Privacy Policy

Effective date: [EFFECTIVE DATE]

This Privacy Policy explains what information AEOS (Autonomous Executive Operating System, at getaeos.com) collects, how we use it, who we share it with, and the choices you have. AEOS is a product of LouChi AI ("we", "us"), a sole proprietorship based in Oakland, California, USA.

If you have a question, email us at getaeos@gmail.com.

1. Who this policy covers

This policy covers people who visit our website, create an AEOS account, or contact us. AEOS is a business tool. When you connect a business account such as Stripe, AEOS also processes information about your own customers. For that information, you decide what to connect and we process it on your behalf to provide AEOS to you.

2. Information we collect

Account information

Your email address, which you use to sign in. You can set up an account by email or by signing in with Google.
Your name, if you add it to your profile or it comes from your Google sign-in.
Sign-in and security records, such as when your email address was confirmed, and multi-factor authentication settings if you turn them on.

Organization information

Your organization's name and basic settings, such as industry, size, currency and time zone.
Who belongs to your organization and their role (for example owner, admin or member).
Your plan and subscription status.

Information you give AEOS to work with

Genesis answers. Your business description and details such as industry, monthly revenue and team size, and the blueprint AEOS generates from them.
Chat history. The messages you send to the AEOS assistant and its replies.
Memory. Notes, goals and facts AEOS saves to remember context about your business between sessions. Short-term memories expire automatically after 7 days.
Contact form messages. Your name, email address, subject and message when you contact us through the website.

Connected Stripe account

To connect Stripe, you give AEOS a Stripe restricted key (it starts with rk_). AEOS asks you to grant it Read access only. AEOS uses the key only to read data; it does not create, change or delete anything in your Stripe account. AEOS cannot check that a key has no write permissions, so please grant Read access only.

Using that key, AEOS reads and stores:

Account: your Stripe account ID and default currency.
Customers: customer IDs, names and email addresses, and whether they are active.
Subscriptions: status, prices, plan items, discount amounts, renewal and cancellation dates, and cancellation reason.
Invoices: status, amounts due and remaining, currency, invoice number, and created and due dates.
Charges and refunds: payment amounts, dates and outcomes, used to count failed payments.
Payment methods (if you grant this permission): the card brand, the last four digits and the expiry month and year. AEOS never receives or stores full card numbers or security codes.
Coupons, prices and products (if you grant these permissions): discount terms, price amounts and intervals, and product names.

AEOS also stores the results it calculates from this data, such as revenue metrics, Leak Scan findings (which can include your customer's name, the amount and the reason it was flagged), and recovery tracking (for example, when you marked a recovery email as sent and whether the invoice was later paid).

Free Leak Scan

If you run the free Leak Scan:

AEOS does not store your customers' names or email addresses.
AEOS deletes its copy of your Stripe key as soon as the scan finishes, and in any case no later than 7 days after you connect.
The detailed records and findings from a free scan are deleted 30 days after you connect, unless you upgrade. AEOS keeps the headline total and the per-category totals.
When you connect a live Stripe account for the free scan, AEOS records a one-way fingerprint of that account (not the account ID itself), together with the internal ID of the first organization that used it, the mode (live) and the time. AEOS keeps this record indefinitely, including after the organization is deleted, to prevent repeat free scans. Test-mode Stripe accounts are not recorded.

Your own AI provider key (BYOK)

On a paid plan, you can connect your own Anthropic API key. AEOS stores the key encrypted, along with the model you selected and a fingerprint used to recognize the same key without decrypting it.

Usage and technical information

Usage records. AEOS records how much you use metered features, such as AI requests, the model used, token counts and estimated cost, to apply plan limits and budgets.
Security and audit logs. AEOS records important account and organization actions. These records can include your IP address and browser user agent.
IP address. We use IP addresses to limit abuse, for example by rate-limiting sign-up, contact form and scan requests.

Cookies and similar technologies

AEOS uses only the cookies it needs to work:

Sign-in cookies set by our authentication provider (Supabase) to keep you signed in.
An active-organization cookie (aeos-active-organization) that remembers which organization you are working in.

AEOS also uses your browser's local storage to remember small interface choices, such as whether you have already dismissed a welcome message.

