Privacy Policy of aethos
Last updated: 26 October 2026
This privacy policy explains how aethos processes personal data when you visit our website aethos.one or use the aethos platform ("Platform"). aethos is an infrastructure through which companies upload assets, issue and electronically sign licences, handle payments for their subscription and run scans. The Platform is intended exclusively for companies. We process personal data in accordance with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act (TKG 2021).
1. Controller
aethos, owner Michael Peklo (sole proprietor) Goldschlagstraße 3/22, 1150 Vienna, Austria VAT ID: ATU73975647 E-mail: office@aethos.one
We have not appointed a data protection officer because this is not mandatory under Art. 37 GDPR. Please direct data protection enquiries to the e-mail address above.
Supervisory authority: Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at
2. Our roles
- As controller, we process data that we need for account, contract, billing, security and legal obligations (Sections 3 to 5).
- As processor, we process content that our customers bring onto the Platform, for example uploaded images (including depicted persons or metadata), licence data and contact details of contractual partners. The respective customer is responsible for this. The content is visible only to the customer in the account and to contractual partners to whom the customer releases it in the course of a licence request. aethos does not publish or promote it. To provide the Platform, we pass content on to the sub-processors named in Section 5, for example images to Google when you start a scan, and image hashes and signature documents to our verification and signature service provider. Insofar as we decide on the purposes and means of processing ourselves in an individual case, we act as controller. We have a data processing agreement (DPA, Annex 1 of the GTC) in place with our customers for this. If you are a data subject and have questions about such content, please contact the respective customer first. You may also contact us, and we will forward your request.
- aethos is not a party to licence agreements between customers and does not enforce rights.
3. What data we process
3.1 Account and profile data
E-mail address, name, password (as hash only), optionally telephone number, biography, location, website, links to professional profiles and portfolio.
3.2 Company data
Company name, industry, company size, tax number and VAT ID, teams, names and e-mail addresses of invited team members and roles.
3.3 Billing data
Billing address, name, tax data, Stripe customer and subscription identifiers, payment references and amounts, credit bookings. Optionally bank name and IBAN, insofar as you provide them. We do not receive or store card data; it is processed directly by Stripe.
3.4 Identity verification (KYC)
To activate your account, we verify the identity of the authorised representative via Stripe Identity. This serves trust between users and the prevention of misuse and fraud. You transmit an official photo ID directly to Stripe. We do not see or store this document. We store only the result (for example "verified") and the session identifier. Stripe processes this data on its own responsibility and informs you separately in the verification process about its data processing. We do not require a biometric comparison (selfie).
3.5 Content and licence data
Uploaded files (for example images) with file names and metadata such as EXIF data, checksums and perceptual hashes for duplicate detection, licence requests, licences with details of territory, term, use, exclusivity, price and licence number (ULN), signed licence PDFs.
3.6 Scan data
The image you submit for a reverse image search and the search results (external links and pages), which we store in your account. We retrieve WHOIS and owner lookups live only at your request (click on "Details"); they are displayed but not stored. aethos provides the scan as a service, does not evaluate the results and displays them only in your account.
3.7 Cookies and local storage
Technically necessary cookies or local storage, for example for the session token of your login. We do not use any analytics, advertising or tracking services.
3.8 Technical data
We do not store IP addresses in our application database. Our infrastructure and payment providers may process connection data (for example IP address) in server logs for technical reasons. The purpose is the secure operation of the Platform and error analysis (Art. 6(1)(f) GDPR). Logs are generally stored only briefly, according to the providers' settings.
4. Purposes and legal bases
Purpose | Data | Legal basis |
|---|---|---|
Providing the Platform, managing the account, login | Account, profile | Art. 6(1)(b) GDPR (contract) |
Organisation, teams, seats | Company, account | Art. 6(1)(b) |
Subscription, credits, billing | Billing, company | Art. 6(1)(b) |
Identity verification to activate the account | KYC result | Art. 6(1)(b) and (f) (trust between users, prevention of misuse and fraud) |
Licence requests, signature, management of licences | Content, licence data, account | Art. 6(1)(b) |
Scan and duplicate detection | Scan data, content | Art. 6(1)(b) (function triggered by you) |
Transactional e-mails (signature links, confirmations) | Account, e-mail | Art. 6(1)(b) |
Transparency log (Merkle root hash) | no personal data | Art. 6(1)(f) (tamper-evidence), insofar as any personal reference exists |
Security, prevention of misuse, legal enforcement and preservation of evidence (e.g. retention of licences) | all necessary | Art. 6(1)(f) |
Retention obligations (accounting, tax) | Billing, payments | Art. 6(1)(c) |
If processing is based on your consent, you may withdraw it at any time with effect for the future.
5. Recipients and processors
Recipient | Purpose | Data | Location |
|---|---|---|---|
Supabase | Database, authentication, file storage, serverless functions | all Platform data | EU (Frankfurt) |
Stripe | Payments, subscriptions, invoices, identity verification (Stripe partly acts on its own responsibility) | Name, e-mail, billing address, tax data, payment data, ID data (directly with Stripe) | USA and worldwide |
Mailgun | Sending transactional e-mails | Name, e-mail | EU (Mailgun belongs to a US group) |
Google (Vision API) | Reverse image search when you start a scan | uploaded image | Google Cloud, worldwide |
Michael Gasparik, sole proprietor, Mittersteig 24/14, 1050 Vienna (sub-processor) | Operation of OpenSign (electronic signature) and the verification services (hashing, duplicate search, WHOIS and owner lookups on request) | Name, e-mail, signature documents, image hashes | Nuremberg, Germany, host: Hetzner Online GmbH |
GitHub | Publication of the transparency log | only a Merkle root hash and the number of contracts, no personal data | USA |
For visits to the website, Hostinger (hosting, Cyprus, EU) and Calendly (appointment booking, USA, only after clicking the link) are added, see Section 14. Further recipients are tax advisers, legal advisers, authorities and courts, insofar as necessary to comply with legal obligations.
