Document Version: v1.1-20260803
Drafted: June 11, 2026
Revised: August 3, 2026
Applicable Entity: Shanghai Aether Heart Technology Co., Ltd
Effective Date: June 12, 2026
Last Updated: August 3, 2026
Introduction
Shanghai Aether Heart Technology Co., Ltd (“we,” “us,” or “our”) attaches great importance to the security of users’ personal information and privacy and strictly complies with the Personal Information Protection Law of the People’s Republic of China, the Data Security Law, the Cybersecurity Law, and other applicable laws and regulations.
This aeloon Privacy Policy explains how we collect, use, store, share, entrust the processing of, delete, and protect personal information, as well as the privacy rights available to users, when providing our multi-agent AI services, memory system, scheduled tasks, local knowledge bases, web search, file processing, Skill ecosystem, credit-based paid services, and all other platform services.
By registering for, logging in to, or using any platform service, you acknowledge that you have read, understood, and agreed to this Privacy Policy. This Policy applies to all aeloon platforms, clients, and service scenarios. If a service-specific privacy notice conflicts with this Policy, the more specific notice shall prevail.
Chapter 1 General Provisions
1.1 Legal and Regulatory Basis
This Policy is formulated in accordance with the Personal Information Protection Law of the People’s Republic of China, the Data Security Law of the People’s Republic of China, the Cybersecurity Law of the People’s Republic of China, and supporting compliance rules issued by competent cyberspace, public-security, and market-regulation authorities.
1.2 Personal Information Controller
Shanghai Aether Heart Technology Co., Ltd is the sole personal information controller for the aeloon platform. We independently determine the purposes, methods, and scope of processing and bear the corresponding legal responsibilities for personal information protection and data-security compliance.
1.3 Scope
This Policy applies to aeloon’s mobile, desktop, and web clients; account system; AI agent services; memory system; scheduled tasks; local knowledge bases; web search; file processing; Skill marketplace; credit-based paid services; customer support; after-sales service; security controls; and all other platform service scenarios.
1.4 Policy Updates
We may amend this Policy in response to changes in laws or regulatory policy, product development, or improvements in data-processing practices. Routine updates will be announced through the platform. Material changes involving the scope of collection, purposes of use, sharing rules, or users’ core rights will be announced at least 15 days in advance, and renewed consent will be obtained where required. Continued use of the services constitutes acceptance of the revised Policy.
Chapter 2 Personal Information We Collect
2.1 Information You Provide
We collect the following information that users voluntarily submit, enter, or upload only for the relevant service and in accordance with the principle of minimum necessity.
| Data Type | Information | Purpose |
|---|---|---|
| Account information | Mobile number and securely encrypted account password | Registration, login verification, identity authentication, and account security |
| Profile information | Optional information such as nickname and profile image | Personalized account display, user identification, and service adaptation |
| Credit and payment information | Credit purchases, order number, payment status, and transaction records; we do not store full bank-card numbers, payment passwords, or similar sensitive credentials | Credit fulfillment, order management, refunds, financial compliance, and invoicing |
| Customer-support communications | Inquiries, feedback, complaints, after-sales communications, and contact details supplied by the user | Troubleshooting, after-sales support, dispute resolution, and service improvement |
2.2 Information Collected Automatically
When users access platform services, the system automatically collects necessary, non-sensitive data to operate the services, manage security risks, and improve the experience.
| Data Type | Information | Purpose |
|---|---|---|
| AI conversation data | Prompts, instructions, uploaded files, AI responses, conversation context, and task-execution records | Providing AI services, maintaining conversation continuity, carrying out instructions, and delivering functionality |
| Memory-system data | Preferences, project context, feedback, references, memory tags, and other persistent memory data | Personalization, cross-session context, and interaction improvements |
| Scheduled-task configuration | Reminder rules, scheduled-task instructions, notification preferences, and execution frequency | Scheduled reminders and automated task execution |
| Wiki data | Imported documents, URLs and text, generated Wiki pages, retrieval records, and knowledge-graph configuration | Building, searching, and managing local knowledge bases |
| Web-search activity | Search terms, destination URLs, and summaries extracted from pages | Online information retrieval and research |
| Generated-output data | Reports, presentations, data files, documents, and other generated content | Fulfilling instructions, delivering outputs, and enabling access to history |
| Operational logs | Feature interactions, Skill calls, page visits, error logs, and feature-call records | Troubleshooting, optimization, product development, security audits, and anomaly detection |
| Device and environment data | Device model, operating system, application version, and environment parameters | Compatibility, device-risk detection, security, and bug fixes |
| Network data | IP address, network type, access region, and connection status | Account-security risk controls, suspicious-login prevention, regional adaptation, and fraud prevention |
2.3 Skill Ecosystem Data
When a user accesses the Skill ecosystem, the platform records necessary data such as Skill installation history, invocation time, permissions granted, interaction metadata, and task-execution records. This data is used only for service operation, permission control, and security audits and is processed under the principle of least privilege. Third-party developers are independently responsible for their Skills’ data-processing activities, which are governed by the applicable Skill privacy rules.
