Privacy Policy

1. Who We Are

Atherion AI Technologies Inc. ("Atherion," "we," "us," or "our") builds a general-purpose AI agent. You describe work; it plans, acts, and reports back — writing and running software, using a real browser, and working inside tools you connect.

This policy explains what that means for your data: what we collect, why, who else touches it, and what you can do about it. It covers https://atherion.appand related services (the "Services").

Data controller: Atherion AI Technologies Inc., 1209 North Orange St, Wilmington, DE 19801.

2. What We Collect

What you give us

• Account information: name, email address, username, and profile picture.
• Payment information: handled by Stripe under PCI-DSS. We store billing status and transaction history; we never see your full card number.
• Sign-in data: if you sign in with Google or GitHub, we receive your name, email address, and profile photo from that provider.
• Your content: prompts, files, code, images, and anything else you send or upload, plus what Atherion produces in response.
• Messages to us: support requests and feedback.

What we collect automatically

• Device and connection: IP address, browser and operating system, device type, screen size, and language.
• Usage: which features you use, what you ask for, how long runs take, and when.
• Approximate location: city and country derived from your IP address. We do not collect precise geolocation.
• Diagnostics: server logs, error reports, and performance metrics. Error reports can include stack traces and request context, which may incidentally contain content you supplied.

What we receive from tools you connect

When you connect an account — a repository host, a mailbox, a calendar, a project tracker — we receive an access token scoped to the permissions you granted, and Atherion can read and act within those permissions on your instruction. You choose which accounts to connect and can disconnect any of them at any time.

Sensitive personal data

We do not ask for, and do not want, sensitive categories of personal data — racial or ethnic origin, political opinions, religious beliefs, trade union membership, biometric or genetic identifiers, health information, or sexual orientation. Atherion cannot inspect the meaning of everything you paste into it, so if you submit such data it will be processed like any other content. We recommend you don't.

3. How the Agent Works With Your Data

An agent that only answers questions has a small privacy footprint. Atherion acts, which makes its footprint worth describing precisely rather than burying under "service delivery."

• Each conversation runs on its own machine.When work needs to run, we start an isolated cloud sandbox for that conversation, operated on our behalf by our infrastructure provider. Your files and any credentials you place there live inside it. One conversation's sandbox cannot reach another's, and none of them can reach your computer — your computer was never part of the system. Sandboxes stop when idle and their contents are destroyed with them.
• Atherion uses a real browser.Some work requires the open web, so the agent drives a browser inside that sandbox. Pages it loads, and anything you type into that browser — including signing in to a site — exist inside the sandbox for the life of the session. Treat it like a computer in an office you share with us: fine for work, and not where we'd suggest you keep secrets you can't rotate.
• What it reads has no authority. Web pages, emails, and files the agent encounters are treated as information, never as instructions. Only you can instruct it. This is a security decision, and it is also a privacy one: it prevents a page from talking Atherion into moving your data somewhere.
• Actions that can't be undone stop and ask. Reading, editing, building, and running happen immediately and visibly. Deleting, publishing, sending, pushing, and paying wait for you. An ignored request is a refusal — we never treat silence as approval.
• Runs continue when you close the tab. A run belongs to our database, not to your browser session, so it keeps going and keeps recording what it did. That record is retained with your account until you delete it.
• Atherion remembers between conversations. To avoid re-explaining yourself, it stores facts drawn from your work — preferences, project details, and how you like things done. This is personal data. You can view, correct, and delete it in settings, or clear it entirely.

4. Why We Process It

• To run the Services: carrying out what you ask for, including model inference, sandboxes, browsing, previews, and deployment.
• To manage your account: sign-in, subscriptions, invoices, and service notices.
• To keep it working: diagnosing failures, measuring performance, and fixing what breaks.
• To keep it safe: detecting fraud, abuse, and security incidents.
• To support you: answering questions and investigating problems you report.
• To meet legal obligations: tax, accounting, and lawful requests.

We do not use your content to train models — ours or anyone else's.

5. Model Providers

Atherion routes your prompts and the context they need to third-party model providers — currently OpenAI, Anthropic, and Google — to produce a response. Which provider handles a given request depends on the model selected for it.

These providers act as our processors. We enter into data processing agreements with each, and where a provider offers zero-retention terms for API traffic we contract for them. Their processing is governed by those agreements alongside their own privacy policies.

Outputs are generated on demand from your inputs. They can be wrong. You are responsible for deciding whether an output is fit for what you intend to do with it.

6. Legal Bases for Processing

Where GDPR or UK GDPR applies, we rely on:

• Performance of contract: providing and supporting the Services you signed up for.
• Legitimate interests: securing the platform, preventing abuse, and improving reliability, where those interests do not override your rights.
• Consent: non-essential cookies and marketing email. You can withdraw consent at any time.
• Legal obligations: accounting, tax, export controls, and lawful orders.

7. Who Else Touches Your Data

We use a small set of providers to run the Services. Each processes data on our instructions under a data processing agreement, and none of them is permitted to use your data for their own purposes.

• Cloud sandboxes and previews — running your code and the agent's browser.
• Database and file storage — your account, conversations, and stored content.
• Identity and authentication — sign-in and session management.
• Payments — Stripe, for subscriptions and invoices.
• Model inference — OpenAI, Anthropic, and Google, as described in Section 5.
• Connected app integrations — brokering the tokens for accounts you connect.
• Error monitoring — capturing crashes and stack traces so we can fix them.

