Privacy Policy
1. Data Controller
Aethrix (the "Company," "we," "us," or "our") is the data controller for personal data collected via the Services.
Contact: privacy@aethrixstudio.com
2. Data We Collect
Account Data
- Email, name (first/last)
- Password hash (BCrypt)
- Region, license type, organization (if applicable)
- MFA secret (encrypted), login history
Usage Data
- API requests/responses (test execution)
- Service simulation traffic
- AI Assistant interactions (opt-in)
- Aggregated usage statistics (opt-out available)
Technical Data
- IP address, user agent, device info
- Authentication logs, audit trail
3. Purpose & Legal Basis
| Purpose | Legal Basis (GDPR) | Legal Basis (PIPL/US) |
|---|---|---|
| Provide Services | Contract (Art. 6.1.b) | Contract performance / consent |
| Authentication & Security | Legitimate interest (Art. 6.1.f) | Security compliance |
| Billing & License | Contract (Art. 6.1.b) | Contract performance |
| Support Communications | Legitimate interest | Service relationship |
| Usage Analytics (opt-in) | Consent (Art. 6.1.a) | Consent |
| AI Assistant (opt-in) | Consent (Art. 6.1.a) | Consent |
| Legal Compliance | Legal obligation (Art. 6.1.c) | Legal obligation |
4. Data Residency & Regional Processing
Your data is stored and processed in the region you selected at registration. This section details region-specific processing.
Quick Reference — Europe (EU)
| Aspect | Details for Europe (EU) |
|---|---|
| Supervisory Authority | Lead: Irish DPC (One-Stop-Shop) / your local DPA |
| Legal Basis | GDPR Art. 6 (contract, legitimate interest, consent, legal obligation) |
| Data Transfers | No transfers outside EU/EEA. Sub-processors EU-only. |
| DPIA | Not yet conducted. DPIAs for high-risk processing, including the AI Assistant, are on the compliance roadmap |
| Breach Notification | 72 hours to DPA; without undue delay to data subjects |
| Your Rights | Art. 15-22: Access, rectification, erasure, restriction, portability, objection, automated decision-making |
| DPO | No DPO has been formally appointed under Art. 37. Data-protection queries are handled at dpo@aethrixstudio.com and privacy@aethrixstudio.com |
| Representative | No Art. 27 EU representative has been appointed. If one is required, the name and address will be published here before this document is relied upon |
EU-Specific Privacy Details
- Lawful Basis per Category: See Purpose table in Section 3. Account data = contract; Security = legitimate interest; Analytics/AI = consent.
- No International Transfers: EU region data never leaves EU/EEA. All sub-processors are EU-hosted.
- DPIA: Not yet conducted for the AI Assistant features, automated test analysis or systematic monitoring. DPIAs for high-risk processing are on the compliance roadmap.
- Records of Processing (ROPA): Not yet maintained as a formal Art. 30 register. Processing details are described in this policy and are available on written request; a formal register is on the compliance roadmap.
- Schrems II Compliance: No reliance on invalidated transfer mechanisms. All infrastructure EU-hosted.
- Your Rights: Exercise via account portal (download data, delete account) or email privacy@aethrixstudio.com. Response within 30 days.
5. Sharing & Disclosure
We do not sell personal data. We share only:
- Sub-processors: Infrastructure providers per region (see Sub-processor List)
- Legal Requirements: When required by law, court order, or government request
- Business Transfers: In merger/acquisition, with notice
- With Consent: Any other sharing requires your explicit consent
6. Retention
- Account data: Retained while account is active + 30 days after closure
- Audit logs: 13 months (security)
- Billing records: Per tax law (typically 7 years)
- Usage analytics: 13 months (aggregated/anonymized)
Region-specific retention periods may apply.
7. Your Rights
Depending on your region, you may have rights to:
- Access, correct, delete your data
- Data portability
- Restrict or object to processing
- Withdraw consent (where consent is basis)
- Lodge complaint with supervisory authority
Exercise rights via account portal or email privacy@aethrixstudio.com.
8. Security
We implement appropriate technical and organizational measures: encryption in transit (TLS 1.2+), encryption at rest (AES-256), least-privilege access controls, and dependency vulnerability scanning on every build. No third-party penetration test and no SOC 2 audit have been performed to date. Our current position and the order we plan to close the gaps in are published at www.aethrixstudio.com/trust.
10. Changes to This Policy
We may update this Policy. Material changes will be notified via email and/or in-app notice 30 days before taking effect.
11. Contact
Data Protection Officer: dpo@aethrixstudio.com
Privacy Team: privacy@aethrixstudio.com
Postal: a contracting-entity address per region is not yet published in the
Terms of Service. Write to privacy@aethrixstudio.com
and we will supply it.