// Trust Centre
Privacy Policy.
Aelethion OÜ
Last updated: 30 September 2026
Effective date: 14 September 2026
1. Who We Are.
This Privacy Policy applies to Aelethion OÜ, a private limited company registered in Estonia (registry code 17529868), with its registered address at Mäealuse tn 2/4, 12618 Tallinn, Estonia (“Aelethion”, “we”, “us”, “our”).
Aelethion provides Athena, an enterprise AI control and evidence product. Athena has four modules: Data Control, which governs what AI can see and send; Secure Runtime, which governs what AI can do; Sovereign Compliance, which turns the resulting records into tamper-evident, audit-ready evidence that an authorised reviewer can verify offline; and Algo Assurance, which keeps algorithmic decisions about people in human hands and keeps the proof. Customers select the modules they need in writing.
This Policy, together with our public website and its subpages, forms our privacy notice. For all data protection matters you can contact us at privacy@aelethion.com.
Aelethion acts as a data controller for the personal data described in this Policy that relates to visitors to our website, enquirers and our business contacts. Where we process personal data on behalf of a customer as part of delivering Athena, we act as a data processor; that role is described in section 12.
The supervisory authority responsible for overseeing our compliance is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee.
2. Scope of This Policy.
This Privacy Policy explains what personal data we collect, why we collect it and on what legal basis, who we share it with, how long we keep it, where it is processed, and the rights you have under the General Data Protection Regulation (GDPR).
It applies to our public website, our contact form, and our business communications with prospective and existing customers, partners and suppliers. It does not by itself govern the personal data a customer chooses to process through Athena; that processing is governed by the agreement and Data Processing Agreement between Aelethion and that customer.
3. Personal Data We Collect.
3.1 Data You Provide Directly.
When you use our contact form or otherwise contact us, we collect the information you choose to give us. Through the contact form this is your name, work email address, organisation, role, an optional phone number, the enquiry type you select, and the content of your message. When we engage with you as a prospective or existing customer, partner or supplier, we also process the business-contact and correspondence details you share with us.
3.2 Data We Collect Automatically.
When you visit our website, our hosting provider processes standard server and security information, such as your IP address, browser and device type, the pages you request and the date and time of the request. We use this to serve the site, keep it secure and diagnose faults. We do not use advertising or cross-site tracking cookies.
3.3 Cookies and Preferences.
We use a small number of strictly necessary cookies and locally stored preferences to operate the website and remember your choices, including your decision about whether to load the embedded map on our contact page. Section 9 describes this in more detail.
3.4 Data Processed Through Athena.
When a customer deploys Athena, the product may process personal data contained in that customer’s AI workflows on the customer’s behalf. Depending on the deployment, that data can remain entirely within the customer’s own environment. Where Aelethion processes such data, it does so as a processor under the customer’s instructions; see section 12. This Policy does not turn that customer data into data for which Aelethion is the controller.
4. Legal Bases for Processing.
We rely on the following legal bases under Article 6 of the GDPR for the controller processing described above:
| Processing Activity | Legal Basis | GDPR Reference |
|---|---|---|
| Responding to a contact-form enquiry and taking steps at your request before entering into a contract | Performance of a contract or steps prior to a contract | Art. 6(1)(b) |
| Communicating with prospective and existing customers, partners and suppliers | Legitimate interests | Art. 6(1)(f) |
| Operating, securing and maintaining our website | Legitimate interests | Art. 6(1)(f) |
| Loading the optional embedded map when you allow it | Consent | Art. 6(1)(a) |
| Complying with our legal and regulatory obligations | Legal obligation | Art. 6(1)(c) |
Where we rely on legitimate interests, we have considered your interests and rights and concluded that our processing does not override them. You may object to that processing as described in section 10.
5. How We Use Your Personal Data.
We use personal data to respond to your enquiries, to arrange and run demonstrations and pilots, to manage our relationship with customers, partners and suppliers, to operate and secure our website, to meet our legal obligations, and to keep records of our business communications.
We do not use your personal data for automated decision-making that produces legal or similarly significant effects, and we do not sell your personal data.
