top of page

Privacy Policy

1. Who we are and what this policy covers

Data controller: ASTRAnavi Ltd, a private company limited by shares registered in England and Wales (company no. 17316936)

Registered office: 128, City Road, London.

Contact: legal@astranavi.net

ASTRA is a mobile application published by ASTRAnavi Ltd that displays street-level safety information for the city of Milan as a risk heatmap, and offers walking directions with a risk overlay. This policy explains what personal data the ASTRA app and the astranavi.net website collect, why, on what legal basis, who it is shared with, how long it is kept, and the rights you have. It applies worldwide; users in the European Union, the European Economic Area and the United Kingdom have additional rights described in Section 9.

2. The short version

  • ASTRA does not require an account. We do not collect your name, email address, or contact details unless you contact us.

  • Location is used only while the app is open, to show your position on the map and calculate directions. You can use the map without granting location access.

  • We do not sell personal data, show advertising, or use advertising identifiers, and we do not track you across other companies’ apps or websites.

  • The risk heatmap is built from aggregated, modelled crime-risk data about places, not data about people. It contains no personal data.

3. Data we collect and why

Server-side storage of location. Route requests and associated coordinates may be processed and temporarily stored on our servers to deliver directions and improve service reliability. We do not build movement profiles of identified users.

​

Analytics SDKs. As of the effective date, ASTRA integrates no third-party analytics or advertising SDKs. 

​

What we do not collect: names, email addresses (except when you contact us), phone numbers, contacts, photos, health data, financial data, advertising identifiers (IDFA), or any data used to track you across third-party apps and websites.

4. The safety heatmap is not personal data

Risk zones shown in ASTRA are derived from Risk Terrain Modeling data supplied under licence by MineCrime S.r.l., aggregated at census-section level for Milan. This is a modelled risk surface about geographic areas. It contains no information about identified or identifiable individuals, no victim or offender data, and no user-generated reports. The in-app incident report interface does not transmit or store any data in the current version of the app.

5. Who we share data with

We share personal data only with the service providers below, only as needed to run ASTRA. Each provider is contractually required to protect your data to at least the standard described in this policy, as required by Apple App Store Review Guideline 5.1.1. We never sell personal data and never share it with data brokers or advertising networks.

We may also disclose data where required by law, court order, or to protect the rights, safety, or property of users, the public, or ASTRAnavi Ltd, and in connection with a merger, acquisition, or sale of assets (in which case this policy will continue to apply to previously collected data).

6. Legal bases (GDPR / UK GDPR)

7. International transfers

ASTRAnavi Ltd is established in the United Kingdom (UK GDPR applies). For users in the EU/EEA, transfers to the UK are covered by the European Commission’s adequacy decision. Transfers to Mapbox in the United States rely on the EU–US Data Privacy Framework and, where applicable, Standard Contractual Clauses. 

8. Retention

  • Location processed on-device: not retained by us.

  • Route requests and server logs (including IP addresses): retained for up to 30–90 days for security and debugging, then deleted or anonymised.

  • Mapbox telemetry: controlled by Mapbox; de-identified promptly; IP addresses retained by Mapbox for approximately 30 days.

  • Contact emails: retained as long as needed to handle your enquiry, up to 24 months.

9. Your rights

If you are in the EU/EEA or UK, you have the right to access, rectify, and erase your personal data; to restrict or object to processing; to data portability; and to withdraw consent at any time without affecting prior processing. Because ASTRA has no accounts, most data we hold cannot be linked to you by name — to exercise a right, email legal@astranavi.net and include enough technical detail (e.g. IP address and approximate time of use) for us to locate the data. We respond within one month.

​

You may complain to a supervisory authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in Italy, the Garante per la Protezione dei Dati Personali (gpdp.it); or your local authority. Users in other jurisdictions (including US states with consumer privacy laws) may exercise equivalent rights by contacting us at the same address; we honour access and deletion requests globally.

​

Opting out of Mapbox telemetry: tap the attribution (ⓘ) mark on the map and use the telemetry toggle, or contact us and we will assist.

10. Children

ASTRA is not directed at children under 14 and we do not knowingly collect personal data from them. Location access relies on consent, which children under the applicable age of digital consent (13–16 depending on country) cannot validly give without parental authorisation. If you believe a child has provided personal data to us, contact legal@astranavi.net and we will delete it. The App Store age rating for ASTRA reflects its safety-information content.

11. Security

All traffic between the app and our servers, Mapbox, and Apple uses TLS encryption. Access to production infrastructure is restricted and credential-protected. No system is perfectly secure; if a breach affecting your personal data occurs, we will notify the competent supervisory authority and, where required, affected users, within the timelines set by GDPR Articles 33–34.

12. Changes to this policy

We will post any changes on this page with an updated effective date, and for material changes we will provide notice in the app before the change takes effect. Continued use after the effective date constitutes acceptance of the revised policy, except where the law requires fresh consent.

13. Contact

ASTRA NAVI LTD

privacy@astranavi.net

128, City Road, London.. 

bottom of page