Privacy

Your data, plainly.

How AIOProductOS collects, uses, and protects personal data — under the GDPR and US state privacy laws. Last updated 22 June 2026.

1 · Who we are & our role

AIOProductOS is operated by AIOProductOS Inc. (a Delaware C-Corporation, United States).

AIOProductOS Inc. — a Delaware C-Corporation, file no. 10681442. 131 Continental Dr, Suite 305, Newark, DE 19713, United States.

We are the controller for account, billing, support, marketing, and error-monitoring data about our own users. We are a processor for the business data and end-user analytics we process on behalf of customer organisations — there, the customer is the controller and our obligations are set in the Data Processing Addendum.

Data Protection Officer. AIOProductOS Inc. does not meet the GDPR Art 37 threshold for mandatory DPO designation. Privacy Contact: privacy@aioproductos.com.

2 · What we process, and why

Each row is one processing activity, with its lawful basis and how long we keep the data. This mirrors our Article 30 record of processing.

Processing activities, personal data categories, lawful basis, and retention
Purpose	Personal data	Lawful basis	Retention
Account creation & authentication	Name, email, hashed credentials, org membership, role, sign-in IP & user agent, session metadata	Art 6(1)(b) contract	Life of the account; deleted on account/org deletion or a verified request
Billing & subscription	Billing name & email, plan, subscription IDs, transaction history. No card/PAN data — handled by Stripe	Art 6(1)(b) contract; Art 6(1)(c) legal (tax)	Life of the relationship; financial records per accounting law
Product analytics (your end users)	Event names & properties, page/screen views, pseudonymous IDs, device metadata, IP-derived data	Customer is controller (Art 6(1)(f) or consent); we are processor	Per your configuration & the DPA; deleted on org deletion or instruction
Meeting transcription	Participant audio, transcript text, speaker IDs, derived action items	Art 6(1)(b)/(f) for the customer; consent where required, logged	With the meeting record until deleted
AI features (synthesis, agents, prioritisation, surveys, codebase map)	The customer content needed to answer the query, and any personal data within it	Customer is controller; we are processor	Inputs transient to the API call; outputs persist on the record until deleted
Support & in-product communications	Name, email, message content, attachments, account context	Art 6(1)(b) contract; Art 6(1)(f) legitimate interest	Life of the account unless deleted on request
Transactional & marketing email	Name, email, send/open/click metadata, subscription status	Transactional: Art 6(1)(b). Marketing: Art 6(1)(a) consent, opt-out honoured	Until unsubscribe or account deletion; suppression list kept to honour opt-outs
Error & performance monitoring	Error/stack traces, request metadata, user/session IDs, IP; incidental PII in error context	Art 6(1)(f) legitimate interest in a secure, reliable service	Minimised and time-limited per provider configuration

3 · Where your data lives & international transfers

AIOProductOS runs two regions — an EU project (eu-central-1) and a US project (us-east-1) — with the same schema. You pick your region at signup; your data lives and stays there.

Some processors are US-based or process data outside the EEA. Where personal data of EU/EEA data subjects is transferred outside the EEA, the safeguard we rely on is the Standard Contractual Clauses (SCCs) in that processor's data-processing terms. Serbia, where the controller is located, is treated as a third country for EEA transfers; the same SCC safeguard applies.

4 · Who we share it with (subprocessors)

We use vetted subprocessors for hosting, database, email delivery, transcription, AI inference, error monitoring, and payments. The current list — name, purpose, country, and the safeguards each holds — is published and kept up to date at status.aioproductos.com/subprocessors. We do not sell personal data and do not run third-party advertising trackers.

5 · Your rights under the GDPR

If you are in the EU/EEA or UK, you have the following rights:

Access. A copy of the personal data we hold about you (Art 15).
Rectification. Correct inaccurate or incomplete data (Art 16) — editable in Settings.
Erasure. Delete your data (Art 17) — served by account/org deletion.
Portability. Receive your data in a portable format (Art 20) — full-org export.
Restriction. Limit how we process your data (Art 18).
Objection. Object to processing based on legitimate interests (Art 21).
Withdraw consent. Withdraw consent at any time, without affecting prior processing (Art 7).

How to exercise them. Email privacy@aioproductos.com, or use Settings → Privacy & Data in the product. We respond within 30 days. Where we act as a processor, requests about a customer's end users are routed to that customer as controller.

Complaints. You may lodge a complaint with your local supervisory authority. EU/EEA residents can complain to the data-protection authority of their country of residence or work; others may contact Serbia's Commissioner for Information of Public Importance and Personal Data Protection.

6 · US state privacy rights

If you are a resident of California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), or Texas (TDPSA), you have the right to:

Know & access the categories and specific pieces of personal information we hold about you.
Delete personal information we collected from you.
Correct inaccurate personal information.
Portability — a copy of your information in a portable form.
Opt out of any sale or sharing of personal information and of targeted advertising.
Non-discrimination for exercising any of these rights.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We honour Global Privacy Control (GPC) browser signals automatically. To exercise a right, email privacy@aioproductos.com or use the Do Not Sell or Share control. You may use an authorized agent, and you may appeal a decision by replying to our response.

7 · Cookies & tracking

This site uses only what's needed to function plus privacy-first, first-party usage measurement — no advertising or cross-site tracking cookies, and your data is never sold or shared with ad networks. Our measurement sets no cookies; it stores a first-party identifier in your browser's local storage so we can tell a returning visit from a new one. In the EEA, the UK and Switzerland nothing beyond the essentials runs until you accept; elsewhere it runs by default and you can turn it off at any time. Full detail and your controls are on the cookie policy.

8 · Children

AIOProductOS is a business tool not directed to children. We do not knowingly collect personal data from anyone under 16.

9 · AI connector (MCP)

AIOProductOS publishes a hosted MCP connector so you can reach your own spine from Claude (Claude.ai, Claude Code, Cursor). It runs on the same data you already trust us with — this section covers what that connection does:

OAuth tokens. Connecting via Claude issues an access token scoped to a single member of a single organisation, on that org's region (EU or US). It carries no broader access than the member already has, never expires unless you revoke it, and is revocable any time in Settings → Tokens. We store only a one-way hash of the token, never the token itself.
Tool-call data flow. Each tool call reads or writes the same records the in-app product does (analytics, revenue, accounts, feedback, work) under the same row-level tenancy. The connector never trains a model on your data, and the reasoning runs on your Claude subscription — we send no spine content to any model ourselves.
Demo connector. The read-only demo (/api/mcp/demo) is locked to our seeded Brightline showcase org and exposes no real customer data — it is shared, public, and contains no personal data.
Encryption & retention. Connector secrets are envelope-encrypted at rest (per-org key, AES-256-GCM). Tokens and the records they reach are deleted when you delete the organisation, per the retention rules above.

10 · Changes & contact

We update this notice when our processing changes and revise the date above. Questions, requests, or concerns: privacy@aioproductos.com. Security matters: security@aioproductos.com. See also our Trust & security overview and AI transparency page.