Privacy Policy

This policy covers Aether, operated by Buildaether Inc. It applies to the firms that use Aether and the people at those firms who sign in. It does not cover a customer firm’s own clients directly — your firm is the one with a relationship to its clients, and your firm is responsible for telling them Aether is in use on their engagement (we provide a template for that; see our DPA).

• Account information — your email address, via Supabase Auth (password or Google sign-in).
• Engagement content your firm connects — documents, email and calendar content from Google Drive, Gmail and Calendar, scoped to what your firm’s admin authorises when connecting Google Workspace. Nothing is read outside that authorised scope.
• What Aether generates from it — extracted decisions and commitments, drafts, and the record of what was reviewed and approved.
• Usage data — which agents are run and when, to operate and improve the product for your firm.

To attribute connected content to the right engagement, extract facts from it, and draft the work product your firm reviews and approves. Everything is scoped to your firm — Aether does not use one firm’s content to improve what another firm sees, and cannot retrieve across firms by design (row-level security enforced in the database, not only in application code).

Aether uses a small number of infrastructure and AI providers to run the service. Each sees only what a given call needs.

Per Anthropic’s and Voyage AI’s own commercial API terms as they currently stand, content sent through their APIs is not used to train their models unless we separately opt in, which we do not.

Separately, a provider’s own request logs (used for abuse monitoring and debugging) age out on that provider’s own schedule, which we don’t control. We say this plainly rather than imply a guarantee we can’t make: what we can certify is what we ourselves stored and deleted, described next.

Your firm sets how long a closed engagement’s documents are kept, from your firm’s own contract terms with its client. When that period ends, an owner or admin at your firm confirms destruction — it is never automatic. We keep an append-only log of what was destroyed, when, and under which terms, which your firm can export.

A client-initiated deletion request, once your firm confirms it, destroys every layer of that relationship’s data regardless of the engagement’s normal retention setting.

If you’re a person signed in to Aether, you can ask your firm’s owner or admin to remove your access at any time. If you’re asking on behalf of a firm about data Aether holds for that firm — access, correction, or deletion — contact us using the details below; we’ll act on it or direct you to the retention controls your firm’s admin already has in Settings.

Every table that holds firm data enforces row-level security in Postgres, tested to confirm one firm cannot read another firm’s rows. Data is encrypted in transit and at rest, per our infrastructure providers’ own standard practice.

Buildaether Inc. is an Ontario, Canada entity. Our infrastructure providers may process and store data outside Canada. Where they do, it’s under that provider’s own standard contractual protections.

We may update this policy as the service evolves. We’ll update the date at the top of this page, and for a material change, we’ll tell your firm’s administrator directly.

This policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable in Ontario.

Privacy questions or requests: admin@buildaether.com.