Privacy Policy

Effective: 8 August 2026

This Privacy Policy explains how Aeloria collects, uses, shares, and protects personal data when you visit our website, create an account, or use the Aeloria Service. It complies with the EU General Data Protection Regulation 2016/679 ("GDPR") and the Swiss Federal Act on Data Protection ("revDSG") in force as of 1 September 2023.

1. Controller

The data controller responsible for the processing described in this Policy is:

Aeloria (a business name of Matteo Panzavolta, sole proprietor)
Im Lindengut 15
8803 Rüschlikon, Switzerland
Email: privacy@aeloria.ai

Aeloria will be transferred to a Swiss corporate entity upon its incorporation. From that date, the new entity will become the controller for all processing described in this Policy. We will update this Policy and notify users in advance of the change.

2. EU/EEA Representative

Although Aeloria is established in Switzerland (a country recognised by the European Commission as providing an adequate level of data protection), where Article 27 GDPR applies to a specific processing activity, an EU representative will be appointed. Contact details will be published here once designated.

3. Categories of Personal Data We Process

3.1 Account & Identity Data

Name, work email address, job title, organisation, country
Password (stored hashed)
Language preference

3.2 Billing Data

Billing name and address, VAT identification number where provided
Payment method details (held by Stripe, not by Aeloria)
Invoice history and subscription tier

3.3 Usage Data

Application log data: IP address, browser type, device identifiers, timestamps, in-app actions performed
Feature usage: prompts and queries submitted to the Service, frequency of use, dashboard interactions
Aggregate, anonymous website analytics via Umami (see Section 5 and our Cookie Policy)

3.4 Brand & Workspace Data

Brand names and information you choose to monitor
Reference URLs, content uploaded, competitive sets defined
Notes, tags, and collaborative comments

3.5 Communications Data

Support tickets, emails to and from us, in-product chat
Marketing preferences and newsletter subscription status

4. Purposes & Legal Bases

Purpose	Legal Basis (GDPR Art. 6)
Provide the Service and manage your Account	Performance of contract (6(1)(b))
Process payments and issue invoices	Performance of contract (6(1)(b)); legal obligation (6(1)(c))
Customer support	Performance of contract (6(1)(b))
Improve and develop the Service (aggregated, non-identifying analysis)	Legitimate interest (6(1)(f)) — to run and improve a competitive SaaS product
Send transactional emails (renewals, security alerts, service notices)	Performance of contract (6(1)(b))
Send marketing emails and product updates	Consent (6(1)(a)), with opt-out at any time
Detect and prevent fraud, abuse, and security incidents	Legitimate interest (6(1)(f))
Comply with legal, accounting, and tax obligations	Legal obligation (6(1)(c))

5. Sub-Processors & Recipients

Aeloria shares personal data with the following categories of recipients: cloud hosting, storage and database providers; a user-authentication provider; a payment processor; AI providers performing evaluation and content generation; an analytics data warehouse; a transactional email provider; and a cookieless website-analytics service.

The authoritative, current list of sub-processors — entities, purposes, locations, and transfer mechanisms — is maintained in Annex III of our Data Processing Agreement and is updated as sub-processors change. We enter into Data Processing Agreements with all sub-processors that process personal data on our behalf, and we ensure adequate safeguards for any international transfers (see Section 7).

6. AI Engine Queries — Important Notice

To measure visibility, the Service submits prompts and queries to third-party AI Engines. The engines queried are ChatGPT, Gemini and Perplexity, plus any additional engine where the Customer has enabled optional engine coverage. The role of the queried engine operators is addressed in Annex III of our DPA.

Separately from engine querying, the Service uses the AI evaluation Sub-Processors listed in Annex III of our DPA to analyse and score the responses it collects. This evaluation processing is part of the Service and takes place regardless of which engines are queried.

