Personal data processing and privacy policy

1. Controller and channels

The controller is Diego Fernando Martinez, an independent professional. Registered address: Carrera 73 # 20A-40, Medellín, Antioquia, Colombia. Email: diferez676@gmail.com. Phone: +57 304 274 9571.

This policy covers the Aether store demo, accounts, cart, sandbox checkout, forms, and the Aether Assistant. You may submit privacy questions, complaints, access, correction, withdrawal, or deletion requests by email, phone, or the contact form.

2. Information processed

• Account: Clerk identifier, name, email, session status, and roles required for authentication.
• Demo shopping: cart identifier, products, favorites, coupons, amounts, email, sandbox Stripe references, order status, and technical events. Aether does not receive or store full card numbers, CVCs, or bank credentials.
• Contact: name, email, optional company, subject, message, language, and authorization evidence.
• Assistant: submitted text, response, language, current page or product, strictly necessary cart context, conversation identifier, and a hash of the session identifier. Obvious email, phone, and card-like patterns are replaced before storage, but this protection is not infallible.
• Device: language, theme, cart and favorites in the browser; temporary cart and conversation identifiers; plus IP, user agent, and security logs infrastructure providers may generate.

3. Purposes and authorization

• Operate the demo, authenticate accounts, maintain cart and favorites, run sandbox checkout, and display test orders.
• Reply to messages, retain authorization evidence, and handle privacy requests.
• Let the Aether Assistant search products, answer store questions, and modify the cart when instructions are sufficiently clear.
• Prevent abuse, fraud, cross-user access, operational errors, and excessive assistant use.
• Form submission and the checkbox shown before the assistant's first message provide prior informed authorization for those purposes. Data is not sold or used for advertising, and no legal or credit decision is automated.

4. Aether Assistant and Gemini

Chats are stored. Aether keeps redacted messages and responses in Cloudflare D1 to restore context. The original message may be sent to the Google Gemini API to classify intent, extract a search, or draft a limited reply. Do not include passwords, payment-card data, identity documents, health information, or other sensitive data.

The assistant can be wrong and is not a substitute for human advice. Cart actions are recorded in a security audit trail. “Delete chat” requests server-side deletion and then removes the tab's conversation identifier.

5. Processors and international transfers

These providers may process information outside Colombia under their terms, security measures, and data-processing arrangements. They receive only the information needed for their function.

• Cloudflare: hosting, security, Workers, and D1 database.
• Clerk: authentication and account management.
• Stripe: sandbox checkout and test payments only.
• Google Gemini: processing of some assistant queries.
• Sentry: minimized error and performance diagnostics. Session replay is disabled.
• Resend: delivery of contact messages when configured.

6. Retention

• Chats: 30 days from conversation creation unless deleted sooner. Automated cleanup removes expired messages and metadata.
• Assistant action logs and aggregate usage metrics: up to 12 months for security and diagnostics; they do not contain the full message text.
• Sentry technical events: for the retention period configured for the project, exclusively for diagnostics and security.
• Contact messages and authorization evidence: up to 12 months unless a legal duty or active claim requires longer retention.
• Server-side anonymous carts: cleaned after 90 days of inactivity. Local cart, favorites, theme, and language remain until you clear browser data.
• Account, associated favorites, and addresses: while the account remains active or until a valid request. Sandbox orders and events remain for the demo's operational life or as needed for security, audit, or a claim.

7. Rights and procedure

Email diferez676@gmail.com with your name, requested right, and enough information to verify your identity. Colombian consultation and complaint deadlines apply where relevant.

• Know, access, update, correct, and request a copy of your data.
• Request proof of authorization and learn how data was used.
• Withdraw authorization or request deletion where applicable, without affecting legal duties or essential anti-fraud records.
• Complain to Colombia's Superintendence of Industry and Commerce after the direct process where required.

8. Children, security, and changes

Aether is not directed to children and does not intend to collect their data. Controls include minimization, validation, access control, encrypted transport, cart tokens, usage limits, and sensitive-pattern redaction. No system is infallible.

Material changes will be published here with a new version and renewed authorization will be requested when necessary.