Astute

privacy policy.

Privacy Policy

This Privacy Policy sets out how Astute collects, uses and protects your personal data when you visit joinastute.com (the Site), use the Astute platform as a Brand or a Creator (the Platform), interact with our social media profiles or emails, or otherwise deal with us. Please read it carefully to understand the types of personal data we collect, how we use them, when we share them, and your rights. Capitalised terms not defined here have the meaning given in our Terms and Conditions.

1. Who we are

Astute is operated by two companies in the same group:

  • Lumera AI, Inc. (doing business as Astute), a Delaware corporation; and
  • Lumera AI Limited (trading as Astute), a company registered in England and Wales with company number 16708536 and registered office at 42a Arbor Lane, Winnersh, Wokingham, England, RG41 5JD.

Lumera AI, Inc. and Lumera AI Limited (together, Astute, we, us or our) are joint controllers of personal data processed through the Site and Platform, and share it with each other to operate Astute. If you have any questions about this Privacy Policy, or want to exercise your rights against either company, please contact us at privacy@joinastute.com.

Brands and Creators are responsible for personal data they collect independently from their audiences. This Privacy Policy covers our processing of that information when it is provided to Astute, including supporter contact details supplied for launch invitations.

2. Personal data we collect

2.1 Personal data we need to provide and manage the Platform, justified on the basis of performing our contract with you and our legitimate interests

When you create an Account, we ask for basic information so that we can set you up and manage your Account. This typically includes your name, job title, company, email address, phone number, login details and billing details. We use the same information to contact you about the Platform, respond to your queries and provide customer support. We continuously improve the Platform on the basis of the information you provide and how you use it.

2.2 Creator profile, audience and performance data, justified on the basis of performing our contract with you and our legitimate interests

If you are a Creator, we collect the information you add to your profile, such as your biography, photographs, channels, rates, audience size and demographics, topics and sample content. If you connect a third-party account (for example LinkedIn, a newsletter platform, a podcast host or Google), we receive information from that account in line with the permissions you give, such as subscriber and follower counts, open and click rates, downloads, engagement and audience composition. We use this to build your profile, show it to Brands, recommend pricing, match you with suitable Campaigns and report on Campaign performance.

2.3 Information from publicly available sources, justified on the basis of our legitimate interests

We may collect information that creators and businesses have chosen to make public, such as public social media profiles, newsletter and podcast listings, published content and publicly reported audience figures. We use it to identify creators who may be a good fit for the Platform, to keep Creator profiles accurate, and to provide benchmarks and recommendations to Brands. If you have not yet joined the Platform and would like us to stop using this information, please contact us.

2.4 Payment and transaction data, justified on the basis of performing our contract with you and our legal obligations

We process information about Bookings, Campaigns, Fees, refunds and payouts. Card and bank details are collected and processed by our payment provider, Stripe, and we receive only limited information such as the last four digits of a card, payment status and payout details. We keep records of transactions to meet our tax and accounting obligations.

2.5 Personal data we need to promote and advertise the Platform, justified on the basis of our legitimate interests

We may approach you online or offline (for example on LinkedIn, by email or at events) to ask whether you or your organisation would be interested in the Platform. To do this we use information you have chosen to publish, such as your LinkedIn profile, or have shared with us, for example by exchanging business cards. We may also receive business contact information from third-party data providers and combine it with information we already hold, so that our communications are relevant to you. We will contact you if you fill in a form on the Site, using the details you provide.

2.6 Communications, justified on the basis of performing our contract with you and our legitimate interests

When you contact us, or message other users through the Platform, we process the content of those communications and related information (such as the time sent and whether a message was read) to respond to you, to support Bookings, to resolve disputes and to keep the Platform safe.

2.7 Information generated when you use the Site and Platform, justified on the basis of your consent where required, and otherwise our legitimate interests

When you visit the Site or use the Platform, technical information about you and the device you use is generated by cookies, pixels, web beacons, server logs and similar technologies. This may include your IP address, browser type, device identifiers, pages visited, referring website, time spent, and the actions you take. Our emails may contain a small tracking pixel that tells us whether an email was opened and which links were clicked.

Where you consent, we use analytics tools (Google Analytics and PostHog) to understand how the Site and Platform are used, including by recording browsing sessions, and to measure the effectiveness of our marketing, for example by tracking the campaign tags (UTM tags) in the links that brought you to the Site. You can manage your choices using the cookie banner on the Site. Please see section 9 for more detail.

2.8 Aggregated and de-identified data

We may combine and analyse data from across the Platform, including Campaign results, pricing and audience metrics, to create aggregated or de-identified insights, for example market rates and performance benchmarks for different types of Creator. These insights do not identify you, and we may use and share them for any lawful purpose.

2.9 Minors

The Platform is for business users aged 18 or over. We do not knowingly collect personal data from or about anyone under 18. If you believe someone under 18 has provided us with personal data, please contact us and we will delete it.

2.10 Google connections and data

You can choose to connect Google services to specific Astute features. We request the permissions used by the feature you connect. These connections are separate from the website analytics described elsewhere in this Privacy Policy.

