Aldena Privacy Policy

This Privacy Policy explains how Aaron Delasy ("Aldena", "we", "us", or "our") collects, uses, and shares personal information. Aldena is the persistent AI product-team platform for software agencies.

Account registration is open to the public through self-service sign-up. Paid plans are live and are sold through our payment processor, which acts as the merchant of record (see "Subprocessors" below).

1. Introduction and scope

Aaron Delasy is the controller of the personal information described here. This policy covers our website and the Aldena product. It does not cover third-party services you connect to Aldena, which have their own privacy practices.

When you use Aldena to process information on behalf of your own clients or end users, you are typically the controller of that information and we act as your processor under our agreement with you; this policy describes our own practices as a service provider.

2. Information we collect

Information you provide:

• Account profile — your name, email address, password, email-verification status, and profile image, created through our authentication provider.
• Content you upload or create — room configuration, chat messages, prompts, agent reasoning and audit logs, and uploaded files and code (attachments).
• Connector credentials — the credentials and tokens for third-party services (for example, GitHub) you choose to connect.
• Billing information (paid plans) — when you subscribe, our payment processor (the merchant of record) collects your payment details directly; we receive limited billing information such as your name, billing address and country, the card type and last four digits, and transaction and subscription identifiers. We do not store full payment-card numbers.
• Communications — messages you send us, such as support requests.

Information collected automatically:

• Device and usage data and server logs — request and diagnostic logs generated when you use the Service.
• IP address — IP addresses may appear transiently in server logs for security and abuse prevention.
• User-agent — your browser's user-agent string.
• Referral and campaign parameters — UTM parameters (source, medium, campaign, term, and content) when you arrive at the site through a campaign link.
• Cookies and similar technologies — as described in "Cookies and similar technologies" below.
• Analytics events — we use Google Analytics 4 and Google Tag Manager, loaded first-party from our own domain, to understand how the website and product are used. In regions that require opt-in consent, analytics runs without cookies until you grant consent (see "Cookies and similar technologies" below).
• Error and performance diagnostics — collected through Sentry to help us detect and fix problems.

The website fonts are self-hosted, so loading our pages does not send your information to a font provider.

Information from third parties:

• OAuth sign-in profile — if you sign in or connect using a third-party provider such as GitHub, we receive basic profile information from that provider as permitted by your authorization.

3. How we use information and our legal bases

We use personal information to:

• Provide and operate the Service — create and run your account, rooms, and agents, execute the actions you authorize, and deliver results (legal basis: performance of a contract).
• Secure the Service and prevent abuse — including bot protection through Cloudflare Turnstile and rate limiting (legal basis: legitimate interests in keeping the Service secure, and legal obligation where applicable).
• Process payments and manage subscriptions — bill paid plans, prevent payment fraud, and keep billing records, working with our merchant of record (legal basis: performance of a contract, and legal obligation for tax and accounting records).
• Maintain, debug, and improve the Service — using Sentry diagnostics and server logs (legal basis: legitimate interests).
• Comply with law — respond to legal obligations and lawful requests (legal basis: legal obligation).

We do not use your content to train AI models. See the next section.

4. AI processing and model training

This is the core of how Aldena handles your data.

Your code, prompts, and agent outputs are processed only to run your agents and return results to you. We do not use your content to train our own models or any third party's models.

To produce results, agents send your prompts and relevant context to large-language-model providers (including Anthropic, OpenAI, and AWS Bedrock). We make those calls under terms that prohibit using your data to train models and that provide zero or limited retention by the provider. Agent work runs inside ephemeral, isolated sandbox virtual machines that are torn down after the run.

5. Cookies and similar technologies

We group the cookies and similar technologies we use into four categories:

• Essential — always active and required for the Service to work: the session cookie set by our authentication provider so you can stay signed in, Cloudflare Turnstile bot protection, Sentry error-monitoring technologies, and the cookie that stores your own cookie preferences.
• Analytics — Google Analytics 4 and Google Tag Manager, loaded first-party from our own domain, help us understand how the website and product are used.
• Marketing — used to measure whether our campaigns are effective.
• Preference — remember settings and choices you make so the Service behaves consistently between visits.

If you are in a region that requires opt-in consent (for example the EEA, the UK, or Switzerland), all non-essential categories are off by default and are enabled only if you grant them. You can change your consent at any time via the "cookie settings" link in the site footer, which reopens the preferences dialog.

We do not sell or "share" your information for cross-context behavioral advertising. You can also control cookies through your browser settings; blocking essential cookies may prevent you from signing in.

6. How we share information

We share personal information only as follows:

• Service providers and subprocessors — vendors that help us operate the Service, listed in "Subprocessors" below, under contracts that limit their use of the information.
• At your direction, through Connectors — when you enable a Connector, we share information with that third party as needed to perform the actions you authorize.
• Legal and safety — when we believe disclosure is required by law or legal process, or is necessary to protect the rights, safety, or property of Aldena, our users, or others.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising (as those terms are used under California law).

7. Subprocessors

We use the following subprocessors to provide the Service. EU↔US transfers rely on Standard Contractual Clauses and/or the EU-US Data Privacy Framework where applicable (see "International data transfers").

8. International data transfers

We process personal information in the European Union and in the United States. When we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and/or the EU-US Data Privacy Framework where applicable.

9. Data retention

We keep personal information for as long as needed for the purposes described in this policy:

• Account and profile — for the life of your account and then for a limited period of 30 days afterward, unless a longer period is required by law.
• Room and agent logs and attachments — for as long as your room and account remain active, unless you delete them sooner or we must keep them longer.
• Billing and tax records — retained as needed to meet financial, tax, and accounting obligations, typically for up to 7 years.
• Backups — residual copies may persist in routine backups for up to 30 days before they are overwritten.

We delete or de-identify personal information when it is no longer needed, subject to legal holds and obligations. You can request deletion as described in "Your rights".

10. Security

We use technical and organizational measures designed to protect personal information, including encryption in transit and at rest, access controls and least-privilege practices, isolation of agent workloads in ephemeral sandboxes, and monitoring. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. Your rights

Depending on where you live, you may have the following rights.

If you are in the EEA, the UK, or Switzerland (GDPR): the rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing; the right to withdraw consent at any time (without affecting prior processing); and the right to lodge a complaint with your supervisory authority.

If you are a California resident (CCPA/CPRA): the rights to know and access the personal information we collect, to delete it, to correct it, to opt out of the sale or "sharing" of personal information (we do not sell or share it), to limit the use of sensitive personal information, and to non-discrimination for exercising your rights.

To exercise any of these rights, contact us at [email protected]. We will verify your request as required by law and respond within the applicable timeframe. You may use an authorized agent where the law permits.

12. Children's privacy

The Service is intended for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us at [email protected] and we will delete it.

13. Changes to this policy

We may update this policy from time to time. If we make material changes, we will take reasonable steps to notify you, such as by updating the "Last updated" date below or by other notice. Your continued use of the Service after changes take effect constitutes acceptance.

14. Contact

Privacy: [email protected]