Privacy policy.

Aethel Digital ("we", "us") is an independent web design and development agency. We run aethel.digital, the client accounts on it, and the websites and web apps we build and host for clients. For the personal data described here we are the controller. Questions about privacy go to hello@aethel.digital.

We collect only what each part of the service needs:

• Enquiries and project requests. Your name, email, phone, company, website and what you tell us about the project — to reply, prepare a proposal and keep a record of the conversation.
• Website readings. The address you submit and, if you ask for the report, your email. An automated browser loads the public page, measures it and takes phone and desktop screenshots. The report and screenshots are stored so you can open and share them.
• Website previews. When you ask for a preview, or we prepare one for your business, we read your current public website — name, logo, colours, typefaces, text, photos and the contact details it shows — and compose a draft site in your brand. Previews are private links. Figures and reviews we could not find are marked as examples.
• Client accounts. Your email, one-time sign-in codes, a session cookie, the messages you send, and the documents, projects and previews shared with you.
• Contracts. Names, company details, your signature, and the time, IP address and browser of the signing — kept as evidence of the agreement.
• Invoices and payments. Billing details, amounts and payment references. For payments in Ethiopian birr, the transaction reference or receipt screenshot you submit is sent to our verification provider, Veritas, which checks it with your bank or wallet and returns the transaction details (amount, date, payer and recipient names and accounts). We keep the result to record the payment and to stop the same receipt being used twice. US-dollar transfers are confirmed by our team.
• Apps and websites we run for you. The source code you or your developers provide, and the API keys your app needs for services on your own accounts (payments, email, maps and so on). Keys are encrypted the moment they are saved, are never shown again — in your account or ours — and are used only to configure your app's hosting.
• Newsletter. Your email, plus the time and IP address of your sign-up and confirmation, as proof of consent. Every newsletter has an unsubscribe link.
• Prices in your currency. Our host tells us the country your IP address belongs to. We use it to show prices converted from US dollars into your currency, and to show Ethiopian payment methods to visitors in Ethiopia. Only the two-letter country code is kept, in a cookie; the IP address is not stored for this.
• Security. IP addresses are used to limit repeated attempts (counters are deleted within a day) and are recorded where they serve as evidence: contract signatures, newsletter consent, payment confirmations and preview requests.

We also note when you open a proposal, preview, contract or invoice, so we can follow up at the right time. This shapes who we contact first; it is never used to make decisions about you with legal or similar effect.

Our own analytics record pages visited, where the visit came from, device type and approximate country — only if you allow analytics in the banner. Without your consent, page views are discarded.

Vercel Web Analytics and Speed Insights measure page views and loading speed in aggregate. They set no cookies and build no profile of you.

Sentry receives technical reports when something breaks (the page, the browser, the error). It is configured not to receive IP addresses or personal details, and stores data in the EU.

We use no advertising trackers, and we do not sell or rent personal data.

• aethel_csrf — security token that protects forms. Eight hours.
• aethel_account — keeps you signed in to your client account. 30 days, or until you sign out.
• Admin sign-in cookies — for agency staff only.
• aethel_country — your country code, for currency and payment methods. 30 days.
• aethel_visitor — a random ID that remembers your analytics choice and, only if you allow analytics, groups page views into a visit. One year.
• aethel_consent_v1 (local storage) — your analytics choice, so the banner does not ask again.
• aethel_landing, aethel_attributed (session storage) — where the visit started. Cleared when you close the tab.

Personal data is shared only with the services that run aethel.digital, each under its own data protection terms:

• Vercel (USA) — hosting, file storage, analytics, country lookup, and hosting of the client apps we deploy.
• Supabase (database hosted in the EU, Frankfurt) — where our records are kept.
• Our email delivery provider — sends our emails: sign-in codes, documents, receipts and replies.
• Veritas (veritas.et, Ethiopia) — confirms Ethiopian bank and mobile-money payments; used only for payments in birr.
• Sentry (EU region) — error reports.
• Google Fonts — website previews load their typefaces from Google, so your browser connects to Google when you open one.
• ExchangeRate-API — daily exchange rates. No personal data is sent.

Third-party services connected to an app we run for you (for example Stripe or Chapa) process data under your own account with them. We may also disclose information when the law requires it.

Our database and error reports are stored in the European Union. Hosting runs on Vercel's global network, operated from the United States. Ethiopian payment confirmations are processed by Veritas in Ethiopia. Where data leaves your country, we rely on our providers' contractual safeguards, such as the EU Standard Contractual Clauses.

• Sign-in codes and links: deleted a day after they expire. Sessions: when they expire.
• Rate-limit counters: within 24 hours.
• Record of document and preview views: 180 days. Email delivery log: 180 days. Payment webhook logs: 180 days.
• Analytics: 13 months.
• Enquiries, website readings and previews: until you ask us to delete them or they are no longer needed.
• Contracts, invoices, payments and payment confirmations: as long as tax and accounting law requires, typically up to ten years.
• App source code and API keys: while we run the app for you. Removing the app deletes its stored source, its keys and its hosting project.

Everything travels over HTTPS. The database is encrypted at rest and closed to direct access from browsers; only our servers can read it. API keys you give us for your apps are additionally encrypted with AES-256-GCM, using a key kept apart from the database. Staff access is limited to the agency and every admin action is logged. No system is perfectly secure; if a breach ever affects your data, we will tell you and the relevant authority as the law requires.

Wherever you live, you can ask us to show you, correct, export or delete your personal data, object to how we use it, or withdraw consent — for analytics in the banner at the foot of the site, for the newsletter with its unsubscribe link. These rights are protected by Ethiopia's Personal Data Protection Proclamation (No. 1321/2024), the EU and UK GDPR and the California Consumer Privacy Act, among others. California residents: we do not sell or share personal information for cross-context advertising.

Email hello@aethel.digital and we will answer within 30 days. Some records — signed contracts and invoices — must be kept by law even if you ask for deletion; we will tell you if that applies. You can also complain to your data protection authority.

Our services are for businesses and are not directed at children under 16. We do not knowingly collect their data.

When our services change, this policy changes with them. The date at the top shows the latest version, and significant changes are posted here before they take effect.

Privacy questions or requests: hello@aethel.digital.