Privacy Policy

This Privacy Policy explains how Aeloria collects, uses, shares, and protects personal data when you visit our website, create an account, or use the Aeloria Service. It complies with the EU General Data Protection Regulation 2016/679 ("GDPR") and the Swiss Federal Act on Data Protection ("revDSG") in force as of 1 September 2023.

1. Controller

The data controller responsible for the processing described in this Policy is:

Aeloria (a business name of Matteo Panzavolta, sole proprietor)
Im Lindengut 15
8803 Rüschlikon, Switzerland
Email: privacy@aeloria.ai

2. EU/EEA Representative

Although Aeloria is established in Switzerland (a country recognised by the European Commission as providing an adequate level of data protection), where Article 27 GDPR applies to a specific processing activity, an EU representative will be appointed. Contact details will be published here once designated.

3. Categories of Personal Data We Process

3.1 Account & Identity Data

• Name, work email address, job title, organisation, country
• Password (stored hashed)
• Language preference

3.2 Billing Data

• Billing name and address, VAT identification number where provided
• Payment method details (held by Stripe, not by Aeloria)
• Invoice history and subscription tier

3.3 Usage Data

• Application log data: IP address, browser type, device identifiers, timestamps, in-app actions performed
• Feature usage: prompts and queries submitted to the Service, frequency of use, dashboard interactions
• Aggregate, anonymous website analytics via Umami (see Section 5 and our Cookie Policy)

3.4 Brand & Workspace Data

• Brand names and information you choose to monitor
• Reference URLs, content uploaded, competitive sets defined
• Notes, tags, and collaborative comments

3.5 Communications Data

• Support tickets, emails to and from us, in-product chat
• Marketing preferences and newsletter subscription status

4. Purposes & Legal Bases

5. Sub-Processors & Recipients

Aeloria uses the following sub-processors.

xAI and Mistral AI are engaged only as queried engines, and only where a Customer has enabled the corresponding optional engine coverage. Where a Customer has not enabled it, no data is transmitted to those providers. OpenAI, Google and Anthropic also carry out the AI evaluation processing that produces Aeloria's scores and recommendations; that processing is part of the Service and does not depend on optional engine coverage.

We enter into Data Processing Agreements with all sub-processors that process personal data on our behalf, and we ensure adequate safeguards for any international transfers (see Section 7). This list is updated as sub-processors change; the same list is maintained in Annex III of our Data Processing Agreement.

6. AI Engine Queries — Important Notice

To measure visibility, the Service submits prompts and queries to third-party AI Engines through their official APIs. The engines queried are ChatGPT, Gemini and Perplexity, and — where the Customer has enabled the optional engine boost pack or an Enterprise configuration — Claude, Grok and Mistral.

Separately from engine querying, the Service uses models provided by OpenAI, Google and Anthropic to analyse and score the responses it collects. This evaluation processing is part of the Service and takes place whether or not the optional engine boost pack is enabled.

The Service does not query Google AI Overviews or Microsoft Copilot. Google AI Overviews publishes no official API, and measuring it would require automated sessions against a consumer interface, which Aeloria does not do. Copilot is an agent layer over third-party models scoped to a customer's own tenant rather than a distinct public answer surface, and is therefore outside the scope of brand visibility measurement.

Website Health. Separately from AI Engine measurement, the Service retrieves pages from web addresses you provide, in the same way a browser or search engine crawler would, in order to assess how readable your own site is to AI systems. We do not retrieve pages behind authentication and we respect standard exclusion directives.

The content of measurement prompts may include Brand names, product descriptions, and reference URLs, but should not include personal data of individuals (employees, customers, end-users) unless strictly necessary and lawful.

You agree not to submit personal data of individuals through the Service in a way that would expose such data to AI Engines, and you remain responsible as controller for any personal data so submitted. We strongly recommend keeping all monitoring prompts focused on brand-level information rather than individuals.

7. International Data Transfers

Aeloria is based in Switzerland. The European Commission has recognised Switzerland as providing an adequate level of data protection (adequacy decision under Article 45 GDPR). Where personal data is transferred from the EU/EEA to Aeloria, this decision serves as the legal basis for the transfer.

Some sub-processors (in particular AI Engine providers) may process data in the United States or other jurisdictions. For such transfers, we rely on:

• Adequacy decisions where available (e.g. EU–U.S. Data Privacy Framework);
• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Equivalent safeguards under Swiss law (revDSG).

8. Retention

We retain personal data only as long as necessary for the purposes described in this Policy:

• Account data: for the duration of your Account, plus up to 12 months after closure for backup and dispute-resolution purposes;
• Billing and invoice data: 10 years, as required by Swiss commercial and tax law (Art. 958f Code of Obligations);
• Application logs: 12 months, then anonymised or deleted;
• Customer Data within Workspaces: for the duration of the Subscription and 30 days after termination, after which it is deleted unless export is requested. Backup copies may persist for up to 90 days before deletion;
• Support communications: 3 years from last interaction;
• Marketing data: until consent is withdrawn;
• Aggregate website analytics: retained in anonymous form indefinitely; no personal data is collected.

9. Your Rights

Under the GDPR and revDSG, you have the following rights:

• Access — request a copy of the personal data we hold about you;
• Rectification — correct inaccurate or incomplete data;
• Erasure — request deletion, subject to legal retention obligations;
• Restriction — request that we limit processing in certain circumstances;
• Portability — receive your data in a structured, machine-readable format;
• Objection — object to processing based on legitimate interest or direct marketing;
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing;
• Lodge a complaint — with the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or, for EU residents, with your local supervisory authority.

To exercise these rights, email privacy@aeloria.ai. We may need to verify your identity before fulfilling the request and will respond within 30 days.

10. Security

We implement technical and organisational measures appropriate to the risk, including:

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent, provided by our hosting platform);
• Role-based access control and the principle of least privilege;
• Authentication credentials stored salted and hashed;
• Logging of administrative access to customer data;
• Dependency vulnerability scanning;
• Sub-processor due diligence and contractual security commitments.

The measures in force are set out in Annex II of our Data Processing Agreement and are reviewed periodically and updated as appropriate.

In the event of a personal data breach likely to result in a risk to your rights, we will notify you and the competent supervisory authority within 72 hours of becoming aware. The same 72-hour commitment applies to notifications we owe Customers under our Data Processing Agreement.

11. Cookies & Tracking

Aeloria is cookieless by design with respect to tracking and analytics. We use only strictly necessary first-party session cookies for authentication and security, plus two functional cookies (preferred_lang and PARAGLIDE_LOCALE) that record your interface language. We do not use third-party tracking cookies, advertising cookies, or behavioural profiling technologies. Our analytics provider, Umami, operates without cookies and without collecting personal data. See our Cookie Policy for full details.

12. Children

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have done so inadvertently, please contact us and we will delete it.

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified by email or in-product notice at least 30 days before taking effect. The version date at the top reflects the most recent update.

Version history. Version 1.2 (8 August 2026): hosting sub-processor corrected to Google Cloud; Microsoft Copilot removed as a sub-processor and Google AI Overviews removed from the Gemini processing purpose, as neither is queried by the Service; xAI and Mistral AI added as sub-processors for optional engine coverage; the no-scraping commitment scoped precisely to AI chat interfaces and the retrieval of Customer-nominated web pages for Website Health disclosed; the multi-factor authentication statement removed as it does not reflect the Service as built; the 72-hour breach notification window stated explicitly.

14. Contact

Privacy-related questions, requests, or complaints may be sent to privacy@aeloria.ai.