Privacy Policy

AetherCloud ("we", "us") is the Data Controller for personal data processed through this platform, as defined under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

• Account data: name, email address, role. • Company data: business name, address, industry, contact details. • Client data you input: contacts, appointments, invoices, quotes. • Usage data: login timestamps, feature usage (anonymised analytics). • Payment data: processed by Stripe; we receive only masked card details (last 4 digits, expiry, card brand). • Google Calendar data: if you connect Google Calendar, we access your OAuth token solely to create, update, and delete calendar events on your behalf. We do not store your Google credentials or read any of your existing calendar content. Only the Google Calendar event IDs we create are stored in our database. • Cookies and similar technologies: see our Cookie Policy.

• To provide, maintain, and improve the Service. • To process payments and send billing notifications. • To send service-related emails (receipts, reminders, appointment notifications). • To sync appointments to your Google Calendar — but only when you explicitly connect your Google account, and only to create, update, or delete events corresponding to your own appointments. • To respond to support requests. • To comply with legal and regulatory obligations. Google user data (including data obtained via Google Calendar API) is used exclusively to provide the calendar sync feature directly requested by you. It is never used for advertising, profiling, credit assessment, or any other secondary purpose.

• Contract performance: to provide the Service you have subscribed to. • Legitimate interests: security monitoring, fraud prevention, platform improvement. • Legal obligation: financial record-keeping, responding to lawful requests. • Consent: marketing communications (where separately obtained).

We do not sell your data. We do not share Google user data with any third party except as follows: • Stripe: payment processing (Stripe's Privacy Policy applies). • Base44: infrastructure and hosting provider (bound by data processing agreement). • Resend: transactional email delivery. • Google LLC: when you connect Google Calendar, appointment data (title, date, time, location, and description) is transmitted to the Google Calendar API solely to create or update events on your behalf. This is governed by Google's Privacy Policy (policies.google.com). You can disconnect Google Calendar at any time from Settings → My Account. • Legal/regulatory authorities: where required by law. Google user data is never sold or transferred to data brokers, advertisers, or any other third party for any purpose unrelated to providing this Service.

We protect your data using industry-standard security practices: • All data in transit is encrypted via TLS/HTTPS. • Access to production data is restricted to authorised personnel only. • Google OAuth tokens are short-lived and never stored permanently; only the Google Calendar event IDs we create are persisted. • Payment data is handled exclusively by Stripe and is never stored on our servers. • We conduct regular reviews of access controls and security practices.

• Personal data is retained for the duration of your active account. • On account deletion, your data is purged within 30 days, except where legal retention obligations apply (e.g. financial records: 6 years under HMRC requirements). • Google Calendar event IDs stored in our database are deleted when the corresponding appointment is deleted or when you disconnect Google Calendar. • Google OAuth access tokens are not stored persistently and expire automatically; disconnecting Google Calendar immediately revokes our ability to access your calendar. • To request deletion of your data, use the Support tab in Settings or contact us via the Contact page.

Where data is transferred outside the UK/EEA, we ensure adequate safeguards are in place (e.g. Standard Contractual Clauses or adequacy decisions).

You have the right to: access your data; rectify inaccurate data; erasure ("right to be forgotten"); restriction of processing; data portability; object to processing; and to withdraw consent at any time without affecting prior processing. To exercise these rights, contact us via the Contact page or use the Support tab if you are a registered user.

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

If you choose to connect your Google Calendar account, AetherCloud will: • Request OAuth 2.0 authorisation via Google's secure sign-in flow, using the narrowest scope necessary (calendar.events — create, update, and delete events only). • Create, update, and delete calendar events corresponding only to your scheduled appointments. • Store only the Google Calendar event IDs we create in our database — never your calendar content, contacts, or any other Google data. • Never read, access, or process any pre-existing calendar events or data. • Never share your Google Calendar data with any third party. Data sent to Google is limited to: appointment title, date, time, location, and description — the minimum required to create a useful calendar event. You may disconnect Google Calendar at any time from Settings → My Account → Google Calendar Sync. Disconnection stops all future syncing immediately. Events already created in your Google Calendar are not retroactively removed on disconnection but can be managed directly in Google Calendar. Google API Services Limited Use Compliance Statement: The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Google user data is used solely to provide the calendar sync feature you have requested; it is not used to develop, improve, or train AI/ML models; and it is not transferred to any third-party service that would use it for AI/ML model training or any other secondary purpose.

For privacy queries or Data Subject Requests, use the Contact page or, if you are a registered user, the Support tab in Settings.