AEOS does not use advertising cookies and does not currently use third-party analytics or tracking tools.

3. How we use information

We use information to:

Create and secure your account and organization.
Provide AEOS features, including Genesis, the assistant, CFO and revenue views, signals, weekly briefings, Leak Scan and recovery drafts.
Sync your connected Stripe data, generally once a day, and when you run a sync or scan.
Process your subscription payments and manage your plan.
Apply plan limits, AI budgets and abuse protection.
Send account and security emails, such as sign-in links and account notices.
Respond to your messages and support requests.
Keep AEOS secure, investigate problems, and meet legal obligations.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

4. How AEOS uses AI

AEOS features are powered by Anthropic's Claude models. When you use an AI feature, AEOS sends the information that feature needs to Anthropic to generate a response. Depending on the feature, this can include your messages, your Genesis answers, saved memory, organization details, and metrics and other information derived from your connected Stripe data, which may include customer names.

Platform AI. By default, AEOS sends these requests using our own Anthropic account.
Your own key (BYOK). If you connect your own Anthropic key, AEOS sends these requests using your key, and your agreement with Anthropic also applies.
Recovery email drafts. When you ask AEOS to improve a recovery email with AI, AEOS sends only a version with placeholders. Your customer's name, your business name and email addresses are not sent.

Anthropic processes these requests under its commercial API terms. We do not use your data to train AI models. Please review Anthropic's terms and privacy policy for how Anthropic handles API data.

AI output can be wrong. See our Terms of Service for more.

We share information only with service providers that help us run AEOS, when you ask us to, or when the law requires it. Our service providers are:

Supabase — database, authentication and sign-in cookies.
Vercel — application hosting and scheduled jobs.
Stripe — subscription payments for AEOS plans. Stripe collects your payment details directly; AEOS does not receive your full card number. Separately, AEOS reads data from your own Stripe account using the key you provide.
Anthropic — AI models that power AEOS features.
Resend — sending sign-in links and account and security emails.
Upstash — temporary data used for usage limits and request de-duplication.
Google — only if you choose to sign in with Google.

We may also share information:

If required by law, or to protect the rights, safety and security of our users, the public or AEOS.
As part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your information.

6. How we protect information

Encryption of keys. Stripe keys and AI provider keys are encrypted with AES-256-GCM before they are stored, and are tied to your organization so they cannot be opened for another organization. Keys are never sent back to your browser.
Organization isolation. Our database uses row-level security so members can only access their own organization's data. Sensitive tables, such as stored Stripe customer and payment-method records, can only be accessed by AEOS servers, not directly from the browser.
Encryption in transit. AEOS is served over HTTPS.
Key removal. When you disconnect Stripe, AEOS deletes its copy of your key and stops syncing. If Stripe tells us a key is no longer valid, AEOS deletes its copy. You should also expire the key in your Stripe dashboard to fully revoke access.
Imported data removal. When you disconnect Stripe, you can also delete the data AEOS imported from that connection. This option is selected by default. See Section 7.

No system is perfectly secure. If we learn of a security incident that affects your personal information, we will notify you as required by law.

7. How long we keep information

Account, organization, chat, memory and usage data: for as long as your account is active, unless you delete it sooner. You can delete chat history and individual memories inside AEOS.
Short-term memories: 7 days.
Stripe key: until you disconnect, until Stripe rejects it, or, for a free scan, until the scan finishes (at most 7 days).
Imported Stripe data: until you delete it. When an owner or admin disconnects Stripe with "Disconnect and delete imported data" (selected by default), AEOS deletes the customer data imported through that connection: customer names and email addresses, subscriptions, invoices, payments and refunds, card brand, last four digits and expiry, discounts, prices, Leak Scan findings and recovery tracking. If a connection was disconnected with its history kept, an owner or admin can delete that history later under Settings, Integrations. If a scan or sync is still running at that moment, AEOS still deletes the key right away and asks you to retry the data deletion a minute later.
What AEOS keeps after deleting imported data: totals that identify no customer, such as daily revenue figures, customer counts and Leak Scan headline totals, so your history charts keep working. Customer names are removed from those totals. AEOS also keeps a record that your organization used its one free Leak Scan, the one-way fingerprint of any live Stripe account that used the free scan (kept indefinitely to prevent repeat free scans), and a security log entry recording that the data was deleted, with row counts but no customer details. AI signals, weekly briefings and suggested actions are deleted, because they can mention customers by name; they are created again from any connection you still have.
Free Leak Scan details: 30 days after you connect, unless you upgrade. Totals are kept.
Contact form messages and security logs: for as long as needed to keep AEOS secure, investigate misuse and meet legal obligations.

