Privacy notice

Last updated 30 October 2026. This is how Libra (libra.astraobp.com) handles personal data. It is an engineering notice, not legal advice.

Who is responsible

The controller is Astra OBP. Contact privacy@astraobp.com for access, rectification, erasure, restriction, or objection requests, or to complain about how we process your data. You may also lodge a complaint with your supervisory authority.

What we process and why

Libra is a research archive of published domain-name dispute decisions (UDRP and related policies) collected from ICANN-approved providers. Those decisions already name complainants, respondents, counsel, and panelists. We store that text and the structured fields we extract from it so authorised users can search and analyse the corpus.

The legal basis we rely on for the archive is legitimate interest (GDPR Art. 6(1)(f)): operating a searchable record of decisions that the providers have already made public. We do not use the archive to market to the people named in it, and we do not sell the data.

If you ask for access from the front page, we store:

• your name, company, job title, and email address, any note you typed, and when you sent it, so a member of staff can decide. Free email addresses such as Gmail are refused. A Cloudflare Turnstile check confirms a person sent the form; we do not store that check. Decided requests are deleted after 12 months. If we approve, your address goes on the invite list and we email you once to say so.

Separately, when you sign in we process:

• your email address, and the name and picture Google provides if you sign in with Google, to know who you are and whether you are staff (@astraobp.com) or a guest;
• a session record (a random token, the IP address and browser string that opened it, and when it expires) so you stay signed in. Sessions last up to 30 days and are deleted when you sign out or when we remove you from the invite list. One-time sign-in links expire after 15 minutes;
• an optional first and last name you set on your profile, so the app can show them in the account menu;
• a last-seen timestamp and country (from the connection) so staff can see who recently opened the app, and a last-click time (not what you clicked) so we know you were still using it. Those visit rows are deleted after 12 months, or sooner if you ask. Profile names are kept until you change them or we delete them on request.

LinkedIn profiles

Staff can run an optional enrichment pass that searches the public web for counsel and panelist LinkedIn URLs. That is a different purpose from the archive itself. Those URLs are shown only to staff. Guests see the published decision data, not the LinkedIn links. The pass is not run automatically.

Staff can also send a company name, an individual representative, or a panelist to Zero, Astra’s CRM. A panelist is placed on the UDRP individuals list there. A LinkedIn URL is included only when Libra already has one. Nothing is sent unless a staff member presses the button.

Cookies and similar technologies

Libra works without optional cookies. Essential storage does not need a choice: the sign-in session (up to 30 days), the record of your cookie choice (libra_consent, 180 days), settings kept in this browser, a campaign tag from the welcome link (utm_source and the related utm_ fields, kept in this tab and removed from the address; sent to Google Analytics only if you allow it), a Cloudflare clearance cookie only if a browser check runs, and Cloudflare Turnstile on the access form. Turnstile loads when you open that form, and its token is checked and not stored.

If you allow them, these services run. Nothing is requested from them until you do:

• Google Analytics — which pages are used. Cookies _ga and _ga_YLHD5M77HD, kept up to 13 months. Names, search filters, case numbers, and private links are removed from the address before it is sent. Google (United States, EU-US Data Privacy Framework) processes this for us.
• PostHog — session replay and product analytics so we can watch how a visit moved through the app. Form fields are masked in the recording. Names, search filters, case numbers, and private links are removed from addresses. A first-party PostHog cookie (up to 365 days) and related browser storage identify the session. PostHog processes this in the EU (Frankfurt).
• Google Ads — whether an ad led to an access request. Cookies _gcl_au and _gcl_aw, about 90 days, plus Google’s own cookies on its sites. Google acts under its advertising terms (United States, EU-US Data Privacy Framework).
• LinkedIn — whether a LinkedIn ad led to an access request, once that tag is switched on. LinkedIn (United States) is a joint controller for Insight Tag data under its own terms. The switch stays hidden until the tag is in use.

A choice lasts 180 days. You can change it at any time. Change cookie settings. We keep an anonymous record of the choice (a random id, the switches, and the time) for 13 months so we can show what was agreed. That record has no IP address, browser string, or email.

Who can see the data

Only people Astra OBP has invited can sign in: staff on the @astraobp.com domain, plus guests on an invite list. There are no passwords; you sign in with Google or with a one-time link we email you. It is not an open website. The public front page describes Libra and does not include decision text, party names, or rankings.

Processors and where data lives

• Amazon Web Services — PostgreSQL in eu-north-1 (Stockholm).
• Cloudflare — DNS and proxy in front of the site, Workers AI (classification, translation, embeddings), and Turnstile on the public access form. The Turnstile token is checked and not stored. Libra is excluded from Cloudflare Web Analytics.
• Google — if you choose “Continue with Google”, Google tells us your email, name, and picture. If you allow cookies, Google Analytics and Google Ads also receive the measurement described above. We do not send your email address to Analytics or Ads.
• PostHog — if you allow the PostHog cookie, session replays and product analytics are processed in the EU as described above. Signed-in email is sent only so a replay can be linked to a person.
• LinkedIn — only if you allow the LinkedIn cookie, and only once that tag is switched on.
• Resend — delivers sign-in links, the access-approval email, and the daily digest.
• Serper — only when staff run the LinkedIn pass.
• Zero — only when staff add a company, representative, or panelist.
• Bright Data — only as an egress proxy when crawling provider sites.

Decision text is sent to an AI provider when we classify a case (bad faith, the respondent’s arguments, reverse domain name hijacking, industry, and product class), translate it into English, embed it for similar-decision search, or write a short summary. Embeddings use Workers AI. The other passes use the model selected in Settings, which can be Workers AI or OpenAI. We store the labels, the English translation, the embeddings, and the summary. A question typed in Ask, and the decision text used to answer it, are sent to the configured model. We do not send your email address to the AI or search providers.

The daily digest includes a one-pixel image, and its links pass through Libra first, so we can record whether the email was opened and which links were followed. Staff can see that log: your email address, when the digest was sent, when it was first opened, and each link clicked. Turn the digest off in Profile, or from the link in the email.

How long we keep it

Published decision text is kept for as long as Libra operates as an archive. Visit logs and decided access requests are kept for 12 months; sessions for at most 30 days. If you ask us to stop processing your name or email, we add it to a suppression list: structured fields are replaced with [redacted], later crawls will not restore the identifier, and we will not look up a LinkedIn profile for that name.

We cannot remove your name from the original decision on WIPO, Forum, or another provider’s site. That publication is theirs.

Your rights

You can ask us for a copy of what we hold about you, to correct it, to erase or suppress it in Libra, to restrict or object to our processing, and to complain to a supervisory authority. Write to privacy@astraobp.com.

Back to Libra · Cookie settings