Privacy Policy

01Who we are

This Privacy Policy explains how Aetheron Solutions ("Aetheron", "we", "us", or "our") handles personal data across our agentic AI platform and the products built on it, including Arctiq AI, Eonix, FinOptic, and LegitChain, along with any WhatsApp Business Platform messaging we operate on behalf of our customers.

Aetheron is based in Mayurbhanj, Odisha, India. For the personal data of our own account holders and website visitors we act as a Data Fiduciary. For the lead and contact data our business customers upload and process through our platform, we act as a Data Processor on their instructions.

02What data we collect

We collect three broad categories of data:

Account and workspace data

• Name, business email, phone number, and login credentials.
• Billing details, GSTIN, and organization configuration.
• Workspace settings, team roles, and the agents, templates, and channels you configure.

Customer and lead data (processed on behalf of business customers)

• Contact records such as names, phone numbers, and email addresses uploaded or captured by our customers.
• WhatsApp and messaging content exchanged between a business and its opted-in contacts.
• Interaction metadata such as message status, timestamps, and conversation state.

Usage and technical data

• Credit and usage metering, feature interactions, and audit logs.
• IP address, device and browser information, and diagnostic logs.
• Cookies and similar technologies as described in Section 11.

03Lawful basis and consent (DPDP Act, 2023)

We process personal data on the basis of consent or on the legitimate uses permitted under India's Digital Personal Data Protection Act, 2023. Where consent is the basis, it is obtained through clear notice and can be withdrawn at any time.

Our business customers are responsible for obtaining valid consent from their own leads and contacts before messaging them through our platform. Marketing communications are sent only with consent, and every recipient can opt out at any time.

04Our role: Processor vs. Fiduciary

We are the Data Fiduciary for account-holder and website-visitor data — we decide how that data is used to run our business.

We are a Data Processor for the lead data and WhatsApp message content inside a customer's workspace — we process it only on that customer's documented instructions. If you are an end customer who interacted with a business using our platform, please direct data requests to the business you communicated with; we will support them in fulfilling your request.

05How we use data

• To operate, maintain, and improve the platform and its AI agents.
• To meter credits, process payments, and manage subscriptions.
• To secure the service, prevent abuse, and investigate incidents.
• To provide customer support and service communications.
• To comply with legal and regulatory obligations.

06WhatsApp data and Meta policy

Messaging is delivered through the WhatsApp Business Platform and the WhatsApp Cloud API, and is also governed by Meta's WhatsApp Business Messaging Policy and Meta's terms. When you connect a WhatsApp Business number to our platform:

• WhatsApp message content is handled solely to deliver the messaging service to the controlling business customer and its opted-in contacts.
• Businesses must use approved message templates and honor opt-outs and STOP requests.
• We do not repurpose WhatsApp content for advertising.
• WhatsApp content is shared with third parties only as needed to deliver the service (for example, Meta as the messaging provider).
• Meta may rate-limit, reject templates, or restrict numbers based on quality ratings and policy compliance.

07Sharing and disclosure

We share personal data only with:

• Sub-processors that help us run the service — hosting and infrastructure, WhatsApp Business Solution Providers, payment processors, and transactional email providers.
• The controlling business customer whose workspace the data belongs to.
• Authorities where disclosure is required by law or valid legal process.

Our current sub-processor list is available on request. We do not sell personal data.

08Your rights as a Data Principal

Subject to the DPDP Act, 2023, you have the right to:

• Access a summary of your personal data and how it is processed.
• Request correction or completion of inaccurate or incomplete data.
• Request erasure of your personal data.
• Nominate another individual to exercise your rights.
• Withdraw consent and seek grievance redressal.

We may need to verify your identity before acting on a request. To exercise these rights, contact us using the details in Section 14.

09Data retention and security

Account data is retained while your account is active plus a period required for legal and compliance obligations. Lead and message data is retained per the customer's instructions and deleted on termination of their workspace, subject to a short backup-expiry window of 30 days.

Our security measures include tenant isolation, TLS encryption in transit, encrypted secrets at rest, least-privilege access controls, signed webhooks, audit logging, and a breach-notification process consistent with applicable law.

10Cross-border transfer

Personal data is primarily stored in India. Where a sub-processor stores or processes data outside India, we do so in accordance with the DPDP Act, 2023 and under contractual safeguards that require an equivalent standard of protection.

11Cookies

We use strictly necessary cookies for authentication and security, and — with your consent — analytics cookies to understand and improve how the platform is used. You can control cookies through your browser settings.

12Children

Our services are not directed at children. We do not knowingly process the personal data of children except as permitted under the DPDP Act, 2023.

13Changes to this policy

We may update this policy from time to time. Material changes will be notified through your dashboard or by email, and the "Last updated" date at the top of this page will be revised.