Effective 11 August 2026
Privacy Policy
This policy describes information handling for Astra Agent Bridge, a private internal integration operated under the Hearts Trading name.
Scope and purpose
Astra Agent Bridge sends bounded, auditable tasks from authorized ChatGPT environments through a secure MCP tunnel into a locally operated execution pipeline. Information is used only to validate, persist, deduplicate, execute and audit authorized tasks; maintain reliability and security; and return attributable results.
Information processed
The integration may process task instructions and metadata, including task and message identifiers, creation times, requested execution mode, repository identity, nonces and integrity hashes. It also creates local durable ingress envelopes and receipts, execution and result-provenance records, delivery state, and operational security or audit events.
Integrity and minimisation
Identifiers, nonces and cryptographic hashes support integrity checks and duplicate protection. The system is designed to accept only the information needed for its governed workflow. Operators should not submit credentials, private keys or unrelated personal information in task instructions.
Storage and retention
Ingress, receipt, provenance and audit records are persisted in the locally operated Agent Bridge environment. Operational records may be retained for audit, reliability and security purposes in accordance with the system's local operational policies. No fixed public retention period is represented by this policy.
Disclosure and commercial use
Task data is not sold, used for advertising or used for unrelated profiling. Access is restricted to authorized internal operators and systems involved in operating, securing and auditing the integration. Information may be disclosed when required by applicable law or to protect the security and integrity of the service.
Security
The integration uses a secure MCP tunnel for transport and maintains integrity, deduplication and provenance controls in its local pipeline. No system can guarantee absolute security. This public policy intentionally omits credentials, private infrastructure details and sensitive configuration.
Access, deletion and questions
Authorized users may ask about access to or deletion of task-related information by emailing astra.williams@heartstrading.com. Requests are assessed against applicable obligations and legitimate audit, reliability and security needs. Security concerns should be clearly identified and should not include secrets in the initial message.
Changes
This policy may be updated when the integration or its information-handling practices change. The effective date above identifies the current version.