Privacy Policy

1. What we collect

• Account data, name, email, hashed password, workspace and organization structure.
• Product data, target prompts, brand names, competitor names, scan history, interventions.
• Usage data, page views and product events, used to improve the product.
• Billing data, handled by Razorpay (India) or Stripe (global). We store customer IDs, not full card numbers.

2. Why we collect it

• To operate the product (scans, alerts, dashboards).
• To send transactional messages (weekly digests, receipt emails, security notices).
• To detect abuse, prevent overage, and enforce plan limits.
• To measure how the product is used, so we can improve it.

3. Who we share it with

Only sub-processors strictly necessary to operate Aelo. Today: Supabase (Postgres, Auth, Storage), Vercel (hosting, Cron), Google Gemini / OpenAI / Anthropic / Perplexity (scan providers, prompts only, no PII sent), Resend (email delivery), Razorpay + Stripe (billing). We do not sell customer data. We do not share it with advertisers.

4. How we store it

All data lives in Supabase Postgres with Row-Level Security policies scoping every row to the owning organization. Backups are encrypted. Passwords are hashed with bcrypt.

5. Your controls

• Export, one-click JSON export of every row we hold on your workspace.
• Delete, delete your account and every associated row on request.
• Object, request that we stop using your data for a specific purpose.
• Audit, every metric on the dashboard is auditable to the raw scan.

6. Retention

We keep account and product data for as long as your account is active, plus 30 days after cancellation for backup restoration windows. After that, we hard-delete.

7. Changes

If we make material changes, we email every account at least 14 days before they take effect.