Privacy policy

1. Who is responsible

Aqteron is operated by EIREEN Tech, a French société par actions simplifiée (SAS), registered under 102 628 047 R.C.S. Paris. Registered office: 122 rue Amelot, 75011 Paris, France. Contact: contact@aqteron.com.

EIREEN Tech is the controller for Aqteron account administration, service security and support. An app publisher determines the purposes and content of their own application; for personal data hosted on their instructions, Aqteron provides the hosting service. This policy covers aqteron.com, its cabinet, API, connectors and hosting functions. It does not replace an app publisher’s own privacy notice.

2. Data we process

We receive information from you, your browser, the AI service you connect and applications using Aqteron’s hosting functions.

• Account: email address, account identifiers and status, password verification hash, email verification and sign-in records, session and access permissions. Your email and authentication information are needed to create and protect an account.
• Apps: uploaded ZIP files, source files and assets, app names, versions, validation reports, publication links and operation results. Content can contain personal data supplied by you or your app’s users.
• Optional app features: database records, uploaded files, app-user identifiers, notification subscriptions and messages or events required by enabled platform capabilities. The data depends on the application and features used.
• Technical and support data: IP address, browser and request information, timestamps, errors, security and operation records, and messages you send us. Please include only information needed to resolve your request.

3. Purposes and legal bases

App content is processed to provide the hosting functions requested by the publisher. The publisher is responsible for identifying the legal basis for their own collection and use of users’ data.

• Providing the requested service: account creation, authentication, uploading, validation, hosting, publication and connected-tool operations — performance of our contract with you, or steps you request before it (GDPR Article 6(1)(b)).
• Security, abuse prevention, diagnostics and handling general enquiries — our legitimate interests in protecting users and operating a reliable service (Article 6(1)(f)), balanced against your rights.
• Responding to data-rights requests and binding legal requirements — compliance with legal obligations (Article 6(1)(c)).
• Where a feature requires consent, such as optional browser permissions or non-essential tracking, that permission is requested separately and can be withdrawn. Simply reading this policy is not consent (Article 6(1)(a), where applicable).

4. ChatGPT, Claude and other AI connections

An AI connection is optional. You authenticate on Aqteron and approve access through OAuth. The AI client receives access credentials, not your Aqteron password. Available permissions cover reading your apps, uploading app packages, publishing apps and reading deployment results.

Aqteron receives tool arguments and files sent through the connection. The AI service receives the requested app information and operation results. Connecting does not automatically send Aqteron your entire chat history or grant it access to your computer, mailbox or other services. A tool argument or uploaded file may nevertheless contain information from your conversation.

You can revoke a connection in the cabinet’s AI connections page. Revocation stops further use of that grant; it does not delete your apps, operation records or copies already held by the AI provider. ChatGPT, Claude and other providers process your conversations and returned data under their own terms and privacy settings. Consult their notices before connecting.

5. Published apps and their users

Publishing makes the app available at its publication address, subject to the app’s access configuration. A public or hard-to-guess URL is not a confidentiality guarantee. Publicly served source files and assets can be read, downloaded and shared by visitors. Do not embed passwords, private keys or personal information that must remain private in public files.

Files stored through a private app feature are governed by that feature’s access rules; they are not automatically published as static app assets. An app’s code or publisher can still choose to disclose data. External APIs, embedded services and content selected by an app publisher have their own recipients and policies. Contact the publisher about its data use; contact us about Aqteron’s hosting or account processing.

6. Recipients and international processing

Data is accessible as needed to authorized people operating and supporting Aqteron, hosting and technical service providers, and email delivery providers. Transactional emails use Resend: the recipient’s address, message content and delivery metadata are transmitted for delivery. Data also goes to the AI services and other integrations you or an app publisher choose, and to visitors where you publish content. We disclose information to competent authorities when legally required.

International processing can occur. Resend states that its primary processing operations are in the United States and publishes a data-processing addendum containing transfer provisions and standard contractual clauses. AI providers and services chosen by app publishers may also process data outside the European Economic Area under their own arrangements. See the provider links below. For information about Aqteron’s relevant recipients, processing locations and applicable transfer safeguards, or a copy of those safeguards, contact contact@aqteron.com.

Payments and plan requests

Aqteron stores your account identifier and plan eligibility, assigned plan, access source, status and dates. Previously submitted plan requests retain their identifier, status and timestamps. Complimentary access does not require card details. For purchases processed by Paddle, Paddle handles payment data under its own privacy notice. Aqteron uses subscription and transaction references for access and support. Do not send card details to Aqteron support.

7. How long data is kept

• Account data and app content are kept while needed to operate your account, maintain your apps and versions, or resolve a request. You can request account or data deletion by email. Moving an app to the trash, unpublishing it and permanently deleting its data are different actions.
• Temporary ZIP transfers and access credentials have technical expiry periods. Expiration is distinct from deletion of the resulting app, versions or related records; revoking a connection stops its future access.
• Security, support, operation and audit records are retained according to the need to investigate failures or abuse, maintain service history, handle disputes and meet applicable legal obligations. There is no single automatic deletion period for all such records. A deletion request is assessed against those purposes and any required retention; we explain applicable exceptions.
• Recovery copies, where present, may persist until their backup cycle replaces them. Deletion from Aqteron does not remove copies already downloaded by visitors or retained by an independent provider.

8. Cookies and browser storage

The current public site loads its scripts, images and font from Aqteron and has no advertising or audience-measurement tracker enabled. Session cookies and the aqteron_ui_lang cookie / aq-minimal-language browser preference provide sign-in and the language you select. Language can be changed in the selector; sign out to end your session, or clear site data to reset stored preferences. There is no optional tracking choice to accept at present. If optional tracking is introduced, it must remain blocked until a separate choice, with equally simple acceptance and rejection and a way to change it.

An app publisher may add other storage, analytics or third-party services to its application and must explain them in its own notice and obtain consent where required. Optional browser permissions, including notifications, can be managed in browser or device settings.

9. Protection and automated checks

The service uses HTTPS, password hashing and account-scoped authorization. Connector access is limited by granted permissions and can be revoked. Automated ZIP validation, quotas and security checks can reject an upload or operation; the result is returned to you. Contact support if you believe a check is incorrect. No internet service can guarantee absolute security.

10. Your choices and rights

Subject to the conditions in applicable law, you can request access, correction, erasure, restriction and portability of your personal data, object to processing based on legitimate interests, and withdraw consent for processing based on consent. Withdrawal does not affect earlier lawful processing.

Write to contact@aqteron.com with your request and the account or app concerned. Do not send your password, access tokens or unnecessary identity documents. We may request proportionate information to verify your identity. We respond within one month; if a lawful extension is needed, we explain it within that month.

You may complain to the French data protection authority, CNIL, at cnil.fr, or to another competent supervisory authority. You do not have to contact us first to exercise that right.

11. Changes to this policy

The effective date appears at the top of this page. We update the policy when the service or its data processing changes and provide additional notice of material changes where required. This policy is available in English, French, German, Spanish, Italian, Polish and Russian. Questions about any version can be sent to contact@aqteron.com.