Google Calendar launch invitations. When you connect Google Calendar, we receive your Google account identifier and verified email address to identify the organiser and display the connected account to your company. We use access to events on calendars you own to create launch invitations on your primary calendar, update their timing, message, recipients or live post link, and cancel them when instructed through Astute. We retrieve the specific events created for these launches to check their state, avoid duplicate invitations and preserve attendee responses during updates. This feature does not list or import unrelated events or change calendar settings.

We store the organiser's account identifier and email address, an encrypted refresh token, launch details, recipient names and email addresses supplied to Astute, Google event identifiers and processing status. Google receives event details and recipient addresses to provide invitations, updates and cancellations. Recipients can see their invitation and organiser information. Astute configures invitations to hide the guest list and prevent guests from adding people or editing the event. Members of your Astute company and authorised Astute administrators can view and manage its launch invitations and supporter list.

Google Analytics reporting. When you connect Google Analytics, we use read-only access to list the accounts and properties available to your Google account, let you select a property and conversion events, and retrieve aggregate campaign measurements such as sessions, users and event counts. We store the selected property and events, an encrypted refresh token and reporting results used in Astute's campaign dashboards. We do not use this connection to change your Google Analytics property. Authorised company users and Astute administrators can access the relevant reporting, and reports can be shared through Astute's report-sharing features.

Google Sheets and Drive campaign workflows. Authorised Astute administrators can connect an account used for campaign spreadsheets. We create and update campaign spreadsheets, read specified spreadsheets' cell text and formatting to interpret changes and selections, and store spreadsheet references and campaign information derived from these workflows. We use the connected account's email address to identify that account during setup. Generated spreadsheets may be shared with named editors and with anyone who has their link. When an administrator asks Astute's campaign assistant to interpret a selected spreadsheet, information from that spreadsheet may be processed by our AI service providers to perform that campaign task. This connection does not provide Gmail access.

Use and disclosure limits. Astute's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. These limits also apply to information derived from Google API data and take priority over broader descriptions elsewhere in this Privacy Policy or our Terms. We use Google data for the connected features described here and transfers necessary to provide those features, subject to those requirements. Our general provisions about Platform improvement, marketing, aggregation, sharing and corporate transactions do not permit uses or transfers of Google data that those requirements prohibit.

Storage and controls. Calendar and Google Analytics refresh tokens are encrypted in Astute's database and are not returned to company members through the application. Access to integration records is controlled by the server and company permissions. Astute uses service providers to operate its hosting, database and connected features; Google also processes data under its own policies. You can review or remove Astute's access in your Google Account.

Disconnecting Calendar in Astute removes the active refresh token from that connection and stops new invitation processing through it while disconnected. It does not cancel existing Google Calendar events or erase the organiser identity, supporter lists or invitation history already stored by Astute. Clearing the reusable supporter list does not erase recipient records retained with existing invitations. Wait for invitation cancellations to finish before disconnecting if you want Astute to send their cancellations. Previously delivered information may remain with recipients or Google.

Disconnecting Google Analytics removes the active connection credentials and selected property configuration from Astute; it does not automatically erase previously generated reports. The internal Sheets connection is managed by Astute administrators. Removing its access does not delete spreadsheets already created in Google Drive.

We retain Google connection data and related information for the purposes described in this section, subject to section 6 and the Google API Services User Data Policy. To request deletion of this information held by Astute, contact privacy@joinastute.com. We handle requests under section 8, including identity verification and any applicable retention obligations. Disconnecting access and requesting deletion are separate actions.

3. How we use personal data

We use personal data for the following purposes. The legal basis we rely on is shown in brackets.

  • Providing access to the Site and Platform, managing Accounts and verifying users [performance of a contract, legitimate interests].
  • Processing Bookings, payments, refunds and payouts, and sending confirmations, invoices and notices [performance of a contract, legal obligation].
  • Matching Brands with Creators, recommending pricing and producing Campaign reports [performance of a contract, legitimate interests].
  • Responding to queries and providing customer support [performance of a contract, legitimate interests].
  • Improving, testing and developing the Platform and new products and services [legitimate interests].
  • Producing analytics, benchmarks and aggregated insights [legitimate interests, and consent where required for cookies].
  • Marketing the Platform, including by email, on social media and through online advertising [consent where required, otherwise legitimate interests].
  • Detecting and preventing fraud, misuse, inflated metrics and security incidents [legitimate interests].
  • Complying with law, and establishing, exercising or defending legal claims [legal obligation, legitimate interests].

You can opt out of marketing emails at any time using the unsubscribe link in each email.

4. Disclosures of personal data

Astute treats your personal data as confidential and does not sell it. We use various technology providers to deliver, manage, improve, promote and advertise the Platform. These include cloud hosting and storage providers, payment providers, customer relationship management systems, email and communication tools, analytics providers, advertising partners and social media companies, such as Supabase (database and authentication), Stripe (payments), Google Workspace (email and documents), Railway (hosting), Slack (internal messaging) and Notion (internal documentation). Our providers may only use personal data to provide their services to us, although their roles mean some will have access to your information.

