Aeleron AI
arrow_back Back to Studio Showcase
Enterprise Compliance Standard

Privacy Policy

Effective Date: November 4, 2026 • Last Updated: November 4, 2026 • Entity: Aeleron AI Studio

01. Overview & Privacy Architecture

Aeleron AI ("Aeleron", "we", "us", or "our") operates the web platform located at aeleronai.com, including all associated edge endpoints, APIs, and bespoke software engineering showcase environments (collectively, the "Platform").

We adhere to modern data governance principles: strict data minimization, zero unauthorized monetization, and transparent sub-processing. We process only the minimum information necessary to evaluate software engineering inquiries, protect edge infrastructure against automated threat actors, and deliver requested technical services.

We do not sell, rent, monetize, or trade your personal information, client inquiry details, or technical project specifications to third-party data brokers or marketing affiliates.

02. Categories of Data Collected

A. Inquiry Form Data (Voluntarily Provided)

When prospective clients initiate a project consultation or submit a build inquiry via our intake interface, we collect:

  • Contact Information: Full name, professional email address, and company or organization name.
  • Technical Scope & Parameters: Selected architectural pillar (Web Platform, Mobile App, AI System, or Full-Stack Architecture), estimated budget tier, target delivery timeline, and high-level project goals or system specifications.
  • Direct Correspondence: Technical feedback or project requirements transmitted to our communication channels.
  • By submitting the above form, you consent to Aeleron AI contacting you directly to discuss your software engineering inquiry.

B. Automated Telemetry & Technical Metadata

  • Edge Network Telemetry: Standard HTTP request headers (IP address, user-agent string, operating system type, timestamp, and referring URL) processed in real time by our edge network for request routing, DDoS mitigation, and rate limiting.
  • Aggregated Usage Analytics: Anonymized site engagement metrics and categorical navigation events collected via industry-standard analytics tools with IP anonymization enabled. We do not transmit personal names, email addresses, or unredacted project details to analytics pipelines.

C. Bot-Verification Tokens

To defend our intake endpoints against distributed spam and automated enumeration attacks, we deploy automated cryptographic challenge verification (Cloudflare Turnstile). Turnstile evaluates device and browser risk signals ephemerally without setting persistent behavioral advertising cookies.

03. How We Use Data

We process collected data strictly for operational, security, and contractual purposes:

  • check_circle Engineering Scope Evaluation: Assessing technical feasibility, staffing models, and architectural requirements to deliver structured client project proposals.
  • check_circle Client Communications & SLA Fulfillment: Responding to authorized inquiries under our guaranteed 24-hour studio response standard.
  • check_circle Infrastructure Security: Enforcing rate-limiting thresholds, detecting automated script execution, and neutralizing distributed denial-of-service attempts.
  • check_circle Contractual & Statutory Compliance: Executing subsequent bilateral Non-Disclosure Agreements (NDAs), Master Services Agreements (MSAs), and satisfying regulatory record-keeping duties.

04. Authorized Sub-processors

To maintain high availability, secure edge delivery, and reliable transactional messaging, we engage authorized enterprise sub-processors. Each entity is bound by strict confidentiality and data protection obligations:

Cloudflare, Inc.
CDN, DNS, & Turnstile

Content Delivery Network, edge routing, DDoS mitigation, and anti-bot challenge verification.

Google LLC
Cloud Infrastructure & Analytics

Google Cloud Platform, Firebase infrastructure for secure hosting and database services, and Google Analytics.

Resend, Inc.
Transactional Email Delivery

Secure transactional email delivery for lead intake notifications and client correspondence.

05. Data Retention & Security Controls

We retain personal information only for as long as necessary to fulfill the specific inquiry, maintain active client business relationships, resolve disputes, or satisfy applicable legal and regulatory obligations. When data is no longer needed, it is deleted or irreversibly anonymized in accordance with our standard disposal procedures.

Our infrastructure incorporates enterprise-grade administrative, technical, and physical safeguards:

  • Encryption in Transit: All web traffic and API endpoints enforce modern Transport Layer Security (TLS 1.3 / HTTPS).
  • Cryptographic Authorization: Backend database transactions and edge communications require cryptographic token verification (RS256 JWT) signed by secured service keys.
  • Automated Threat Isolation: Honeypot triggers isolate malicious crawlers, automatically discarding rogue traffic without processing or database persistence.
  • Access Governance: Internal systems operate under least-privilege access controls with mandatory multi-factor authentication.

06. Your Privacy Rights (GDPR / CCPA / US State Laws)

In accordance with applicable privacy frameworks—including the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended (CCPA/CPRA), and comprehensive US state privacy laws—you possess the following rights:

  • Right to Access / Know Request confirmation of whether we process your personal data and receive a readable copy of that information.
  • Right to Correction / Rectification Request correction of inaccurate or incomplete contact and project records.
  • Right to Deletion / Erasure Request permanent erasure of your personal data, subject to statutory retention exceptions.
  • Right to Opt-Out & Non-Discrimination Opt out of analytics processing or exercise your privacy rights without receiving discriminatory treatment or altered service levels.

To exercise any statutory privacy rights, submit a written request to [email protected]. We verify requester identity before fulfilling substantive requests and respond within the statutory timeframe (typically within 30 days).

07. Contact & Governance

For inquiries regarding this Privacy Policy, our data protection practices, or data subject requests, contact our dedicated compliance office:

Aeleron AI — Privacy & Data Protection Jurisdiction: State of Oregon, United States Privacy Desk: [email protected] Official Web Domain: https://aeleronai.com