Privacy Policy

Effective date: July 7, 2026 · Contact: hello@aeolus-cloud.com

This Privacy Policy explains how AEOLUS ("AEOLUS," "we," "us") collects, uses, and shares information when you use aeolus-cloud.com, the AEOLUS application and its subdomains, our APIs and connectors, and related services (together, the "Service"). AEOLUS is an Answer Engine Optimization (AEO) analytics platform used by businesses and agencies. We act as the data controller for account and usage data, and as a processor for content our customers submit for analysis.

1. Information we collect

Information you provide

• Account data — name, email address, and a password (stored only as a salted hash).
• Organization data — organization/workspace names, member roles, branding you upload for white-label use.
• Content submitted for analysis — website URLs, page content, brand names, competitor names, questions/queries, personas, and documents you ask the Service to scan or grade.
• API keys you bring (BYOK) — provider keys (e.g., OpenRouter, Anthropic, OpenAI, Google, Perplexity, xAI, SerpApi) that you choose to store. These are encrypted at rest with AES-256-GCM, are never displayed back in full, are used only to run the analyses you request, and are never sold or shared.
• Communications — messages you send us, feedback and bug reports submitted in-product.

Information collected automatically

• Usage and log data — IP address, browser/user-agent, pages viewed, actions taken (kept in an audit log for security), timestamps.
• Cookies — we use essential session cookies only (sign-in state and security). We do not use advertising cookies or third-party trackers on the Service.

Information from integrations you connect

• Google Search Console / Google Analytics 4 — search performance and AI-referral session metrics, accessed via OAuth with the scopes you approve. Use of Google data complies with the Google API Services User Data Policy, including its Limited Use requirements.
• Monday.com — board and task metadata needed to create work items you request, via OAuth.
• MCP / API clients (e.g., Claude) — when you authorize a connector via OAuth, it acts with your permissions, narrowed by the token scopes you approve; all connector actions are audit-logged and tokens can be revoked at any time.

2. How we use information

• Provide, operate, and secure the Service (authentication, RBAC, audit logging, abuse prevention).
• Run the analyses you request — including sending submitted content to the AI model providers you configure (see Section 4).
• Send transactional email (reports, alerts, password resets) via our email provider.
• Respond to support requests and improve the Service.
• Comply with law and enforce our Terms of Service.

We do not sell personal information, and we do not use your content or keys to train AI models.

3. Legal bases (EEA/UK)

Where GDPR/UK GDPR applies, we process personal data on these bases: contract (providing the Service you signed up for), legitimate interests (security, audit logging, service improvement), consent (optional integrations you connect; you may withdraw consent by disconnecting them), and legal obligation where applicable.

4. AI processing disclosure

AEOLUS analyzes content using large language models. When you run a scan, relevant content (page text, queries, brand/competitor names) is sent to the model provider(s) configured for your organization — either through your own keys (BYOK) or, for sponsored pilots, through platform keys. Providers process this data under their own terms; we recommend reviewing them. AI-generated findings can be inaccurate; see the Terms for the accuracy disclaimer.

5. Sharing and subprocessors

We share data only with service providers that help us run the Service:

We may also disclose information if required by law, or in connection with a merger or acquisition (with notice). We never share your stored API keys with anyone.

6. International transfers

The Service is hosted in the United States. If you access it from outside the US, your data is transferred to and processed in the US. For EEA/UK customers we rely on Standard Contractual Clauses with our subprocessors where required; a Data Processing Addendum (DPA) is available on request at hello@aeolus-cloud.com.

7. Retention

Account and organization data are retained while your account is active and deleted within 30 days of a verified deletion request (backups purge on their own rolling cycle, up to 35 additional days). Scan results are retained so you can track trends and are deleted with the organization. Audit logs are retained for up to 12 months for security purposes.

8. Security

Controls include TLS in transit, AES-256-GCM encryption for stored API keys, hashed passwords, role-based access control, append-only audit logging, token revocation on password change, and strict outbound-request guards. Details: aeolus-cloud.com/security. No method of transmission or storage is 100% secure; report concerns to security@aeolus-cloud.com.

9. Your rights

EEA/UK (GDPR): you may request access, rectification, erasure, restriction, portability, and object to processing, and you may lodge a complaint with your supervisory authority.

California (CCPA/CPRA): you have the right to know, delete, and correct personal information, and the right to non-discrimination. We do not "sell" or "share" personal information as defined by the CPRA, and we do not use sensitive personal information beyond providing the Service.

To exercise any right, email hello@aeolus-cloud.com from the address on your account; we respond within 30 days. If your data was submitted by an organization using AEOLUS (e.g., your employer or agency), we may direct your request to that organization as the controller.

10. Children

The Service is for business use and not directed to anyone under 16. We do not knowingly collect data from children.

11. Changes

We will post any changes here and update the effective date; material changes will be announced by email or in-product notice.

12. Contact

AEOLUS · hello@aeolus-cloud.com · aeolus-cloud.com