2.4 Information We Do Not Proactively Collect
By default, the platform does not proactively collect precise geolocation, biometric information, contacts, data from other applications, personal information of children under 14, or similar sensitive data. We will not collect or use such information without separate, explicit authorization or a mandatory legal requirement.
Chapter 3 Core Processing Principles and User Commitments
3.1 Core Compliance Principles
All processing follows the principles of lawfulness, legitimacy, necessity, and good faith, as well as data minimization, purpose limitation, openness, and transparency. We do not collect or use user data beyond the stated scope.
3.2 Commitments for Conversations and Personal Data
- AI conversations and memory data are used primarily for immediate responses, task execution, context continuity, personalization, and delivery of core services.
- If de-identified conversation data is to be used for model improvement, algorithm development, or product upgrades, we will obtain separate consent and provide a privacy control that the user may disable at any time.
- Conversation and memory data will never be used for targeted advertising or precision marketing.
- Personnel may access only the necessary data for troubleshooting, security controls, user appeals, or compliance checks, and only after internal approval under access controls and complete audit logging. Access remains subject to minimum necessity.
- Users may manually delete conversations, clear history, and manage memory entries, retaining control over their personal data.
3.3 No Sale of Personal Information
We never sell, resell, or transfer for consideration any personal information, conversation data, memory data, usage data, or private data. Without the user’s separate and explicit authorization, we will not disclose or share private information with unrelated third parties.
3.4 Data Isolation
Technical, permission-based, and account-level isolation keeps the data of different users, Skills, and Wikis separate and reduces risks of unauthorized access, data commingling, and data leakage.
Chapter 4 How We Use Personal Information
We use personal information only for the lawful purposes disclosed in this Policy:
- Account security: Registration, login verification, authentication, suspicious-login prevention, and security risk controls.
- Core service delivery: AI conversations, personalized memory, task execution, Skill invocation, knowledge retrieval, and other services using conversation, memory, Wiki, operational, device, and network data.
- Product improvement: Troubleshooting, performance improvements, feature upgrades, and model iteration after de-identification or with user consent.
- Paid-service fulfillment: Credit orders, usage records, refunds, invoices, and statutory financial records.
- Customer support: Responding to inquiries, complaints, feedback, and after-sales issues.
- Compliance and risk management: Preventing abusive registration, prohibited use, cyberattacks, and infringement, and cooperating with lawful regulatory and judicial inquiries.
- Service notifications: Necessary notices about updates, changes to benefits, security, expiring credits, and compliance matters.
Chapter 5 Sharing, Entrusted Processing, and Legal Disclosure
5.1 General Principles
We do not share personal information indiscriminately. Sharing occurs only with user authorization, where necessary to provide services, or where legally required, and is limited, de-identified where appropriate, controlled, and traceable.
5.2 Permitted Sharing
- Separate user authorization: Sharing specifically and separately authorized by the user is limited to the authorized scope.
- Necessary service providers: De-identified data may be shared with compliant cloud, AI-model, operations, and payment providers solely for service delivery, maintenance, or payment fulfillment.
- Third-party Skills: When a user chooses a third-party Skill, necessary interaction data may be shared with its developer within the user-authorized scope solely to provide that Skill.
- Mandatory legal disclosure: Information may be disclosed as required by law, judicial decisions, or lawful administrative enforcement.
- Corporate transactions: In a merger, division, acquisition, or asset transfer, data may transfer with the business; the recipient must assume equivalent privacy obligations.
5.3 Entrusted Processing
Where processing is entrusted to a third party, we enter into strict confidentiality and data-processing agreements defining scope, duration, and responsibility. Processors may not use, disclose, or transfer data beyond the agreed scope, and their compliance is monitored.
5.4 Prohibited Sharing
Except as expressly stated, we do not sell, lease, or publicly disclose personal information to marketing organizations or unrelated third parties, or use it for unrelated advertising or targeted marketing.
Chapter 6 Retention, Deletion, and Security
6.1 Retention Periods
Data is retained only for the period necessary to provide services or required by law and is removed when that period ends:
- Conversation data: Users may delete it manually. Otherwise it remains while the account is active to maintain continuity and is deleted as required after account deletion.
- Memory data: Users may view, edit, and delete memory entries at any time; remaining data is deleted after account deletion.
- Wiki data: Imported documents and generated pages may be deleted at any time and are deleted after account deletion.
