Privacy Policy

Aethrel (“we,” “us,” or “our”) operates a done-for-you social engagement platform. This Privacy Policy applies to all information collected through the Aethrel platform, website, and related services (collectively, the “Service”).

By creating an account or using the Service, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

The Service is intended for business use. If you are using Aethrel on behalf of a company or organisation, you represent that you have authority to bind that entity to this policy.

We collect information in three ways: information you provide directly, information generated by your use of the Service, and information from third-party platforms you connect.

We use the information we collect to:

• Provide, operate, and maintain the Service — running the discovery, drafting, review, and publishing pipeline on your behalf
• Process your subscription and manage billing through Stripe
• Generate AI-assisted reply drafts using your strategy profile and thread context
• Score drafts against your policy configuration and surface risk signals to reviewers
• Populate your client analytics portal with activity and engagement data
• Send operational communications — account updates, billing notifications, and policy-relevant announcements
• Send product update emails if you have subscribed to them (unsubscribable at any time)
• Maintain audit logs that you and your operator team can use to trace decisions and publishing outcomes
• Detect and prevent misuse, fraud, or violations of our Acceptable Use Policy
• Improve the Service — we may use anonymised, aggregated activity data to understand how the pipeline performs

We do not sell your personal information. We do not use your strategy profile or draft content to train AI models for general use or share them with third parties for purposes outside the operation of your workspace.

We do not sell, rent, or share your personal information with third parties for their own commercial purposes. We share information only in the following circumstances:

Connecting a platform account to Aethrel involves granting the Service permission to post on your behalf via OAuth. We treat this access with particular care:

• OAuth access tokens are stored encrypted at rest
• Tokens are used only to execute approved publish actions — we do not read your direct messages, access your followers, or retrieve any account data beyond what is needed to post and retrieve basic engagement metrics on published replies
• Token access is scoped to the minimum permissions required for the Service to function
• You may revoke access at any time by disconnecting the account in your platform settings or from within the Aethrel console — revocation takes effect immediately
• Revoking access stops future publishing; it does not remove previously published replies from the platform

We retain your information for as long as your account is active and for a reasonable period thereafter to fulfil the purposes described in this policy, comply with legal obligations, resolve disputes, and enforce our agreements.

You may request earlier deletion of your personal data by contacting us. Some categories of data — particularly audit logs and billing records — may be subject to mandatory retention periods that limit our ability to delete them immediately.

We implement technical and organisational measures to protect your information against unauthorised access, alteration, disclosure, or destruction. These include:

• Encryption of sensitive data at rest, including OAuth tokens and API credentials
• Encryption of all data in transit using TLS
• Access controls limiting which team members can access client workspace data
• Tenant isolation at the data layer — client workspaces are separated and cannot access each other's data
• Regular review of security practices as the platform evolves

No method of transmission over the internet or electronic storage is completely secure. While we use commercially reasonable measures, we cannot guarantee absolute security. In the event of a breach that affects your personal information, we will notify you as required by applicable law.

Aethrel uses cookies and similar technologies to operate the Service and understand how it is being used.

You can configure your browser to refuse cookies, but doing so may prevent you from using the Service. We do not respond to Do Not Track signals at this time, as there is no consistent industry standard for what a response should look like.

Depending on where you are located, you may have the following rights with respect to your personal information:

To exercise any of these rights, contact us at hello@aethrel.com. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

If you are located in the European Economic Area, United Kingdom, or California, additional rights and protections may apply under GDPR, UK GDPR, or the CCPA respectively. We will honour applicable statutory rights regardless of where requests originate.

The Service is not directed to, and we do not knowingly collect personal information from, anyone under the age of 18. If you believe we have inadvertently collected information from a minor, please contact us immediately and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. For material changes — changes that meaningfully affect how your information is used — we will provide notice by email to the address associated with your account at least 14 days before the change takes effect.

Continued use of the Service after a policy update constitutes acceptance of the revised policy.

For questions about this Privacy Policy, to exercise your rights, or to report a concern about how your data is being handled: