Effective date: 7 September 2026.

Who we are and what this policy covers

Aethis is an unincorporated project based in Singapore. In this policy, “Aethis”, “we”, and “us” refer to the project and its operator, who determines the purposes and means of the public-site collection described here and acts as its data controller where that term applies. Our privacy contact is hello@aethis.io.

This policy covers aethis.io, our Aethis-operated forms at forms.aethis.io, early-access waitlist responses, contact enquiries, and Product & Engineering Updates subscriptions. Personal information means information that identifies you or can reasonably be linked to you.

This public-site policy does not replace a customer data-processing agreement or contractual privacy terms for future Aethis product deployments. The current public website has no user accounts, public comments, payments, or ecommerce.

Information we collect

Information you choose to provide

When you join the waitlist, contact us, or opt in to Product & Engineering Updates, you may provide your name, email address, organisation or company, tooling or technical context, and the contents of your enquiry, waitlist response, or message. We also receive information you send directly by email and any follow-up correspondence.

Our public forms use HeyForm software on forms.aethis.io, an Aethis-operated, self-hosted deployment. It is our form infrastructure, not a third-party HeyForm SaaS service. Form submissions are separate from website analytics; the website does not copy your responses into analytics events.

Providing information is voluntary, but we may be unable to respond, assess early-access interest, or send requested updates without the relevant contact details. Only provide information about another person if you are authorised to do so.

We do not intentionally collect special-category or sensitive personal information through public forms. Do not submit passwords, API keys, secrets, sensitive personal information, or unnecessary confidential customer information.

Request and security information

The website is a static Astro site delivered through Cloudflare. Cloudflare processes normal request and security metadata, including IP address, user agent, request time, and network or security information, to deliver and protect the site. Accessing our hosted forms and sending information over the internet also involves processing technical connection information by the infrastructure involved.

Privacy-restricted analytics

We use PostHog EU for pageviews and a small allowlist of categorical events: opening a conversion form, using its direct fallback link, and pricing-tier recommendations. These help us understand which pages and entry points are useful. Analytics may include page paths, browser and operating-system details, device type, screen dimensions, approximate IP-derived geographic information such as country or city, and temporary identifiers held in browser memory. This is not precise GPS location.

We do not create analytics person profiles or persist analytics identifiers in cookies or localStorage. DOM autocapture, session recording, surveys, and automatic exception capture are disabled. Query strings, URL fragments, referrers, and form contents are not intentionally sent in analytics events. These restrictions do not eliminate the technical connection metadata, such as IP addresses, that infrastructure providers receive when handling requests.

We do not currently use advertising trackers. See our Cookie Notice for related information about browser storage.

Why we use information

We use information for the following purposes:

Waitlist: assess early-access interest and technical fit, and communicate about your access request.
Contact enquiries: respond to questions, support the conversation, and address reports or concerns.
Product & Engineering Updates: send the product and engineering emails you separately opt in to receive.
Website operation: deliver content, understand use through restricted analytics, improve the site, and investigate security or abuse.
Administration and legal obligations: keep necessary correspondence and consent records, handle privacy requests, comply with applicable law, and establish or defend legal rights.

We limit collection and use to information reasonably needed for these purposes. If we propose a materially different use, we will provide the required notice and obtain consent where applicable law requires it.

Email choices and withdrawal

The updates subscription is separate from the waitlist. Joining the waitlist does not automatically subscribe you to marketing emails. We do not conduct SMS marketing.

You may withdraw marketing consent at any time through the unsubscribe facility in an updates email or by contacting hello@aethis.io. Withdrawal does not affect processing that was lawful before withdrawal. We may retain the minimum information needed to respect your opt-out and document your choice.

Opting out of marketing does not prevent us from responding to an enquiry you send or communicating about an access request you have made. You can also ask us to withdraw your waitlist request. We will explain any consequences of withdrawing consent needed for a requested service.

Security and retention

We use reasonable technical and organisational measures to protect personal information against loss, misuse, and unauthorised access, disclosure, alteration, or destruction. No internet transmission or storage system is completely secure, and we cannot guarantee absolute security. To report a security issue, use our responsible disclosure guidance.

We retain personal information only for as long as reasonably necessary for its purpose and applicable legal obligations. The relevant criteria include whether your enquiry or access request remains active, whether you still wish to receive updates, the need to record consent or an opt-out, and any legal obligation or dispute requiring preservation. Analytics and security information are retained according to their operational purpose and the applicable provider settings.

When information is no longer needed, we delete it or anonymise it. Lawfully retained records and residual backup copies may remain subject to restricted use and normal backup rotation. This policy does not impose a single retention period or promise that every copy will be deleted within a fixed number of days.

Disclosures and service providers

The current external services relevant to the public website are:

Cloudflare: website delivery, infrastructure, and request/security processing.
PostHog EU: the restricted analytics described above, using its EU ingestion service.

