Privacy Policy

Information we collect

Account data you provide through sign-in (such as your email and name, handled by our authentication provider), API credential records associated with your account, and the embed metadata you create — the source URLs you submit and the provider data resolved from them.

Aggregate request analytics for your embeds: hit counts and timestamps. These analytics do not contain end-viewer IP addresses, user-agent strings, referrer URLs, cookies, or device fingerprints.

For short-lived abuse prevention, our edge reads the viewer IP address supplied by our trusted network proxy and immediately converts it to a keyed, purpose-scoped pseudonym before using it in a rate-limit bucket. Raw viewer IP addresses and full user-agent or referrer values are not written to application logs, analytics, or rate-limit storage.

How we use it

To operate the embed proxy, enforce plan quotas and billing, produce the analytics shown in your dashboard, and secure the service against abuse.

Sharing and subprocessors

We do not sell personal data. Operating aetherframe requires service providers for authentication, payments, application hosting, database processing, and authoritative production rate limiting. The data sent to each provider is limited to the function it performs for the service.

When an embed loads, the selected content provider receives a network request from the viewer. This ordinarily exposes network metadata such as the viewer IP address and broad browser request information; browser policy may also send provider-origin cookies. The nested frames do not forward the publisher page URL to provider content and isolate provider code from the publisher origin, but aetherframe is not an anonymising network proxy.

Data retention

Account, embed, and aggregate analytics records are retained while needed to operate the account. Deleting your account first cancels any active paid subscription with our payment provider, then removes your account record (including your email address and name), API credentials, embeds and their analytics, domain settings, usage counters, subscription and checkout state, plan-change records, and source metadata that no other account uses.

Some billing records are kept after account deletion because they are needed for accounting, tax, payment-dispute, and fraud-prevention purposes: a log of each subscription and payment change (your internal account identifier, the product, price, currency, amount paid, and billing period, and the payment provider’s customer, subscription, and event identifiers); duplicate-delivery and ordering records for payment-provider events (the internal account identifier and provider event and subscription identifiers); and records of payment events we could not process (request metadata such as the method, path, content type, and header names; the body size and a one-way digest of the event; the payment provider’s event identifier; and the rejection reason, which can include a payment-provider object identifier and, when our database rejected the event, a database error code and constraint name; never the event contents). These records do not contain your email address or name. A scheduled bounded cleanup job deletes them after fixed periods: duplicate-delivery records once they expire, 90 days after the event is processed; records of events we could not process after 90 days; ordering records after a subscription has had no payment-provider event for 400 days; and the log of subscription and payment changes after two years.

Short-lived replay claims expire within minutes and processed sign-in-provider webhook evidence is kept for 30 days; both are removed by a scheduled bounded cleanup job. Completed plan-change records are removed 90 days after they finish. Infrastructure backups and records held by external providers, including our payment and authentication providers, follow their own retention schedules required for recovery, security, billing, or law.

Your rights

You can manage available account data in the dashboard or contact us to request access, correction, export, or deletion. Requests are handled subject to applicable law and identity verification.

Security

Stored API credential secrets are encrypted with a server-managed keyring and record-bound authenticated data. Embeds render through a separate-origin policy shell and capsule controller; scripted provider code runs in an additional opaque nested frame. Access is scoped per account.

Changes to this policy

If we change how we handle data, we will update this page with a new effective date and version.