Privacy notice

We hold the data your agency puts into Aegis so that Aegis can run your agency. We do not sell it, we do not use it to train AI models, and we do not let one customer see another’s — that last one is enforced by the database, not by a policy.

For your own account data — the people in your agency, your billing details — we decide how it is used, so we are the controller.

For the data you put in about creators and your clients, you decide what to collect and why. You are the controller and we process it on your instructions. That means your agency is responsible for having a lawful basis to hold a creator’s contact details, and for answering a request from that creator — we will help you find and export or delete the records.

• Account data: name, work email, password hash, timezone, role, and the agency you belong to.
• Security data: sign-in times, IP address and browser string for your active sessions, failed sign-in counts, and — if you turn it on — an encrypted second-factor secret and hashed recovery codes.
• Your business data: clients, creators, products, campaigns, messages, samples, content and results. This is the bulk of it, and it is yours.
• Billing data: your plan, invoices, payment outcomes, and the brand, last four digits and expiry of the card. Never the card number or security code — those are entered on our payment provider’s page and never reach us.
• Operational data: audit entries for significant actions, error reports, and performance metrics.

• Sell it, or share it with advertisers.
• Use it to train AI models. Every AI request records that it was made with training opt-out in force, so this is a fact in a log rather than a promise in a document.
• Put it in an AI prompt beyond what is needed to answer the question asked, inside your own permissions.
• Let one tenant read another’s. Row-level security in PostgreSQL enforces it, and an isolation test suite attempts the crossing on every domain to prove the enforcement is real.

Running the service needs a small number of processors: a cloud host for the servers and database, a payment provider for card processing, an email provider for transactional messages, and an AI provider for the assistant. Each receives only what its job needs — the AI provider, for example, receives the question and the facts needed to answer it, not your database.

We do not yet publish a named sub-processor list with locations, because the production deployment is not finalised. When it is, that list will be published here and changes announced in advance. Until then, ask and we will tell you exactly who is involved.

• Your business data: for as long as your account is open, and for a short window afterwards so you can export it.
• Audit entries: kept for the life of the account. They are append-only and hash-chained, so they cannot be selectively edited — including by us.
• Sessions: refresh tokens expire, and expired ones are deleted on a schedule.
• Reset and verification links: minutes to hours. The record that one was used is kept, because “that link was already used on Tuesday” answers a support question.
• Backups: retained on a rolling schedule for disaster recovery, then overwritten. Deleting data removes it from the live system immediately and from backups as they cycle.

You can export everything in your workspace at any time, from inside the product. You can ask us to delete an account and its data. You can see where you are signed in and end any of those sessions yourself.

Depending on where you are, the law may give you further rights — access, correction, portability, objection, and a complaint to a regulator. Write to privacy@aegis.example and we will act on it. We will not make you pay or subscribe to exercise a right.

Passwords are hashed with Argon2id; tokens are stored only as digests; integration credentials and second-factor secrets are encrypted at rest. Traffic is served over HTTPS, and the browser never holds an API token. The security page describes the controls in detail, including what has not been independently verified.

Aegis is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a creator record in your workspace belongs to a child, delete it — and remember that the responsibility for what you collect about creators is yours.

This notice was written by the engineers who built the system so that it describes the implementation accurately. It has not been reviewed by a privacy lawyer, and it does not claim compliance with GDPR, CCPA or any other regime — that claim needs a review that has not happened. What it does claim is that the behaviour described here is the behaviour in the code.