Our self-hosted HeyForm deployment is Aethis-operated form infrastructure. The infrastructure supporting the site, forms, and communications may process data as needed to provide those functions. We do not describe the HeyForm software itself as a third-party hosted form processor.

We may give access to people working on Aethis or professional advisers where necessary for the purposes in this policy, subject to appropriate confidentiality and access restrictions. We may disclose information when required by law, to respond to lawful requests, or where necessary to protect people, investigate abuse, or establish, exercise, or defend legal rights.

Aethis does not sell personal information or share it for cross-context behavioural advertising.

International transfers

Aethis and its providers may process data in Singapore, the European Union, the United States, and other locations in which infrastructure providers operate. A provider’s EU analytics service does not mean that every public-site data flow remains exclusively in the EU.

Where information is transferred internationally, applicable transfer requirements and safeguards apply. These include Singapore’s requirements for comparable protection and any applicable EU or UK requirements. We do not represent that a particular transfer mechanism applies to every provider or transfer. Contact us for information about safeguards relevant to your information.

Privacy rights and requests

Contact hello@aethis.io to ask about our handling of your information, request access or correction, request deletion where applicable, withdraw consent, object to processing, or raise a complaint. Include enough context for us to locate the relevant information, but do not send identity documents or sensitive information unless we explain why they are needed.

We may reasonably verify your identity or authority before disclosing or changing personal information. We handle valid requests within the periods required by applicable law, subject to lawful exceptions. If a request cannot be fulfilled in full, we will explain the relevant reason and any available next steps. Deletion requests are subject to lawful retention and normal backup rotation.

You may complain to an applicable data-protection authority without first contacting us. We will not unlawfully discriminate against you for exercising privacy rights.

Singapore Personal Data Protection Act

For personal data subject to Singapore’s Personal Data Protection Act (PDPA):

Notification and purpose limitation: we explain why we collect, use, or disclose data and limit processing to appropriate notified purposes, with consent or another basis permitted by law.
Access and correction: you may request access to personal data in our possession or control, information about its use or disclosure, and correction of errors, subject to the PDPA’s exceptions.
Protection and retention limitation: we take reasonable steps to safeguard data and cease retaining identifiable data when it is no longer needed for its purpose or a legal or business reason.
Transfer limitation: overseas transfers must satisfy applicable requirements for protection comparable to the PDPA.
Breach handling: we assess suspected breaches and notify the Personal Data Protection Commission and affected individuals when required by law.

Aethis has designated a Data Protection Officer (DPO). Contact the DPO at hello@aethis.io for PDPA requests and concerns. You can also contact Singapore’s Personal Data Protection Commission.

EU and UK data-protection rights

Where the EU GDPR or UK GDPR applies to our processing, our lawful basis depends on the purpose:

Consent: for optional Product & Engineering Updates and other processing for which consent is required.
Legitimate interests: for responding to general enquiries, managing early-access interest, operating and securing the website, and understanding its use through restricted analytics, where these interests are not overridden by your rights and interests and consent is not required.
Steps requested before a contract, or performance of a contract: only where the processing is necessary for such steps or a contract with you.
Legal obligations: where we must process or retain information to comply with applicable law.

Where applicable, you have rights to be informed, access your personal data, correct inaccuracies, request erasure, restrict processing, and receive eligible data in a portable format. You may object to processing based on legitimate interests and to direct marketing, and withdraw consent at any time without affecting prior lawful processing. These rights have conditions and exceptions under applicable law.

You may lodge a complaint with the relevant EU supervisory authority or, in the UK, the Information Commissioner’s Office.

U.S. state privacy rights

Where applicable U.S. state privacy laws give you rights in relation to our processing, you may request access to or confirmation of processing, correction, deletion, or a portable copy of your information, and exercise applicable opt-out rights. You may use an authorised agent where the law allows, subject to reasonable verification. Where a right to appeal a decision applies, contact us to request a review.

The categories and purposes relevant to the current public site are described above: contact identifiers and information you provide, internet/device activity and technical metadata, and related correspondence. We do not sell personal information or share it for cross-context behavioural advertising. Send rights requests to hello@aethis.io.

Children’s privacy

The public site is intended for people exploring Aethis for professional use and is not directed at children under 13. We do not knowingly collect their personal information. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action. Additional protections required by applicable law still apply.

Business transfers and third-party links

If the project or relevant assets are transferred, personal information may be transferred as part of that transaction, subject to applicable law, appropriate protections, and any required notice. A transfer does not remove the protections or choices required by law.

Links to external websites are provided for convenience. Those sites have their own privacy practices; review their policies when leaving our site. This policy does not govern their independent collection or use of information.

Changes and contact

We may update this policy as the public site or our practices change. We will publish the revised policy with a new last-updated date and provide additional notice or seek consent when required by applicable law.

For privacy questions, rights requests, or complaints, contact Aethis Privacy at hello@aethis.io.