Privacy policy

Last modified [July 14, 2026]

Introduction

Maktoum Technology Limited and our subsidiaries and affiliates (“ASTRAUX”, “Company”, “we”, “us” or “our”) respect your privacy and commit to protecting it through our compliance with the practices described in this notice.

This notice describes our practices for collecting, using, maintaining, protecting, and disclosing the personal data we may collect from you or that you may provide when you visit our website at ASTRAUX | Innovation in EVs, AI Aimon Pet Robot or any other digital properties, communications, or forms that link or refer to this notice (our “Website”). This notice applies to the personal data collected through our Website, regardless of the country where you are located.

Our Website is built on the Shopify platform. Shopify Inc. (Canada) acts as our data processor and hosts your personal data on servers located outside of China (including Canada, the United States, and Europe). Your personal data may be accessed remotely by our team based in Shenzhen, China for order management and support purposes.

The Website may include links to third-party websites, plug-ins, services, social networks, or applications (e.g., payment gateways, logistics providers, social media platforms). Clicking on those links or enabling those connections may allow the third party to collect or share data about you. We do not control these third-party websites. We encourage you to read the privacy policy of every website you visit or service you enable.

Please read this notice carefully to understand our policies and practices for processing and storing your personal data. By using our Website, you acknowledge the practices described in this notice. This notice may change from time to time (see “Privacy Notice Update”). Your continued use of our Website after any such revisions indicates your acceptance, so please check periodically for updates.

Important information and who we are

Maktoum Technology Limited is the data controller responsible for your personal data collected through this Website.

• Company name: Maktoum Technology Limited
• Registered address:  RM 1917,19/F LEE GARDEN ONE 33 HYSAN AVENUE CAUSEWAY BAY HONG KONG
• Contact email: support@astraux.com

Our Website sells electric vehicles, AI companion robots, and AI speakers. Our main sales model is pre‑order (deposit and early‑bird voucher). We target markets including the United States, Germany, Italy, Spain, France, Japan, and other countries.

 

As a global business, we comply with applicable data protection laws, including the GDPR (for individuals in the European Economic Area and the UK), the CCPA/CPRA (for California residents), and Hong Kong’s Personal Data (Privacy) Ordinance (PDPO).

 

Third party links and sites

Our Website may, from time to time, contain links to and from the websites of our partner networks, advertisers, affiliates (e.g., Meta, Google, TikTok), or include plug‑ins enabling third‑party features. If you follow a link to any third‑party website or engage a third‑party plug‑in, please note that these third parties have their own privacy policies. We do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these third parties.

 

The data we collect about you

We collect different types of personal data depending on how you interact with our Website. Below we describe the categories of personal data we collect, the sources, and the purposes.

1. Website Access and Browsing

When you visit our Website, we automatically collect certain technical data through cookies, log files, and analytics tools (including Google Analytics, Meta Pixel, and TikTok Pixel). This data includes:

• IP address, device type, browser type, operating system
• Pages visited, clickstream, referrer URL, time of visit
• Approximate location based on IP address

Purpose: Website operation, security, analytics, user experience improvement, advertising conversion attribution and retargeting (with your consent).

Legal basis: Legitimate interest (for essential operation and security) and consent (for non‑essential analytics and marketing cookies).

Retention: Up to 14‑26 months depending on the tool, or until you clear your cookies or withdraw consent.

2. Account Registration

To create an account on our Website, you provide:

• Name, email address, mobile phone number (optional)
• Account ID, login records, country/region

Purpose: Account creation, login authentication, order management, and account security.

Legal basis: Performance of a contract (to provide account services) and consent (where required for optional fields).

Retention: For as long as your account is active. Upon account deletion, we will delete your data within 180 days, unless we are required to retain it for legal or tax reasons.

3. Pre‑order (Deposit & Early‑bird Voucher) and Order Placement

When you purchase a pre‑order voucher or place an order for products, we collect:

• Name, email address, mobile phone number, country/region
• Pre‑order voucher information, order number, product model/configuration
• Payment status, transaction records

Purpose: Confirm pre‑order eligibility, issue vouchers, communicate order status, process refunds, and provide after‑sales support.

Legal basis: Performance of a contract.

Retention: 7 years after final fulfilment of the transaction (to comply with financial and tax audit requirements).

4. Shopping Cart and Checkout

We collect information about items added to your shopping cart, product configurations, quantities, prices, discount codes, and checkout status.