We will also disclose information where the law requires it, in connection with a merger or acquisition, or when you tell us to.

We do not sell your personal information, and we do not share it for advertising. There is no advertising business attached to Atherion, and the product carries no advertising or behavioural-analytics trackers.

8. Cookies

We use cookies to keep you signed in, remember your preferences, and secure the product:

• Strictly necessary: sign-in, session management, and security. These cannot be switched off and do not require consent.
• Functional: your theme, layout, and language.
• Diagnostics: error and performance reporting. Where consent is required in the EEA, UK, and Switzerland, we ask first.

We do not set advertising cookies. You can manage cookies in your browser, and we honour the Global Privacy Control (GPC) signal where it is recognised. Turning off non-essential cookies will not break the product.

9. How Long We Keep It

• Sandbox contents: destroyed when the sandbox is torn down, which happens automatically after a period of inactivity.
• Conversations, files, and agent memory: kept while your account is open, and deleted within 30 days of your deleting them or closing your account.
• Account records: kept while your account is active and for up to three years after closure, unless the law requires longer.
• Logs and error reports: up to 90 days.
• Billing records: up to seven years, as tax and accounting rules require.

Backups lag deletion. Data can persist in encrypted backups for up to 90 days after it is deleted from live systems, after which it ages out permanently.

10. Security

• Encryption: TLS in transit; encryption at rest with managed keys.
• Isolation: one sandbox per conversation, so a failure or compromise in one cannot reach another.
• Access control: role-based access, multi-factor authentication, and periodic access review.
• Monitoring: logging, alerting, and a documented incident response process.

If something goes wrong: where a breach affects your personal data and is likely to put you at risk, we will tell you without undue delay, and notify regulators within the deadlines the law sets.

No system is perfectly secure, and we are not going to claim otherwise. What we can tell you is where the boundaries are, so you can decide what to put inside them.

11. International Transfers

We operate from the United States, and your data will be processed there and in other countries where our providers run infrastructure. Where data leaves the EEA, UK, or Switzerland we rely on:

• The EU-US Data Privacy Framework, its UK Extension, and the Swiss-US DPF, where they apply to the recipient.
• The European Commission's Standard Contractual Clauses, where they do not.
• The UK International Data Transfer Addendum for transfers from the United Kingdom.

12. Your Rights

Depending on where you live, you can ask us to:

• Show you the personal data we hold about you, and give you a copy.
• Correct anything inaccurate or incomplete — including what the agent has remembered about you.
• Delete your data, subject to records we are legally required to keep.
• Export it in a structured, machine-readable format.
• Restrict or object to processing based on legitimate interests.
• Withdraw consent where consent is what we relied on.
• Be left alone about it. We will not degrade your service because you exercised a right.

Most of this you can do yourself in settings. For anything else, email [email protected]. We verify identity first and respond within 30 days, or sooner where the law requires. You may use an authorised agent with written permission.

13. US State Privacy Rights

If you live in California, Virginia, Colorado, Connecticut, Utah, or another state with a comprehensive privacy law, the rights in Section 12 are yours.

Categories we collect: identifiers, commercial information, internet and network activity, approximate location, professional information, and inferences drawn from your use of the product.

Where it comes from: you, the product as you use it, and the accounts you choose to connect.

Sale and sharing: we do not "sell" personal information, and we do not "share" it for cross-context behavioural advertising, as those terms are defined by the CCPA and CPRA. We run no advertising technology, so there is nothing here to opt out of — but if you want that confirmed in writing, email [email protected] and we will send it.

14. EEA, UK, and Switzerland

Atherion is the data controller for personal data processed through the Services. You have the rights set out in Section 12 under the GDPR and UK GDPR.

You can complain to your local supervisory authority — the ICO in the UK, or your national authority in the EEA. We would rather you came to us first at [email protected], but the right is yours either way.

15. Children

Atherion is for adults. Our Terms require you to be 18 or older, and consistent with COPPA we do not knowingly collect personal information from anyone under 13.

If we learn we have collected data from a child under 13 without verifiable parental consent, we delete it. Parents and guardians can contact us at [email protected]to review or remove a child's information.

16. Do Not Track

There is still no agreed standard for how sites should answer a browser "Do Not Track" header, so we do not change our behaviour based on it. We do honour Global Privacy Control, and there is no advertising tracking here to switch off in the first place.

17. Automated Decisions

Atherion is automated by definition — it produces outputs and takes actions from your instructions. In the ordinary course, none of that makes decisions with legal or similarly significant effects about you.

Where an automated decision does have that kind of effect — an account suspended for abuse, for instance — you can ask a person to look at it by emailing [email protected]. In the EEA and UK, Article 22 of the GDPR additionally gives you the right to an explanation, to contest the decision, and to human review.

18. Other People's Services

The Services link to, and the agent browses, sites we do not operate. What those sites do with data is governed by their policies, not this one.

19. Changes

We will update this policy as the product changes. The "Last Updated" date at the top always reflects the current version. If a change reduces your rights or widens what we do with your data, we will tell you by email or in the product at least 30 days before it takes effect.

20. Contact