We also share personal data as follows:

  • Between Brands and Creators. Creator profiles, rates and audience information are visible to Brands on the Platform. When a Booking is made, we share the contact and Campaign information each side needs to deliver it.
  • With our Affiliates, for the purposes described in this Privacy Policy.
  • Corporate transactions. If Astute buys or sells any business or assets, or if Astute or substantially all of its assets are acquired, personal data may be disclosed to the prospective buyer or seller, or transferred as one of the assets [legitimate interests].
  • Professional advisers, such as lawyers, accountants, auditors and insurers, where reasonably necessary [legitimate interests].
  • Protecting rights. Where we need to protect the rights, property or safety of Astute, our users or others, or to enforce our Terms [legitimate interests].
  • Legal requirements. To courts, regulators, law enforcement or tax authorities where required by law. Where permitted, we will tell you about such a request [legal obligation].

5. Transfers outside the UK or EEA

Some of our service providers store or process personal data outside the United Kingdom and the European Economic Area, including in the United States. Where we do this, we put in place safeguards required by law, such as the UK International Data Transfer Addendum or the European Commission's standard contractual clauses, or rely on an adequacy decision such as the UK-US Data Bridge. Please contact us if you would like more information about these safeguards.

6. How long we keep personal data

We keep personal data for as long as necessary for the purposes described in this Privacy Policy, including for as long as you have an Account and for a reasonable period after, to deal with any issues that may arise, or as required by law. Some personal data, such as transaction records, may need to be kept for up to six years after the end of the relevant financial year to meet legal and tax requirements. Unsubscribed email addresses may be kept on a suppression list so that we do not contact you again.

To decide retention periods, we consider the amount, nature and sensitivity of the data, the risk of harm from unauthorised use, the purposes of processing and our legal obligations. When we no longer need personal data, we delete it or anonymise it. Anonymised information may be kept indefinitely.

7. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls and limiting access to staff who need it. No internet transmission is completely secure, so please take care when deciding what to send us and keep your login details safe.

8. Your rights

Under UK GDPR (and, where it applies, EU GDPR) you have rights in relation to your personal data. You can exercise them by contacting us at privacy@joinastute.com. You have the right to:

  • be informed about how we use your personal data;
  • access your personal data;
  • have inaccurate personal data corrected;
  • have your personal data erased, in certain cases;
  • restrict our processing, in certain cases;
  • object to processing based on our legitimate interests, including profiling, and to object at any time to direct marketing;
  • data portability, in certain cases;
  • withdraw consent at any time, where we rely on consent; and
  • complain to the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concerns first.

We will respond within one month, which may be extended where a request is complex. We may need to verify your identity before acting on a request. Asking us to stop processing or to delete your personal data may mean you can no longer use the Platform, or parts of it.

9. Cookies and similar technologies

Cookies are small files stored on your device when you visit a website. We use:

  • Strictly necessary cookies, which the Site and Platform need to work, for example to keep you logged in and secure; and
  • Analytics cookies, which help us understand how people use the Site and Platform, and which of our marketing campaigns brought them to the Site, so we can improve them.

We only use analytics cookies with your consent, which you can give or withdraw at any time using the cookie banner or settings on the Site, or through your browser settings. Unless stated otherwise, cookies may remain on your device for up to two years. For more information, please see our Cookie Policy.

10. Automated decision-making

We use automated tools to suggest matches between Brands and Creators, recommend pricing and flag suspicious activity, such as unusual payment attempts or metrics that appear inflated. These tools support our team and do not make decisions that have a legal or similarly significant effect on you without human involvement.

11. Third-party websites and social media

The Site and Platform may link to third-party websites and platforms, such as LinkedIn, YouTube, Substack and podcast platforms. We are not responsible for their privacy practices, and we encourage you to read their privacy policies. When you interact with our social media pages, the platform provider also processes your data, and in some cases we may be jointly responsible with them for that processing.

12. Additional information for US residents

Depending on the state you live in (including California, Colorado, Connecticut, Virginia and others), you may have the right to: know what personal information we collect about you and how we use and disclose it; access, correct or delete that information; and opt out of the "sale" or "sharing" of personal information, or its use for targeted advertising.

We do not sell personal information, and we do not use cookies or pixels for targeted advertising. You can opt out of our analytics cookies at any time in our cookie settings, and we treat Global Privacy Control signals from your browser as a valid opt-out request.

To exercise your rights, email privacy@joinastute.com. We will verify your request and respond within the time required by law. We will not discriminate against you for exercising your rights. If we decline your request, you may appeal by replying to our decision.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page and, where appropriate, notified to you by email or through the Platform. Please check this page regularly.

14. Contact and privacy requests

To ask a question or make a privacy request, please email privacy@joinastute.com or write to us at Lumera AI Limited, 42a Arbor Lane, Winnersh, Wokingham, England, RG41 5JD.