6. Transfers to third countries
Insofar as data reaches countries outside the EEA (in particular the USA at Stripe, Google, GitHub and Calendly, and through group links of Supabase, Inc. and Mailgun Technologies, Inc.), we rely on the Standard Contractual Clauses of the European Commission and, where the provider is certified, on the EU-US Data Privacy Framework. You can obtain copies of the safeguards on request.
7. Cookies and local storage
On the Platform we use only technically necessary cookies or local storage, for example for your login session and the security of the Platform (Art. 6(1)(b) and (f) GDPR, Section 165(3) TKG 2021). Our website does not set any cookies. If you actively choose a language or close the language notice, we store this preference in the local storage of your browser (entry "aethos-lang") so that the website remembers your choice. This is strictly necessary to provide the function you requested (Section 165(3) TKG 2021), no consent is required, and you can delete it at any time in your browser settings. We do not use any analytics, advertising or tracking services, neither on the website nor on the Platform. Should we use such services in the future, we will obtain your consent beforehand.
8. Storage period
Data | Duration |
|---|---|
Account and profile data | Until the account is deleted, then deletion or anonymisation (30 days), insofar as no retention obligations apply |
Billing and payment data | Duration of the business relationship plus statutory period (in Austria generally 7 years) |
KYC result | Until the account is deleted |
Licences and signed documents | Term of the licence plus statutory retention and preservation of evidence |
Uploaded content and hashes | Until deletion by the customer or end of the contract |
Scan history | As long as the account exists or until deletion |
Merkle root hashes in the public transparency log | Unlimited (they contain no personal data) |
9. Security
We take appropriate technical and organisational measures. These include encryption in transit (TLS), encryption of stored data by our hosting providers, access restrictions at database level (row-level security), role-based permissions, signature verification for payment and signature webhooks (for example from Stripe) and publication of only a Merkle root hash in the transparency log. No method is completely secure; we adapt the measures continuously.
10. Your rights
Under the GDPR you have the following rights:
- Access (Art. 15)
- Rectification (Art. 16)
- Erasure (Art. 17)
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Objection to processing based on legitimate interests (Art. 21)
- Withdrawal of consent (Art. 7(3))
- Complaint to the data protection authority (Art. 77)
Send your request by e-mail to office@aethos.one. We respond without undue delay, at the latest within one month. In complex cases, we may extend this period by up to two further months and will inform you of this within the first month. There is currently no self-service function for this in the Platform. We may request proof to verify your identity.
11. Persons in content and scan results
If your personal data appears in uploaded content (for example as a depicted person or in metadata) or in scan results, we have not collected it directly from you. We process it on behalf of our customer, who is the controller. The source of the data is the respective customer or a publicly accessible website. Scan results (search results of the Google Vision API) are stored in the customer's account. We carry out WHOIS and owner lookups only at the customer's request, live, and do not store them; they serve display only. Individually informing data subjects about such lookups would involve disproportionate effort (Art. 14(5)(b) GDPR). As a safeguard, we do not store this data, use it for display only and make this policy publicly accessible. Please contact the customer or us for your rights; we will forward the request.
12. Obligation to provide data, automated decisions
Without account and billing data and without the identity verification, we cannot perform the contract and cannot activate an account. There is no exclusively automated decision-making, including profiling, under Art. 22 GDPR.
13. Target group
The Platform is intended exclusively for companies. This policy nevertheless applies to all natural persons whose data we process, for example contact persons, team members and sole proprietors.
14. Website aethos.one
This information applies in addition when you visit our website.
Hosting and server log files. When you access the website, our hosting provider automatically processes technical data: IP address, date and time of access, pages accessed, browser type and version, operating system, referrer URL and host name of the accessing computer. The purpose is the provision, security and optimisation of the website (Art. 6(1)(f) GDPR). The provider is Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, with which a contract under Art. 28 GDPR exists. Log files are stored only as long as necessary for operation and security.
Appointment booking via Calendly. The website contains a link to Calendly (Calendly LLC, 115 E Main Street, Suite A1B, Buford, GA 30518, USA). Only when you click the link does the Calendly page open, and the data you enter there is processed: name, e-mail address, company, requested appointment, time zone, answers to form questions and technical access data. Calendly processes it to book the appointment, send invitations and manage appointments. This may involve a transfer to the USA on the basis of Standard Contractual Clauses or the EU-US Data Privacy Framework, where Calendly is certified. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) and (f) (efficient appointment management). No data is transferred to Calendly merely by visiting our website.
Contact by e-mail. If you write to us, we process your information to handle your request (Art. 6(1)(b) or (f) GDPR). We store it as long as necessary for handling the request and a possible business relationship.
No web analytics, no external fonts. On the website we do not use web analytics tools (for example Google Analytics, Plausible or Matomo), marketing or retargeting pixels (for example Meta Pixel or LinkedIn Insight Tag) or externally loaded Google Fonts. If we change this, we will update this policy and obtain your consent beforehand.
15. Changes
We update this policy when processing or the legal situation changes. We notify material changes by e-mail or on the Platform.