• Purpose: Save cart contents, generate orders, complete checkout.
• Legal basis: Performance of a contract.
• Retention: Abandoned cart data is retained for 30 days for recovery reminders, then automatically deleted.

5. Payment Information

We use Airwallex as our third‑party payment service provider. When you make a payment, you are redirected to Airwallex’s payment gateway or an embedded payment form. Airwallex collects and processes your financial information as an independent data controller. We do not collect, store, or have access to your full credit/debit card numbers or CVV.

Airwallex may collect: payment method, transaction ID, billing information, and refund records. Please refer to Airwallex’s privacy policy (available at https://www.airwallex.com/global/terms/privacy-policy) for details on how they handle your data.

Purpose: Payment processing, fraud prevention, refunds.

Legal basis: Performance of a contract (for payment) and legal obligation (anti‑fraud, AML).

Retention: As determined by Airwallex, typically 5‑7 years to comply with financial regulations.

6. Shipping and Delivery

We use Shenzhen Qianhai Yuntu Logistics Co., Ltd. as our logistics provider. To fulfil your order, we share with the logistics provider:

• Recipient name, phone number, shipping address, delivery instructions
• Order number, tracking number, customs declaration information (item list)

Purpose: Cross‑border shipping, customs clearance, delivery, and handling returns.

Legal basis: Performance of a contract.

Retention: 3 years after successful delivery (for dispute resolution and customs audit).

7. Customer Support and Communication

When you contact us via our Website chat (Shopify Inbox), email (support@astraux.com), or other contact forms, we collect:

• Your name, email address, order number (if applicable)
• Communication content, attachments (images, videos), complaint details

Purpose: Respond to inquiries, handle after‑sales issues, resolve disputes.

Legal basis: Performance of a contract (for order‑related support) and legitimate interest (for general inquiries).

Retention: 3 years after the case is closed.

8. Marketing Subscriptions (Newsletter)

If you subscribe to our marketing communications, we collect:

• Email address (and optional mobile phone number)
• Subscription status, open/click rates, preferences

Purpose: Send promotional emails, product updates, and measure campaign effectiveness.

Legal basis: Consent (you can withdraw at any time via the unsubscribe link in each email or by contacting support@astraux.com).

Retention: Until you unsubscribe or withdraw your consent.

9. User Reviews / UGC

You may voluntarily post product reviews on our Website. We collect:

• Nickname, avatar (if provided), rating, review content, photos/videos

Purpose: Display reviews to other customers, improve products, handle complaints.

Legal basis: Consent (by submitting the review you agree to its public display). You may request deletion by contacting us.

Retention: For as long as the product is listed or until you request removal.

10. Wholesale / Business Cooperation Inquiries

If you submit a wholesale or dealer inquiry via our Website forms (e.g., "Become a Dealer"), we collect:

• Company name, contact person name, job title, email, phone number, country/region
• Cooperation intention, purchase requirements

Purpose: Business communication, qualification assessment, quotation, contract signing, channel management.

Legal basis: Legitimate interest (to explore business opportunities) and performance of a contract (once a contract is signed).

Retention: 5 years after the end of the cooperation relationship.

11. Cookies and Similar Technologies

Our Website uses:

• Essential Cookies (provided by Shopify): Necessary for the functioning of the Website (login, cart, checkout). These cannot be disabled.
• Analytical/Marketing Cookies (Google Analytics, Meta Pixel, TikTok Pixel, affiliate tracking cookies): Used for analytics, conversion attribution, and retargeting.

We obtain your consent for non‑essential cookies via a cookie banner when you first visit the Website. You can change your preferences at any time through the cookie banner or your browser settings.

How we use your personal data

We will only use your personal data when we have a lawful basis to do so. Our lawful basis for each purpose for which we use your personal data is specified below. Most commonly we will use your personal data in the following circumstances:

· Consent. Where you have freely consented before the processing in a specific, informed and unambiguous indication of what you want. You can withdraw your consent at any time by submitting a request through our Contact Us page or by emailing us at support@astraux.com,  (see Your legal rights below).

· Performance of a contract. Where we need to process your personal data to perform a contract with you (e.g., to sell you a hardware device, activate a data plan or subscription) or where you ask us to take steps before we enter into a contract with you. Where we rely on performance of a contract and you do not provide the necessary information, we will be unable to perform your contract.

