Privacy policy

Last updated: 19 October 2026

This policy explains what personal data Aether collects, why we collect it, who we share it with and the rights you have.

Who is responsible

[Your legal name], [Your postal address], is the controller of your personal data. Contact us at [support@your-domain].

What we collect

• Your email address, to send your report link and answer your messages.
• Your idea: the text you type into the order form.
• Your report: the generated report and the list of web sources it used.
• Order details from [Merchant of record]: order ID, plan and the country you paid from. [Merchant of record] handles the payment itself; we never see your card details.
• Requests we can’t serve yet: what you ask for in the “Need something else?” form, or in an order our screening finds outside what Aether does today (such as trip planning, which we don’t charge for). We keep the request to decide what to build next, with your email only if you ask us to contact you or gave it with that order.
• Blocked ideas: when our screening blocks an idea under the Acceptable use policy, we keep the idea briefly so we can correct mistakes. We never keep ideas involving minors.
• Technical data: IP address, browser type and the pages you request, which our hosting providers log for security and use to work out your country.
• Cookies, described below.

How we use it

• To produce and deliver your report, answer support requests and handle refunds (to perform our contract with you).
• To screen ideas against our Acceptable use policy and prevent abuse. An AI model checks each idea before checkout, and after a violation we may block the email address or network used (our legitimate interest in keeping the service safe and lawful).
• To decide what to build next from requests we can’t serve yet, and to email you about yours if you asked us to (our legitimate interest in improving Aether, or your request).
• To keep records the law requires, such as accounting records (legal obligation).
• To measure our ads on marketing pages, outside the UK, EEA and Switzerland (our legitimate interest, or your consent where the law requires it).

We do not sell your personal data.

AI processing and model training

Ideas and reports are processed by Anthropic’s Claude models through Anthropic’s commercial API. Your idea is never used to train AI models: we do not train on it, and under its commercial terms Anthropic does not train its models on it. Anthropic may keep inputs flagged by its safety systems for up to 2 years.

Who we share it with

We use these service providers, who process data on our behalf:

• Vercel: website hosting
• Supabase: database
• Anthropic: the AI model that screens ideas and writes reports
• Resend: email delivery
• Cloudflare: domain name system and email routing
• Google Ads: ad measurement on marketing pages, outside the UK, EEA and Switzerland
• [Merchant of record]: payments, as our reseller and merchant of record

[Merchant of record] and Google also use data under their own privacy policies. We may disclose data when the law requires it.

How long we keep it

• Reports, ideas and email addresses from paid orders: deleted 24 months after delivery, or 24 months after purchase for Founder Pack reports never used.
• Ideas and email addresses from orders that are never paid: deleted after 7 days.
• Requests we can’t serve yet: deleted after 12 months.
• Blocked ideas: deleted after 30 days.
• Technical logs: kept for a limited period by our hosting providers.
• Inputs flagged by Anthropic’s safety systems: up to 2 years at Anthropic.
• Payment records: kept by [Merchant of record] as tax law requires.

Aggregate statistics

We may publish statistics that combine at least 20 reports, such as the share of ideas that received a Go verdict. They never include idea text or anything that identifies you or your idea.

Cookies and ads

• aether_region: set for visitors in the UK, EEA and Switzerland, and for visitors whose location we can't tell, so that no advertising tags load. It holds no personal data and lasts 1 year.
• Google Ads tag: on marketing pages, visitors outside the UK, EEA and Switzerland load Google’s tag (gtag.js), which sets cookies to measure ad clicks and conversions. We send it page addresses without query strings. After payment, the thanks page sends Google one conversion event with a one-way hash of your order reference; it receives no report content, idea or email address.
• Report pages load no advertising or analytics tags.

You can block cookies in your browser settings and manage personalised Google ads at adssettings.google.com.

Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, or to restrict or object to how we use it. Where we rely on consent, you can withdraw it at any time. Email [support@your-domain] from the address you ordered with, and we will reply within one month. If you are in the UK or the EEA, you can also complain to your data protection authority; in the UK that is the Information Commissioner’s Office (ICO).

International transfers

Our providers may process data outside your country, including in the United States. Where the law requires it, transfers are protected by safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or the EU–US Data Privacy Framework.

Security

Report links are long random addresses that cannot be guessed, report pages are excluded from search engines, data is encrypted in transit and access to our database is restricted.

Children

Aether is for people aged 18 and over. We do not knowingly collect data from children.

Changes

We will post any changes on this page and update the date at the top.

Contact

[Your legal name], [Your postal address]. Email: [support@your-domain].