Privacy Policy

Information you provide

• Account & profile. Your name, email address, organization, and role. Passwords are stored only as a salted hash — never in plaintext.
• Billing. Payments are handled by our processor, Stripe. We receive limited details such as your plan, billing contact, country, and the last four digits of your card — never full payment card numbers.
• Communications. Messages you send to support or sales, and anything you choose to include in them.

Customer Data

“Customer Data” is the content you upload to or generate through the Service — documents, text chunks, vector embeddings, associated metadata, and the queries you run. Documents are encrypted with AES-256 on the client before they reach our storage layer, and similarity search runs inside trusted execution environments, so raw queries are not exposed in plaintext to our infrastructure. We process Customer Data solely to provide the Service to you and under your instructions.

Information collected automatically

• Usage & telemetry. API calls, query volume, index size, feature usage, and operational logs used to run, secure, bill, and improve the Service.
• Device & connection. IP address, browser and device type, operating system, referring pages, and timestamps.
• Analytics. Our marketing site uses privacy-friendly, cookieless analytics (Vercel Analytics and Speed Insights) to understand aggregate traffic and performance. These tools do not use cookies to track you across sites.

We use the information we collect to:

• Provide, operate, maintain, and secure the Service;
• Authenticate users and manage accounts and API keys;
• Process payments and send billing-related communications;
• Provide customer support and respond to your inquiries;
• Monitor usage to enforce limits, detect abuse, and protect against fraud and security threats;
• Analyze and improve the performance, reliability, and features of the Service;
• Send service, security, and administrative notices; and
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not use Customer Data to train machine-learning models.

If you are in the European Economic Area or the United Kingdom, we process personal data on one or more of the following legal bases:

• Performance of a contract — to provide the Service you request;
• Legitimate interests — to secure, operate, and improve the Service, where not overridden by your rights;
• Consent — where required (for example, certain marketing communications), which you may withdraw at any time; and
• Legal obligation — to comply with applicable law.

We share information only as described below, and we never sell it.

Service providers (sub-processors)

We rely on a small number of vetted vendors who process data on our behalf under contractual confidentiality and data-protection obligations:

• Vercel — application hosting, content delivery, and product analytics;
• Amazon Web Services — cloud infrastructure, compute, and storage;
• Stripe — payment processing and subscription billing; and
• Resend — transactional and account-related email delivery.

Legal & safety

We may disclose information if required by law, subpoena, or other legal process, or where we believe in good faith that disclosure is necessary to protect our rights, your safety or that of others, investigate fraud, or respond to a lawful government request.

Business transfers

If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal information.

We retain account and personal information for as long as your account is active and as needed to provide the Service. Customer Data is retained until you delete it or close your account; on deletion, vectors are dropped from active memory immediately via tombstoning and the underlying objects are purged from storage in accordance with our deletion routines. We may retain limited information where necessary to comply with legal obligations, resolve disputes, and enforce our agreements.

Security is foundational to Aether. Our measures include:

• Encryption in transit (TLS) and at rest, plus AES-256 client-side encryption of documents before they reach our storage layer;
• Query execution inside Trusted Execution Environments (secure enclaves) so raw queries are not exposed to host infrastructure;
• Strict, least-privilege internal access controls and audit logging; and
• Continuous monitoring and tiered, encrypted backups.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We operate globally and may process and store information in countries other than your own, including the United States. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Delete your personal information;
• Port your data to another service;
• Object to or restrict certain processing; and
• Withdraw consent where processing is based on consent.

California residents.Under the CCPA/CPRA you have the right to know, delete, and correct personal information and to opt out of its “sale” or “sharing.” We do not sell or share personal information as those terms are defined under California law.

To exercise any of these rights, contact us at support@aetherdb.ai. We will respond within the timeframe required by applicable law. You may also lodge a complaint with your local data-protection authority.

Our marketing site uses privacy-friendly, cookieless analytics and does not use third-party advertising cookies. The Aether platform uses strictly necessary cookies (or equivalent local storage) to keep you signed in and maintain your session. You can control cookies through your browser settings, though disabling strictly necessary cookies may impair core functionality.

The Service is intended for businesses and developers and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will revise the “Last updated” date above and, where appropriate, provide additional notice (such as by email or an in-product notice). Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

If you have questions about this Privacy Policy or our data practices, contact us:

• Quintessence Group, Inc. (the entity behind Aether), Colorado, United States; and
• Email: support@aetherdb.ai.