Website Health. Separately from AI Engine measurement, the Service retrieves pages from web addresses you provide, in the same way a browser or search engine crawler would, in order to assess how readable your own site is to AI systems. We do not retrieve pages behind authentication and we respect standard exclusion directives.

The content of measurement prompts may include Brand names, product descriptions, and reference URLs, but should not include personal data of individuals (employees, customers, end-users) unless strictly necessary and lawful.

You agree not to submit personal data of individuals through the Service in a way that would expose such data to AI Engines, and you remain responsible as controller for any personal data so submitted. We strongly recommend keeping all monitoring prompts focused on brand-level information rather than individuals.

7. International Data Transfers

Aeloria is based in Switzerland. The European Commission has recognised Switzerland as providing an adequate level of data protection (adequacy decision under Article 45 GDPR). Where personal data is transferred from the EU/EEA to Aeloria, this decision serves as the legal basis for the transfer.

Some sub-processors (see Annex III of our DPA) may process data in the United States or other jurisdictions. For such transfers, we rely on:

Adequacy decisions where available (e.g. EU–U.S. Data Privacy Framework);
Standard Contractual Clauses (SCCs) approved by the European Commission;
Equivalent safeguards under Swiss law (revDSG).

8. Retention

We retain personal data only as long as necessary for the purposes described in this Policy:

Account data: for the duration of your Account, plus up to 12 months after closure for backup and dispute-resolution purposes;
Billing and invoice data: 10 years, as required by Swiss commercial and tax law (Art. 958f Code of Obligations);
Application logs: 12 months, then anonymised or deleted;
Customer Data within Workspaces: for the duration of the Subscription and 30 days after termination, after which it is deleted unless export is requested. Backup copies may persist for up to 90 days before deletion;
Support communications: 3 years from last interaction;
Marketing data: until consent is withdrawn;
Aggregate website analytics: retained in anonymous form indefinitely; no personal data is collected.

9. Your Rights

Under the GDPR and revDSG, you have the following rights:

Access — request a copy of the personal data we hold about you;
Rectification — correct inaccurate or incomplete data;
Erasure — request deletion, subject to legal retention obligations;
Restriction — request that we limit processing in certain circumstances;
Portability — receive your data in a structured, machine-readable format;
Objection — object to processing based on legitimate interest or direct marketing;
Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing;
Lodge a complaint — with the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or, for EU residents, with your local supervisory authority.

To exercise these rights, email privacy@aeloria.ai. We may need to verify your identity before fulfilling the request and will respond within 30 days.

10. Security

We implement technical and organisational measures appropriate to the risk, including:

Encryption in transit and at rest, using current industry-standard algorithms and, at rest, the encryption provided by our hosting platform;
Role-based access control and the principle of least privilege;
Authentication credentials stored salted and hashed;
Logging of administrative access to customer data;
Dependency vulnerability scanning;
Sub-processor due diligence and contractual security commitments.

The measures in force are set out in Annex II of our Data Processing Agreement and are reviewed periodically and updated as appropriate.

In the event of a personal data breach, we will notify the competent supervisory authority within 72 hours of becoming aware where Article 33 GDPR requires it, and will inform you without undue delay where the breach is likely to result in a high risk to your rights. Where we process personal data on behalf of a Customer, we notify that Customer without undue delay under our Data Processing Agreement.

11. Cookies & Tracking

We use only strictly necessary first-party session cookies for authentication and security, plus two functional cookies (preferred_lang and PARAGLIDE_LOCALE) that record your interface language. We do not use third-party tracking cookies, advertising cookies, or behavioural profiling technologies. Our analytics provider, Umami, operates without cookies and without collecting personal data. See our Cookie Policy for full details.

12. Children

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have done so inadvertently, please contact us and we will delete it.

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified by email or in-product notice at least 30 days before taking effect. The version date at the top reflects the most recent update.

14. Contact

Privacy-related questions, requests, or complaints may be sent to privacy@aeloria.ai.