- Scheduled tasks: Users may modify or delete them at any time; remaining configurations are deleted after account deletion.
- Generated outputs: Users may manage and delete them; remaining outputs are deleted after account deletion.
- Basic account data: Retained while the account exists, then anonymized or deleted as required.
- Order and compliance data: Retained for the statutory period required by tax, finance, and cybersecurity law—generally at least five years—then destroyed.
- Risk-control logs: Retained for security audits and incident tracing, then deleted when the retention period expires.
6.2 Data Following Account Deletion
After account deletion, deletable data will be removed promptly and account information deleted within the required period. Data subject to statutory retention is retained only as required and destroyed when that period expires.
Self-service account deletion is not currently available. To request deletion, email support@aetherheart.com. We will process the request after verifying identity.
6.3 Security Measures
We employ industry-standard safeguards, including:
- TLS encryption in transit and AES-256 encryption at rest.
- Tiered permissions and least-privilege access, with logged and auditable employee access.
- Regular security testing, vulnerability remediation, compliance reviews, and third-party assessments.
- An incident-response process to contain, investigate, remediate, report, and notify users of security incidents as required.
6.4 Security Risk Notice
Internet transmission involves inherent risks. We use reasonable efforts to protect data but cannot eliminate every network risk. Users must safeguard account information and take care to prevent disclosure.
Chapter 7 Your Privacy Rights
Subject to the Personal Information Protection Law, users may exercise the following rights through platform features or official channels.
7.1 Right to Be Informed, Access, and Obtain a Copy
Users may review details of collection, use, sharing, and retention in account settings and may contact support for a copy of personal data. Privacy-information displays will be expanded progressively.
7.2 Right to Correction and Supplementation
Users may correct incomplete or inaccurate information in account settings or request assistance from customer support.
7.3 Right to Deletion
Users may delete conversations, memories, Wiki pages, output files, and other personal data. Users may request deletion of all personal information where processing violates law, exceeds authorization, services end, purposes have been fulfilled, or other statutory circumstances apply.
7.4 Right to Delete an Account
Users may request account deletion through support@aetherheart.com. After deletion, we will remove data as required and cease associated processing.
7.5 Right to Withdraw Consent
Users may withdraw non-essential authorizations through permission settings. Relevant processing will cease promptly; withdrawal does not affect the lawfulness of earlier processing.
7.6 Right to Appeal and Lodge a Complaint
Users who believe their privacy rights have been infringed may appeal by email. We will investigate and respond within 15 business days. Users may also complain directly to competent cyberspace or regulatory authorities.
7.7 Response Time
After identity verification, we will respond to a valid rights request within 15 business days.
Chapter 8 Children’s Privacy
8.1 Age Restrictions
Core services are intended for adults. Children under 14 may not use the platform. Users aged 14–17 may use it only with guardian consent and supervision.
8.2 Protection Measures
We do not proactively collect sensitive personal information from minors. If such data is obtained inadvertently, we will promptly delete it, close the corresponding account, and notify the guardian where possible. Minors’ conversation data is retained for a shorter period by default and is not used for model training or commercial optimization.
8.3 Guardian Rights
Guardians may request access, correction, deletion, account closure, or withdrawal of consent on behalf of a minor through the official privacy email address.
Chapter 9 Third-party Services
9.1 Independent Privacy Practices
Integrated third-party AI models, Skills, payment services, and other services are independently operated. Their processing is governed by their own privacy policies, and those providers independently bear the corresponding compliance responsibilities.
9.2 Platform Responsibilities
We screen third-party providers and conduct basic compliance reviews, but do not assume joint liability for a third party’s unlawful processing. Before using a third-party service, users should review its privacy rules and grant permissions cautiously.
Chapter 10 Disclaimers and Supplementary Provisions
10.1 Privacy-related Disclaimers
To the extent permitted by law, the platform is not responsible for loss or disclosure caused by:
- A user disclosing account credentials, passwords, or verification codes, or voluntarily authorizing a third party.
- A user’s prohibited operation or improper use of platform services.
- Force majeure, cyberattacks, hacking, or other security events beyond the platform’s control.
- Lawful disclosure to judicial or administrative authorities.
- Vulnerabilities or unlawful conduct of third-party services.
10.2 Effect of This Policy
This is the officially effective privacy-compliance document for the aeloon platform. Matters not addressed here are governed by applicable national laws and regulations.
10.3 Contact Us
Privacy requests and complaints: legal@aetherheart.com
Customer support: support@aetherheart.com
Address: Room 4311, Tower A, Zhangjiang Science Gate, 1819 Zhongke Road, Pudong New Area, Shanghai, China
Response time: We will investigate and respond within 15 business days.
This Policy takes effect on the date it is published. Continued use of the platform constitutes acknowledgment of and voluntary compliance with its terms.