Legal & Trust

02 / Data protection

Data protection, GDPR, and international privacy rights

AEREYS is designed to support privacy principles found in the GDPR, UK GDPR, ePrivacy rules, and other data-protection laws. This statement describes the intended allocation of responsibilities; it is not a certification or guarantee of compliance in every jurisdiction.

Controller and processor roles

For waitlist, website, marketing, and direct inquiry information, AEREYS will generally act as the controller because it decides why and how that information is used. For personal data a business customer puts into its AEREYS workspace—such as employee, prospect, customer, lead, or contact data—the business will generally act as controller and AEREYS will generally act as processor, processing that data only on documented customer instructions and to provide the contracted service. The exact role can vary by activity and jurisdiction.

Lawful bases

Depending on the activity and jurisdiction, AEREYS may rely on consent, performance of a contract or steps requested before a contract, compliance with a legal obligation, legitimate interests balanced against individual rights, or another lawful basis recognized by applicable law. Where consent is required, it should be specific, informed, freely given, unambiguous, and as easy to withdraw as it was to provide.

Customer responsibilities

• Identify a lawful basis and provide appropriate notices before collecting personal data through forms, pages, social channels, or CRM workflows.
• Collect only information that is adequate, relevant, and necessary for a stated purpose.
• Honor requests from people whose data the customer controls, including access, correction, deletion, restriction, objection, and portability where applicable.
• Use appropriate safeguards and obtain permissions before connecting social accounts, email accounts, or other integrations.
• Enter into any required data-processing agreement, determine retention periods, and configure the workspace accordingly.

Data-subject rights

Subject to applicable law and exceptions, individuals may have the right to know whether their data is processed, access a copy, correct inaccurate information, request deletion, restrict processing, object to processing based on legitimate interests or direct marketing, receive portable information, withdraw consent, and not be subject to certain solely automated decisions with significant effects. Requests about data held for a business customer should generally be directed to that business first; AEREYS will provide reasonable assistance where required.

International transfers and subprocessors

Information may be processed in countries other than the country where it was collected. Where a transfer is restricted, AEREYS should use a lawful mechanism such as an adequacy decision, approved standard contractual clauses, the UK International Data Transfer Agreement or Addendum, or another valid safeguard, together with a transfer-risk assessment where required. Service providers that process data on AEREYS’s behalf should be bound by written confidentiality, security, and data-protection obligations. A current subprocessor list and applicable data-processing terms should be made available before the platform processes live customer data.

Retention and deletion

AEREYS should retain information only for as long as needed for the purpose collected, the customer’s instructions, contractual obligations, legitimate operational needs, or legal requirements. When a workspace is closed or a deletion request is valid, production data should be deleted, returned, or anonymized within the period defined by the applicable agreement, subject to backups, security logs, dispute preservation, and legal retention obligations.

03 / Cookies

Cookies and similar technologies

AEREYS may use strictly necessary cookies or local storage for preferences such as theme selection, session continuity, security, and core functionality. Non-essential analytics, advertising, or personalization technologies should not be activated in regions that require consent until the user has made a valid choice.

Where consent is required, the consent mechanism should provide clear purposes, reject and accept choices with comparable ease, record the choice and version of the notice, and allow withdrawal at any time. Browser settings may also control cookies, although disabling necessary technologies can affect functionality.

04 / Use

Terms of use

These terms apply to the AEREYS website, waitlist, and any preview or platform access made available by AEREYS. By using the website or requesting access, you agree to use the service lawfully and to provide information that is accurate enough for the requested interaction.

Accounts and workspace access

Account credentials must be kept confidential. Customers are responsible for activity under their accounts, assigning appropriate roles, reviewing permissions, and promptly notifying AEREYS of unauthorized access. Customers must not share access in a way that defeats workspace controls or attempt to access another business’s data.

Acceptable use

• Do not use AEREYS to violate privacy, consumer-protection, intellectual-property, marketing, spam, or other applicable laws.
• Do not upload malware, credentials, unlawful content, or unnecessary sensitive personal data.
• Do not impersonate a person or business, misrepresent generated content, or send deceptive communications.
• Do not probe, scrape, reverse engineer, disrupt, overload, or bypass security or rate limits.
• Do not use connected accounts or generated content to violate a platform’s terms, policies, or API requirements.

AI-generated output

AEREYS may generate strategies, recommendations, captions, visual concepts, and other output. Output may be incomplete, inaccurate, biased, unavailable, or unsuitable for a particular audience. Customers must review output for factual accuracy, rights, brand suitability, accessibility, legal claims, regulated-industry requirements, and platform rules before approval, scheduling, or publishing. AEREYS does not guarantee reach, engagement, revenue, leads, or customer acquisition.

Integrations, publishing, and lead data

Connected social and email services remain subject to their own terms, permissions, outages, limits, and changes. AEREYS cannot guarantee that every platform will accept, publish, schedule, or preserve content. Customers are responsible for their notices, consent flows, lead communications, opt-outs, suppression lists, and lawful CRM use.

Intellectual property and customer content

AEREYS and its licensors retain rights in the website, software, brand, design, and documentation. Customers retain rights in content they provide, subject to the licenses needed to host, process, transform, generate, schedule, and publish it as instructed. Customers represent that they have the rights and permissions required for their inputs, connected accounts, images, trademarks, and lead data.

Availability, changes, and termination

AEREYS is currently coming soon and may change, pause, or discontinue previews, features, integrations, pricing, or availability. AEREYS may suspend access to protect people, data, systems, or third parties, or where use violates these terms. On termination, access may stop and data should be handled according to the applicable agreement and retention rules.

Disclaimers and liability

To the maximum extent permitted by applicable law, the website and preview service are provided on an “as available” and “as is” basis. Nothing here excludes liability that cannot lawfully be excluded, including mandatory consumer rights, fraud, or certain intentional misconduct. Any commercial service agreement should define warranties, service levels, fees, liability limits, indemnities, and governing law expressly.

05 / Security

Security, incidents, and responsible disclosure

AEREYS is being designed with access control, least privilege, tenant separation, authenticated integrations, encryption in transit, secure credential handling, logging, backups, dependency management, and review-before-publish workflows. Specific controls, certifications, hosting locations, recovery objectives, and audit reports should be documented before production commitments are made.

Incident response

AEREYS should maintain procedures to detect, assess, contain, investigate, remediate, and document personal-data incidents. Where required by law, AEREYS should notify the relevant supervisory authority within the applicable deadline and notify affected customers or individuals without undue delay when the risk threshold is met. Customers remain responsible for assessing and reporting incidents in their own systems and for notifying their users where required.

Responsible disclosure

Please report suspected vulnerabilities privately to contact@aereys.com with the affected page or component, reproduction steps, impact, and a safe contact method. Do not access, alter, download, or disclose other people’s data; do not perform denial-of-service testing; and allow reasonable time for investigation and remediation.