Analytics loads only after you press Accept in the cookie banner. On the sign-in and sign-up pages, Google’s sign-in button loads only when you press Continue with Google, and then sets its own g_state cookie, as described in Signing in with Google. The invoice page loads Google’s script for sending from Gmail, which sets no cookie of its own. Neither is analytics. You can change your choice at any time under Cookie settings at the foot of every page, and declining deletes the Google Analytics cookies. Your choice itself is kept in your browser, not in a cookie. Google Analytics never runs inside the astraHR application once you are signed in. The application uses only the cookies it needs to keep you signed in and secure, which do not require consent.
This is everything astraHR stores on your device, as cookies or in your browser’s storage. Only Google Analytics asks for your consent. The rest keeps you signed in, completes something you started, remembers a choice you made, or belongs to a Google sign-in you chose. The sign-in and sign-up pages also run Cloudflare Turnstile, a security check that reads browser signals inside Cloudflare’s own frame and stores nothing on astrahr.com.
| Name | Type | Purpose | How long | Consent |
|---|---|---|---|---|
| _ga, _ga_<id> | Cookie (Google) | Google Analytics on the public website | Up to 2 years | Yes, asked first |
| g_state | Cookie (Google) | Set by Google's sign-in button after you choose Continue with Google; astraHR does not read it | Up to 6 months | No, part of the Google sign-in you asked for |
| sb-<project>-auth-token (may be split into .0, .1) | Cookie | Keeps you signed in to astraHR | Up to 400 days, cleared on sign-out | No, strictly necessary |
| sb-<project>-auth-token-code-verifier, and related …-code-verifier cookies | Cookie | A one-time secret that pairs this browser with the sign-in link you asked for | Up to 400 days, cleared on sign-out | No, strictly necessary |
| astrahr_oauth_browser | Cookie | Ties a Claude connection request to the browser that started it | 10 minutes | No, strictly necessary |
| astrahr-analytics-consent | Browser storage | Remembers your cookie choice | Until you change it or clear site data | No, needed to respect your choice |
| astrahr.pendingInvite | Browser storage | Holds an invitation while you sign in to accept it | Used for up to 7 days; removed when you next open an invitation, or when you clear site data | No, strictly necessary |
| astra.assistant.width, astra.assistant.open | Browser storage | Remembers the assistant panel's width and whether it is open | Until you clear site data (open: until the tab closes) | No, a setting you made |
Employee records, documents, absence, payroll preparation, reviews, goals, meetings and feedback. We hold this as processor on your organisation’s behalf. Every table is scoped to an organisation and isolated by database-level Row Level Security, so one customer cannot read another’s rows.
We use the following sub-processors. We will tell you before adding or replacing one.
| Sub-processor | What it does | Where | Transfer basis |
|---|---|---|---|
| Supabase | Database, authentication and file storage. All customer records live here. | Ireland (eu-west-1) | Within the EEA. No transfer mechanism required. |
| Vercel | Application hosting. Processes requests in transit; stores no customer records. | Dublin (dub1) | Within the EEA for processing. Vercel Inc is US-headquartered; SCCs apply. |
| Anthropic | The AI assistant. Sends the employee and organisation data needed to answer a question you ask. When your organisation turns on AI summaries for a survey, it also receives the text of that survey's comments, without names, to produce a summary. When someone with Finance access scans a supplier's invoice, it receives that invoice, the file itself and anything printed on it, to read its details. | United States | Standard Contractual Clauses. |
| Stripe Payments Europe, Ltd. | Subscription billing. Receives your billing contact, email, address and VAT identification number. It does not receive employee records. | Ireland, with onward transfer to Stripe, Inc. in the United States | EU-US Data Privacy Framework and Standard Contractual Clauses. |
| Resend | Transactional email: sign-in links and team invitations. | United States (sending infrastructure in eu-west-1) | Standard Contractual Clauses. |
| Cloudflare (Turnstile) | Bot protection on the sign-in and sign-up pages: receives your IP address and browser signals to check that a person is signing in. | United States (global network) | EU-US Data Privacy Framework and Standard Contractual Clauses. |
The AI assistant answers questions about your own data. To do that it sends the relevant employee and organisation records to Anthropic. When your organisation turns on AI summaries for a survey, the text of that survey’s comments is sent to Anthropic, without names, to produce a summary, and the people answering are told so before they answer. When someone with Finance access scans a supplier’s invoice, the file is sent to Anthropic, with anything printed on it, to read its details into a form. astraHR keeps neither the file nor what was read unless that person checks the form and saves it. Your data is not used to train any model. If you would rather it were never sent, an owner can disable the AI modules for your workspace, and the rest of astraHR is unaffected.
If your workspace owner turns on AI apps, a person in your workspace can connect their astraHR account to Claude (Anthropic). When they ask Claude about leave, astraHR sends it the names of the people involved, leave dates, numbers of days and leave balances, limited to what that person can see in astraHR. astraHR never sends leave types, the reasons for leave, or pay. Claude is chosen and contracted by the person or their company, so Anthropic processes this data for the customer, not for astraHR. Anthropic remains a sub-processor of astraHR for the assistant inside astraHR.
We keep your data for as long as your workspace exists. If you stop paying, your data remains readable and exportable: we do not withhold access to records you have already entered, because you may need them to answer your own obligations.
Deleting an employee record deletes it. Where you must retain a record to satisfy a legal obligation, for example commercial or tax retention periods, you can pseudonymise it instead. A record for someone who has left is not billed, so retention costs you nothing.
A workspace owner can delete the whole workspace from Settings. It becomes read-only straight away and is erased 30 days later, together with every member's account, the documents uploaded to it and its invoices. Until then the owner can export the data, download every invoice, or cancel the deletion. We email the owner when the deletion is requested and again a week before the erase.
Erased data leaves our database provider's backups within 7 days of the erase.
You have the right to access, correct, erase, restrict and port your personal data, and to object to processing based on legitimate interests. Write to privacy@astrahr.com and we will respond within one month.
Portability is self-service. A workspace’s Admin can download the whole workspace as structured JSON at any time from /api/export. It works in every billing state, including after cancellation, because you may need your own records to answer a request made to you.
If you are in the UK you may complain to the Information Commissioner’s Office. If you are in the EEA you may complain to your local supervisory authority.
Data is encrypted in transit and at rest. Access is passwordless, by emailed sign-in link or with Google, so there is no password to guess or reuse. Tenant isolation is enforced by the database rather than by application code. We do not hold any security certification, and we say so rather than implying one.
We will post changes here and, for anything that materially affects you, tell you before it takes effect.