· Legitimate interests. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

· Legal obligation. Where we need to use your personal data to comply with a legal or regulatory obligation (e.g., tax and anti‑fraud laws). Where we rely on legal obligation and you do not provide the necessary information, we may be unable to fulfil a right you have or comply with our obligations to you, or we may need to take additional steps, such as informing law enforcement or a public authority or applying for a court order.

· To provide and improve AI-powered educational assistance. We use interaction data from the AI-powered Assistant feature to deliver personalized learning support, optimize service performance, and ensure product safety and compliance.

How We Share Your Data

We may share your personal data with:

· Other companies in the ASTRAUX Group acting as joint controllers or processors and who are based in China and provide IT and system administration services and undertake leadership reporting.

· With your consent.

· Third-party service providers (acting as processors or independent controllers) as necessary to provide our services, including:

Service provider	Role	Purpose	Location
Shopify Inc.	Processor	Website hosting, order management, checkout	Canada
Airwallex (Hong Kong) Limited	Independent Controller	Payment processing, fraud prevention, refunds	Hong Kong
Shenzhen Qianhai Yuntu Logistics Co., Ltd.	Processor	Crossborder shipping, customs clearance	China (mainland)
Meta Platforms, Inc. (Meta Pixel)	Joint Controller (for data collection) / Processor	Advertising conversion, retargeting	USA
Google LLC (Google Analytics)	Processor	Analytics, performance measurement	USA
TikTok Information Technologies UK Limited	Processor	Advertising, analytics	UK / Ireland
Amazon, AliExpress, eBay (thirdparty platforms)	Independent Controller	Order fulfilment for platform sales	USA / Europe / China
Future distributors / wholesalers	Independent Controller	B2B order fulfilment, aftersales support	Germany, France, Italy, Spain, Romania, Turkey, USA, Japan

We do not sell your personal data to third parties as defined under CCPA. However, we share your data with advertising partners for cross‑context behavioural advertising. California residents have the right to opt out of such sharing (see “Your Legal Rights” below).

We may also disclose your personal data:

• To comply with any court order, law, or legal process.
• To protect the rights, property, or safety of our business, employees, customers, or others.
• In the event of a merger, acquisition, or sale of assets (subject to continued protection).

International transfers

Your personal data is processed globally. We transfer your personal data across borders for the purposes described in this notice. Examples include:

l Your data is hosted on Shopify servers in Canada (and may be replicated in the US/EU).

• Our team in Shenzhen, China may remotely access the Shopify backend for order management and support.
• Payment data is processed by Airwallex in Hong Kong.
• Advertising data is sent directly from your browser to Meta (US), Google (US), and TikTok (UK/Ireland).
• Logistics data is transferred to Yuntu Logistics in China and local carriers in destination countries.

When we transfer personal data from the European Economic Area (EEA) or the UK to countries that are not recognised as providing an adequate level of protection, we rely on the European Commission’s Standard Contractual Clauses (SCCs) or other approved transfer mechanisms. You may obtain a copy of these safeguards by contacting us at support@astraux.com 

Data security

We have implemented appropriate technical and organisational measures to protect your personal data, including:

• Use of SSL encryption for all payment transactions.
• Firewalls and secure servers hosted by Shopify.
• Access controls and regular security audits.

 

However, no internet transmission is completely secure. You are responsible for keeping your account password confidential. We urge you not to share your password with anyone.

Data retention

We only store your personal data for the time necessary for the relevant purposes. If data is processed for multiple purposes, once the final specified purpose is completed, the data will be automatically deleted or stored in a form that cannot be directly traced back to you. However, personal data must be retained for a longer period as required by local laws, in which case, personal data must continue to be retained within the time frame specified by law.

Specific retention periods:

• Account information: until account deletion + 180 days
• Order and transaction data (hardware, packages, subscriptions): 7 years after final transaction (for tax and audit compliance)
• Abandoned cart data: 30 days
• Customer support communications: 3 years after case closure
• Marketing subscription data: until you unsubscribe or withdraw consent
• UGC generated avatar: until you delete it or request removal
• Cookies / analytics data: up to 26 months or until you clear cookies

In some circumstances you can ask us to delete your data: see [Your legal rights] below for further information.

Once we no longer have a legal right to hold your personal data, we will delete or, in some circumstances, we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

Your legal rights

You have the following rights under data protection laws in relation to your personal data.

· Access. Request access to and/or a copy of the personal data we process about you (commonly known as a data subject access request). This enables you to check that we are lawfully processing it.

· Correction. Request correction of any incomplete or inaccurate data we hold about you. (We may need to verify the accuracy of the new data you provide to us.)