6. Sharing Your Personal Data.
We share personal data only where necessary and with appropriate safeguards. We use a limited set of service providers who act as our processors:
- Google provides our business email through Google Workspace. Contact-form enquiries are delivered to us by email, and our correspondence with you is stored in Google Workspace.
- Vercel hosts our public website and runs the server function that receives contact-form submissions and passes them to our email.
We may also share personal data with professional advisers, or with authorities where we are legally required to do so. A current list of our sub-processors and our Data Processing Agreement are available on request from privacy@aelethion.com.
7. Data Retention.
We keep personal data only for as long as we need it for the purposes described in this Policy, and then delete or anonymise it. The table below summarises our approach.
| Data Category | Purpose | Retention |
|---|---|---|
| Contact-form enquiry | Responding to and following up on your enquiry | Kept for the duration of our correspondence and for up to 24 months afterwards, unless a relationship continues |
| Business-contact details | Managing our relationship with customers, partners and suppliers | Kept for the duration of the relationship and for up to 6 years afterwards for record-keeping |
| Correspondence and email | Keeping a record of our communications | Retained under our Google Workspace retention settings, typically for the life of the relationship |
| Website server and security logs | Operating and securing the website and diagnosing faults | Typically retained for up to 90 days |
| Cookie and preference data | Remembering your choices, including the map consent | Stored on your device until it expires or you clear it, up to 180 days |
| Pilot and evaluation records | Scoping, running and documenting a pilot | Kept for the duration of the pilot and the resulting relationship, then archived or deleted |
| Commercial and billing records | Managing orders, invoices and payments | Retained for the period required by tax and accounting law, generally 7 years |
| Support and enquiry records | Providing support and improving our service | Kept for the duration of the relationship and a reasonable period afterwards |
| Legal and compliance records | Meeting our legal obligations and defending legal claims | Retained for as long as required by the applicable limitation period |
8. International Data Transfers.
We aim to process personal data within the European Economic Area. Some of our providers, including Google and Vercel, may process data outside the EEA. Where that happens, the transfer is protected by an appropriate safeguard under Chapter V of the GDPR, such as the European Commission’s Standard Contractual Clauses or the provider’s certification under the EU-US Data Privacy Framework. You can request details of the safeguards from privacy@aelethion.com.
9. Cookies and Tracking Technologies.
Our website uses strictly necessary cookies and local storage to function and to remember your preferences. We do not use analytics, advertising or cross-site tracking cookies.
Our contact page can display an embedded map from Google. The map does not load, and no request is made to Google, until you choose to allow it. You can allow or withdraw that choice at any time using the controls on the page. Your choice is stored on your device and expires after 180 days.
10. Your Rights Under the GDPR.
Subject to the conditions in the GDPR, you have the right to access your personal data; to have inaccurate data corrected; to have your data erased; to restrict or object to processing; to data portability; and to withdraw consent at any time where we rely on consent. Withdrawing consent does not affect processing carried out before the withdrawal.
To exercise any of these rights, contact privacy@aelethion.com. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate or your local supervisory authority.
11. Security.
We apply appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, the principle of least privilege, and the separation of administrative access from ordinary use. Our business email is provided over Google Workspace with sender authentication in place for our domain. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to any incident.
12. Aelethion as a Data Processor.
When we process personal data on behalf of a customer to deliver Athena, we act as a processor and process that data only on the customer’s documented instructions, under a Data Processing Agreement. Depending on the deployment the customer chooses, the underlying data, keys, logs and evidence can remain within the customer’s own environment, and Aelethion does not hold a key that could create evidence in the customer’s name. Athena’s evidence is a tamper-evident sealed record that an authorised reviewer verifies offline; it is not published to any public ledger.
13. Children’s Privacy.
Our website and Athena are intended for businesses and their staff. We do not knowingly collect personal data from children, and our services are not directed at them.
14. Changes to This Policy.
We may update this Policy from time to time. The “last updated” date above shows when it last changed. Where a change is significant, we will take reasonable steps to bring it to your attention.
15. Contact Us.
For any privacy question or to exercise your rights, contact privacy@aelethion.com. For general enquiries, contact hello@aelethion.com. To report a suspected security issue, contact security@aelethion.com.