PRIVACY

Last updated: October 9, 2026

This page describes the information the current AStack application and control plane are designed to process and store. It does not claim certifications or controls that have not been independently verified.

Responsible entity: CHATBOO PTY LTD. Privacy contact: admin@aether-stack.com.

INFORMATION STORED BY THE CONTROL PLANE

Account and access

  • Email, name, company, account status, and authentication identifiers
  • Billing plan, credit balance, and payment reference identifiers
  • Billing name, company, address, country, and tax ID, when entered, and the buyer details copied onto invoices and credit notes
  • API-key name, prefix, permissions, status, limits, and a one-way key hash
  • Account creation, update, and last-login timestamps
  • The dates you signed up, confirmed your email, and first created an API key, started a session, and bought credit

Sessions and usage

  • Session, customer, worker, and optional end-user identifiers
  • Session status, connection type, timestamps, duration, cost, and credits consumed
  • Usage records, service logs, errors, security events, and performance telemetry
  • Your network address and browser user agent on security events, such as failed sign-ins and refused requests

CONVERSATION PROCESSING

During an active session, the runtime can receive audio, text, and images from the browser. It uses that input for speech recognition, voice activity detection, language generation, speech synthesis, and rendered facial animation.

The browser asks before it shares a microphone or camera. Audio streams only while a call is active, and images are captured only when the application enables image capture. The character's voice, face, animation, and replies are AI-generated.

If a customer explicitly selects Deepgram BYOK mode, relevant audio and text are processed by Deepgram under that customer's account. The provider key is held only for the active runtime session and is not retained by AStack.

  • The database schema stores session and usage metadata; it does not define a customer media library.
  • Runtime and evaluation tools can create temporary recordings and diagnostic artifacts when those tools are enabled.
  • Do not send secrets or information that is not required for the conversation.

HOW INFORMATION IS USED

  • Create, authenticate, route, expire, and clean up sessions
  • Run the conversational and rendering pipeline
  • Measure usage, calculate charges, apply credits, and display dashboard records
  • Count, in aggregate, how many new accounts reach each step from sign-up to first purchase, without cookies or third-party analytics
  • Diagnose failures, enforce API-key permissions and rate limits, and investigate abuse
  • Respond to messages submitted through the support form

CURRENT RETENTION SETTINGS

Session recordsArchived 90 days after the session; the archive is deleted after 2 years
Usage recordsArchived after 180 days, or with their session at 90 days; the archive is deleted after 2 years
Security eventsNon-critical events are archived after 90 days; every event, archived copies included, is deleted after 1 year
Audit logArchived after 30 days; the archive is deleted after 90 days
API request logsArchived after 30 days; the archive is deleted after 1 year
Email delivery logDeleted after 90 days
Sign-in historyDeleted after 90 days
Demo usage limits (hashed network address)Deleted after 7 days
Stored PayPal notificationsDeleted after 1 year
Signup credit record (one-way hash of your email)Deleted after 3 years
Account milestone datesKept while the account is open; deleted when the account is deleted
Credit ledger, invoices, credit notes, and payment referencesKept while the account is open; after closure, see below

Deleting an account ends and bills active sessions and revokes API keys immediately. The request can be cancelled for 30 days. After that, the name, company, email, billing details, login identity, API keys, stored payment methods and usage logs are removed, and email, audit and security logs are pseudonymized. Credit-ledger entries, invoices, credit notes and payment references are kept without personal details for 7 years after the account closes, then deleted. Session and usage records follow the periods above.

SECURITY BOUNDARIES

  • Long-lived API keys are intended for server-side use and are stored as hashes.
  • Browsers receive time-limited session credentials and signed renderer player URLs.
  • Database access is restricted through service roles, authenticated operations, and row-level policies.
  • AStack has not published a SOC 2 report, uptime SLA, or independent penetration-test result.
  • Where retained-host operation is enabled, a GPU host may be reused for successive sessions, including sessions for different customers. A session has exclusive assignment while active; this does not mean it owns a permanently dedicated physical machine.
  • Retained-host software uses fresh session credentials and private working directories, stops session processes, removes their working data, and quarantines a host when its reset fails. These controls do not provide a verified kernel or hardware boundary between customers, or a guarantee that all previous data is erased from GPU memory and other shared resources.
  • A compromised runtime process or a privileged host operator may be able to access or affect resources outside the session workspace. Stronger isolation for customers whose SLA requires it is planned future work and is not currently offered as a verified service.
  • Customers requiring verified isolation or handling sensitive or regulated information should contact AStack to establish suitable safeguards before sending that information. These limitations do not remove AStack's obligations under applicable privacy law.

SERVICE PROVIDERS

Supabase

Authentication, database, scheduled jobs and edge functions

Data: Account, session, usage, billing and log records

Location: United States (East US, Ohio)

Vercel

Website, dashboard, API routes and the session provisioner

Data: Requests, account actions and request logs

Location: United States: Washington, D.C. (iad1) for default functions; San Francisco (sfo1) for the session provisioner

Novita AI

GPU runtime that hosts each live session

Data: Live microphone audio, text and images, generated speech and rendered video

Location: United States

Vast.ai and the selected hosting operator (when enabled)

GPU runtime and retained-host sessions in the prepared Vast path; activation is pending

Data: Live session inputs, generated speech/video and configured runtime diagnostics

Location: Varies by the selected GPU host and operator; the enabled deployment must identify its processing country

Cloudflare

Turnstile bot checks on account forms, and a TURN relay when the session stream cannot connect directly

Data: Browser signals for the challenge; the relayed stream stays encrypted

Location: Global network; information may be processed internationally, with storage primarily in the United States and European Economic Area

PayPal

Credit purchases, refunds and disputes

Data: Payer name, email, country and payment references

Location: PayPal Australia Pty Limited, Australia; payment information may also be processed in the United States and other countries

Resend

Support-form email and, once configured, account emails

Data: Email addresses and message content

Location: United States: North Virginia (us-east-1) for sending; account data, email metadata, logs and API records are stored in the United States

Sentry

Error reports from the website and runtime, when enabled

Data: Error details, request metadata and browser information

Location: United States (US ingest region); website DSNs are configured for production

Amazon Web Services

Stores the runtime container images that sessions start from

Data: No customer content

Location: United States (N. Virginia)

Deepgram

Speech and voice agent processing, only when a customer selects Deepgram BYOK mode

Data: Session audio and text, under the customer’s own Deepgram account

Location: Chosen by that customer’s Deepgram account

The runtime provider can change between development, evaluation, and launch deployments; this list names the production providers.

YOUR DATA REQUESTS

  • Signed-in users can update their profile, billing details, email address, and password, and close their account, from the dashboard.
  • To see a copy of the data associated with your account, correct it, or ask for anything else, email admin@aether-stack.com or use the support form. Use your account's email address so the request can be verified.
  • Response time: We aim to respond within 30 calendar days of receiving your request. We will advise you of any delay and meet any deadline required by applicable law.

Do not include API keys or session secrets in a request.