Data Processing

1. Roles

For a business's customer data, the business is the data controller and Aeros Marketing Solutions (operating Ariium) is the data processor, acting only on the business's instructions given through the product's own settings.

2. What we process on the business's behalf

Customer messages and attachments, contact details, conversation history, identity-check results, and the knowledge and rules the business configures.

3. Sub-processors

Supabase (database, sign-in and file storage); our website hosting provider (currently Vercel); our email provider (currently Mailgun) for sending and receiving email; Anthropic, which writes the AI replies; Voyage AI, which turns text into search data so the AI can find the right approved answer; and, only when a business connects them, Meta (WhatsApp, Messenger, Instagram), Telegram and an SMS provider. Payments for business plans go through a payments provider; customers' payment details never pass through Ariium.

4. Security measures

Encryption in transit and at rest, tenant isolation enforced in the database, role-based access checked on the server, and an append-only audit log of sign-ins, AI decisions, approvals and exports.

5. Breach notification

We notify an affected business without undue delay after becoming aware of a breach affecting its data, with what we know at the time and how we're containing it, so the business can meet its own notification duties.

6. Ending the relationship

When a business cancels, its data can be exported for 30 days and is then deleted, unless the law requires us to keep it longer.