· Deletion. Request us to delete or remove personal data where there is no good reason for us continuing to process it. You also can ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we have processed your information unlawfully or where we need to erase your personal data to comply with law. (In some cases, we may need to continue to retain some of your personal data where required by law. If these apply, we will notify you at the time of our response.)

· Objection. Object to us processing your personal data where (a) we are relying on legitimate interests as the lawful basis and you feel the processing impacts on your fundamental rights and freedoms, or (b) the processing is for direct marketing purposes. In some cases, we may refuse your objection if we can demonstrate that we have compelling legitimate grounds to continue processing your information which override your rights and freedoms.

· Restriction. Request that we restrict or suspend our processing of your personal data:

· if you want us to establish the data’s accuracy;

· where our use of the data is unlawful, but you do not want us to erase it;

· where we no longer require it, but you need us to hold onto it to establish, exercise or defend legal claims; or

· you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.

· Data portability. Request we transfer certain of your personal data to you or your chosen third party in a structured, commonly used, machine-readable format. This right only applies to information processed by automated means that we process on the lawful bases of consent or performance of a contract.

· Withdraw consent. Withdraw your consent at any time where we are relying on consent to process your personal data. Please know that this does not affect the lawfulness of any processing carried out before you withdraw your consent, and after withdrawal, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

· Complain to the data protection regulator. If you are unhappy with how we process your personal data, we ask that you contact us first using the details below so that we have the chance to put it right. You also have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, the CNIL in France, or the Hong Kong Office of the Privacy Commissioner for Personal Data).

· Our Commitment to Responding to Your Requests. We are committed to responding to your valid requests concerning your personal data without undue delay and in any event within one month (30 days) of receipt of your verified request. If your request is particularly complex or you have made multiple requests, we may extend this period by a further two months. If we need to extend our response time, we will inform you within the first month, explaining the reasons for the delay.

· Opt‑out of sale/sharing (CCPA). If you are a California resident, you have the right to opt out of the “sharing” of your personal information for cross‑context behavioural advertising. You can do so by clicking the “Do Not Sell or Share My Personal Information” link on our Website or by contacting us.

You can exercise any of these rights at any time by contacting us at support@astraux.com.

You can also use the Cookies banner to give or withdraw your consent to or disable our processing of your Cookies Data.

 

Children

Our products and services are not targeted at individuals under the age of 13. In some cases, due to local regulatory requirements, this age limit may be higher; please refer to your local supplementary terms for more information. We do not intentionally collect personal data from individuals under the age of 13. If you have reason to believe that an individual under the age of 13 has provided personal data to us through any means, you can contact us through the contact details provided in this privacy statement. We will investigate any such notifications and, where appropriate, delete the personal data. Although the policy is technically applicable to users over 13 years old, our product functions and marketing positioning are targeted at adult users. Users aged 13 to 17 should use the product under the guidance of their parents.

Privacy Notice Update

We may update this Privacy Notice periodically to reflect changes in our services, legal requirements, or data processing practices.

We categorize updates as follows:

1. Non-Material Changes: These include minor clarifications, typographical corrections, or updates to contact information. We will post the updated notice on our Website with a revised “Last Modified” date. Your continued use of the Website after such posting constitutes your acceptance of the changes.

2. Material Changes: These include, but are not limited to, significant changes in: (a) the purposes or legal bases for processing your personal data; (b) the categories of personal data we collect; (c) how we share your data, especially regarding new third-party recipients or international transfers; (d) your data subject rights or how to exercise them. For Material Changes, we will:

l Provide you with prior notice (e.g., via email to the address associated with your account or a prominent notice on the Website) at least [15] days before the changes take effect.

l Clearly summarize the key changes and the reasons for them.

l Explain your options. You may have the right to accept or decline the updated terms. If you decline Material Changes, you may choose to terminate your account before the changes become effective. If you continue to use the Website after the effective date of Material Changes without having accepted them, we will limit the processing of your data for existing services to the terms of the previous notice until your service relationship ends, but you may not be able to access new features or services that rely on the changed practices.

We encourage you to review this notice regularly. The date at the top indicates when it was last revised.

Contact Us

Please address questions, comments, and requests regarding this Privacy Policy and our privacy practices to ：

Email: support@astraux.com

Address: Astraux Technology Limited, RM 1917,19/F LEE GARDEN ONE 33 HYSAN AVENUE CAUSEWAY BAY HONG KONG