Privacy Policy
How AeroReply collects, uses, shares and protects personal information, and the choices you have. Written to be read, not skimmed past.
The short version
- We don’t sell your dataWe use what you give us to run the product. We never sell personal information or rent out your audience.
- Account tokens are encryptedAccess tokens for the social accounts you connect are encrypted with AES-256-GCM and wiped when you disconnect.
- Ad cookies only with your yesEssential cookies keep you signed in. Meta’s measurement pixel only loads if you choose “Accept all”.
- Your data, on requestAsk for a copy of your data, a correction or deletion any time at support@aeroreply.com.
Who we are and what this covers
In short: This policy covers AeroReply’s website, web app, mobile app and API.
AeroReply (“we”, “us”) is the provider of the service and the controller of the personal information described here. We provide an AI workspace that replies to messages, plans and publishes social posts, and turns followers into leads. This policy explains how we handle personal information when you visit www.aeroreply.com, create an account, use the app or API, apply for a job, or subscribe to our newsletter.
When you use the product to manage your own customers — their messages, comments, contact details and leads — you decide what is collected and why. For that information you are the controller and we process it on your behalf, as described in Your customers’ information below.
Information we collect
In short: What you give us, what we receive from the platforms you connect, and a small amount of usage data.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Name, email, username, optional phone number and profile photo, and a hashed password | You, or Google/GitHub if you sign in with them |
| Workspace | Workspace name, members and their roles, brand kit, settings and appearance preferences | You and your team |
| Connected accounts | Account ID, display name, profile photo and encrypted access tokens for the networks you connect | Instagram, Facebook, LinkedIn, X, TikTok, YouTube, Pinterest, Threads, Bluesky, Google Business Profile |
| Content | Posts, captions, designs, uploaded images and videos, Link in Bio pages, short links and templates | You and your team |
| Billing | Plan, invoices and payment status. Card details are handled by Stripe and never stored by us | You and Stripe |
| Usage | Product events such as sign-ins, posts and designs created, AI features used and accounts connected; AI usage counts and cost (not your prompts) | Our own systems |
| Devices | Push notification tokens for the mobile app or browser, if you turn notifications on | Your device |
| Link analytics | For short links and Link in Bio pages: the referring site and visitor country. We don’t store visitor IP addresses or user agents | Visitors to your links |
| Messages to us | Contact form and support messages, newsletter sign-ups and job applications (including the CV and links you send) | You |
Your customers’ information
In short: Data about your audience belongs to you. We store and process it only to run the features you use.
When you connect an inbox or capture leads, the product stores information about the people who interact with you:
- Conversations: the sender’s handle, name and avatar, message text and media, review ratings, and the sentiment and reply suggestions our AI produces.
- Contacts: handle, name, email, phone, company, location, tags, notes, lead score and unsubscribe status.
- Leads: the email and any fields a visitor submits on your Link in Bio page.
You are responsible for having a lawful basis to collect and message these people, including any consent anti-spam laws require. We act on your instructions, don’t use this information for our own marketing, and make a data processing agreement available on request.
How we use information
In short: To run and improve the product, keep it secure, bill you, and talk to you when you’ve asked us to.
- Provide the service: generate replies and posts, schedule and publish to your connected accounts, run your inbox, CRM, links and analytics.
- Bill you and manage your plan, add-ons and AI credits.
- Keep the service secure: authenticate you, rate-limit sign-in attempts, detect abuse and investigate errors.
- Understand how the product is used, using our own first-party events, so we can fix what’s confusing and build what’s missing.
- Send service emails (sign-in, billing, reports you scheduled, security notices) and, if you subscribed, our newsletter.
- Meet legal obligations and enforce our Terms of Service.
We do not sell personal information, and we don’t use your content or your customers’ messages to train our own AI models.
AI features
In short: When you use an AI feature, the text needed for that request is sent to an AI provider to produce the result.
AI replies, captions, designs, repurposing and video captions are generated by third-party model providers: OpenAI (including Whisper for transcription), Anthropic, Google Gemini or Groq, depending on the model selected for your workspace. The request contains the content needed for that task, for example the message you’re replying to, your brand profile and your instructions.
If you bring your own AI provider key, requests go to your provider account under your agreement with them. Your key is stored encrypted. We record which model was used and how many credits it cost, not the text of your prompts.
AI output can be wrong. Features that publish or send on your behalf, such as auto-replies and autopilot, only run when you switch them on.
How long we keep it
In short: As long as your account is active, and shorter for things that stop being useful.
| Data | How long |
|---|---|
| Account, workspace and content | While your account is active, and until you ask us to delete it |
| Social account tokens | Until you disconnect the account, when they are wiped |
| Messages in finished conversations | Deleted after 400 days |
| In-app notifications | 30 days after you read them, 90 days at most |
| Billing records | As long as tax and accounting law requires |
| What you agreed to at checkout (terms version, renewal terms, withdrawal choice) | At least 3 years after the purchase, as proof of your consent, even if you delete the workspace |
| Newsletter subscription | Until you unsubscribe |
| Job applications | For the hiring process and a reasonable time after, unless you ask us to delete them sooner |
Deleting a workspace removes it from the product straight away and cancels its subscription (with a full refund within the 7-day money-back guarantee). To have your personal account and its remaining records permanently erased, email support@aeroreply.com and we’ll confirm when it’s done.
How we protect it
In short: Encryption, hashed credentials, short-lived sessions and signed webhooks.
- Connected-account tokens and bring-your-own AI keys are encrypted at rest with AES-256-GCM.
- Passwords are hashed with bcrypt. Sessions use short-lived access tokens, and refresh tokens are stored only as hashes.
- Sign-in endpoints are rate-limited, and every webhook we send is signed with HMAC-SHA256.
- Data is held in AWS in the United States, and access is limited to the people who need it to run the service.
No system is perfectly secure. Read more on our Security page, and report anything you find to security@aeroreply.com.
International transfers
We host the service in the United States, and some providers above process data in other countries. When information moves across borders we rely on our providers’ contractual safeguards, such as standard contractual clauses, where the law requires them.
Your choices and rights
In short: Depending on where you live, you can access, correct, delete or export your data, and object to some uses.
- Get a copyAsk for an export of your account data.
- Delete your dataAsk us to erase your account and personal data.
- Email preferencesChange topics or unsubscribe from the newsletter.
- Disconnect accountsRemove a social account from Settings and its tokens are wiped.
You can also update most account details yourself in Settings. We answer requests within 30 days, may need to verify it’s you first, and won’t treat you differently for using your rights. If you’re in the EU, UK or another region with a data protection authority, you can complain to it, though we’d like the chance to fix things first.
If you are a customer of one of our users, please send your request to that business. We’ll help them respond.
Children
AeroReply is a business tool and isn’t meant for children. You must be old enough to form a binding contract where you live to create an account. If you believe a child has given us personal information, contact us and we will delete it.
Changes to this policy
We update this policy when the product or the law changes. The date at the top shows the latest version. If a change is significant, we’ll tell you in the product or by email before it takes effect.
Contact us
- Privacy questions and requests: support@aeroreply.com
- Security reports: security@aeroreply.com
- Anything else: our contact page
