Privacy Policy

1. Who we are

AethelLayer provides a probe and inbox for developer-facing failures. For Customer Data that you send through the Service, you are the controller (or equivalent) and we are the processor, except where we decide the means of website analytics, accounts, and billing, where we are the controller. Contact: privacy@aethellayer.com.

2. Data we collect

Account and billing. Name, work email, company, plan, invoices, payment tokens handled by our payment processor. We do not store full card numbers.

Probe and inbox data. Error codes, stack traces, command lines, runtime and OS, endpoint paths, timestamps, hashed developer identifiers, optional session links (PostHog, Mixpanel), messages typed in the probe, and ticket drafts. We ask customers not to send secrets. If they do, we may still process them as part of the payload until you delete the thread.

Website data. Pages viewed, referrer, device, approximate region, and cookie identifiers described in the Cookie Policy.

Support. Emails you send us, and notes from a pilot.

We do not require special category data and we do not want it.

3. Why we use it

• To run the Service you asked for: capture, thread, draft, approve.
• To bill, prevent fraud, and keep accounts secure.
• To debug outages and abuse.
• To improve capture quality using aggregated or de-identified metrics. We do not train third-party foundation models on your raw stack traces. We may use de-identified patterns internally.
• To send product and service mail you can opt out of, except transactional mail we must send.
• To meet law, enforce Terms, and protect people.

Legal bases, where GDPR or similar law applies: contract, legitimate interests (secure, improve, and market a B2B tool to existing contacts), consent where we ask for it, and legal obligation.

4. Sharing

We share with subprocessors who help us host, auth, email, and bill, under contracts that require them to use data only for us. That currently includes infrastructure and auth providers such as Supabase when you enable login. We share with GitHub, Linear, PostHog, or Mixpanel when you connect them, using the tokens you provide. We share if you instruct us to, if we sell or merge the company (with notice where required), or if law or safety requires it. We do not sell personal information as that term is used in the CCPA. We do not share it for cross-context behavioral advertising.

5. Retention

Account data lasts for the life of the workspace plus up to 24 months unless law needs longer. Probe threads follow the retention you set, default 13 months, then delete or anonymize. Backups roll off on a shorter cycle. Billing records may last 7 years. Security, fraud, and abuse logs may be kept as long as we have a legitimate interest in defending the Service. You can export and delete threads in the product. We may refuse a deletion request that would impair security, billing, or an active investigation, except where law forbids refusal. Workspace deletion is irreversible after we complete it.

6. International transfers

We may process in the United States and other countries where our providers run. Where a transfer law applies, we use approved safeguards such as standard contractual clauses. You are responsible for telling developers in your product that a US processor may see failure context if that is your situation.

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object, and to withdraw consent. End developers who only hit a probe must contact the customer whose SDK they were using. We will point them there unless we must act. We will not discriminate against you for exercising privacy rights. We may take up to the statutory period to respond and may charge a reasonable fee for repetitive or excessive requests where law allows. You may appeal a denial to privacy@aethellayer.com, then to your regulator.

8. Security

We use encryption in transit, access control, and least-privilege production access. No method is perfect. You must protect your workspace, tokens, and who you invite. Report suspected incidents to security@aethellayer.com.

9. Children

The Service is for businesses, not for children under 16. We do not knowingly collect their data. If we learn we did, we will delete it.

10. Changes

We will post updates here with a new date. Material changes get a site or email notice when we have an admin address. Keep reading it if you keep using the Service.