Deleting your organization or your account

Organization owners can delete their organization under Settings, Account & Data. An active AEOS subscription must be canceled in the billing portal first. Deleting an organization deletes its connections and all imported data, metrics, Leak Scan results, signals, briefings, Genesis blueprints, chat history, memories, AI provider keys and team memberships.
Other members can leave an organization there. Leaving removes only their membership.
Your login. When you delete or leave your last organization, you can choose to also delete your login. It is not deleted unless you ask. AEOS then deletes your sign-in account, profile, and the memories and chat messages tied to you. It also deletes used or expired sign-up links that contain your email address.
What AEOS keeps after deleting an organization: records of AEOS's own billing and usage for the organization (such as the plan, subscription status, Stripe billing identifiers and AI usage counts) as needed for accounting, tax and dispute handling; a record that the organization used its one free Leak Scan; the one-way fingerprint of any live Stripe account that used the free scan, with the first organization's internal ID, the mode and the time, kept indefinitely to prevent repeat free scans (it is not covered by the retention period below); and the security log of actions taken in the organization, showing what happened, when, and an internal user ID. AEOS removes the details of each security-log entry, including IP addresses, browser user agents, AI explanations and any text you typed. The organization's name is erased. Billing notification records, which can contain an email address, are deleted. Payment records also remain with Stripe under Stripe's own policies.
What AEOS keeps after deleting your login: security-log entries for actions you took in organizations that still exist, so their owners keep an accurate history. These entries keep the action, the time and an internal user ID. AEOS removes your IP address, browser user agent, AI explanations, and text you typed, such as Genesis refinement instructions and blocked chat phrases. AEOS also keeps a one-way hashed form of your email address that is used only to rate-limit sign-up requests.
How long: these retained records are kept only as long as needed for accounting, tax, security and dispute purposes, or as the law requires.

You can also email getaeos@gmail.com to ask us to delete your information.

8. Your choices and rights

Depending on where you live, you may have the right to:

Know what personal information we hold about you and get a copy of it.
Correct inaccurate information.
Delete your information.
Object to or restrict certain processing.
Receive your information in a portable format.
Withdraw consent where we rely on it.

To make a request, email getaeos@gmail.com. We will verify your request, for example by confirming it comes from the email address on your account, and respond within the time required by law. We will not treat you differently for exercising your rights.

If your request is about information in a business's connected Stripe account (for example, you are a customer of an AEOS user), please contact that business. We will help them respond.

California residents

If you live in California, the California Consumer Privacy Act (CCPA) gives you the rights listed above, including the right to know, delete and correct personal information, and the right not to be discriminated against for using these rights. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information to infer characteristics about you. An authorized agent may submit a request on your behalf with your written permission.

The categories of personal information we collect are described in Section 2. We collect them from you, from your connected accounts, and automatically when you use AEOS, for the purposes in Section 3, and share them with the service providers in Section 5.

People outside the United States

AEOS is operated from the United States, and our service providers may process information in the United States and other countries. Our database is hosted in the United States (Amazon Web Services, US East). If you are in the European Economic Area, the United Kingdom or Switzerland, we process your information to provide the service you requested (contract), for our legitimate interests in securing and improving AEOS, to meet legal obligations, and with your consent where required. You may also complain to your local data protection authority.

9. Children

AEOS is for businesses and is not intended for anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact getaeos@gmail.com and we will delete it.

10. Changes to this policy

We may update this policy. If we make material changes, we will notify you by email or in AEOS before they take effect. The effective date at the top shows when this policy last changed.

11. Contact us

LouChi AI
Oakland, California, USA
Email: getaeos@gmail.com