Privacy Policy

1. Information we collect

• Account information: name, email, and the website URL you submit for scanning.
• Payment information: processed by Stripe. We receive transaction metadata (amount, status, last four digits of card) but do not store full card numbers on our servers.
• Scan inputs and outputs: the public web pages we scan on your behalf, the findings we generate, and any artifacts we produce for your site.
• Usage data: server logs, browser type, IP address, referrer URL, and timestamps for security and reliability.
• Communications: emails you send us and our replies, including delivery notifications from our email provider (Resend).

2. How we use it

• To deliver the products you purchased.
• To process payments, refunds, and account changes.
• To send transactional emails (delivery links, build status, account notifications).
• To improve our scanning methodology, scoring framework, and product quality.
• To detect, prevent, and respond to security threats.
• To comply with legal obligations.

3. Sharing

We share information only with:

• Service providers who help us operate the business: Stripe (payments), Supabase (database and storage), Resend (email delivery), Railway and Vercel (hosting), Google Workspace (internal email). These providers are bound by their own privacy commitments and process data only on our instructions.
• Legal requirements, when we receive a valid subpoena, court order, or other lawful demand.
• Business transfers, in the event of a merger, acquisition, or asset sale, in which case we will notify affected customers in advance.

We do not sell personal information, and we do not share it with advertisers.

4. Retention

We retain account and order records as long as your account is active and for a reasonable period afterward to comply with tax and accounting obligations. Scan artifacts are retained on your portal for the lifetime of the account; delivery emails reference time-limited signed URLs.

5. Your choices

• Access and correction: email privacy@etherealmedia.ai and we will provide a copy of the personal information we hold about you and correct any inaccuracies.
• Deletion: you may request deletion of your account and associated personal information, subject to record-retention requirements imposed by law.
• Email preferences: transactional emails (order confirmations, delivery notifications) are required to operate the service. Marketing emails, where applicable, can be unsubscribed via the link in each message.

6. Security

We use TLS for data in transit, signed URLs for artifact downloads, row-level security on customer data in Supabase, and least-privilege access for our team. No system is perfectly secure; if we discover a breach affecting your information, we will notify you as required by applicable law.

7. International users

Our infrastructure is hosted in the United States. By using our services from other jurisdictions, you consent to the transfer of your information to the U.S.

8. Children

Our services are intended for businesses and adults. We do not knowingly collect information from children under 13.

9. Changes

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated to active customers by email.

10. Contact

Questions or requests? Email privacy@etherealmedia.ai.