Privacy policy · Aeotter

Aeotter Privacy Policy

Effective date: 11 November 2026
Last updated: 11 November 2026
Entity: Arclume Digital, a sole trader business based in Sydney, NSW, Australia, trading as Aeotter
Contact: hello@aeotter.com

1. About this policy

This Privacy Policy explains how Arclume Digital, a sole trader business based in Sydney, NSW, Australia (trading as and referred to as Aeotter, we, us or our), collects, holds, uses and discloses personal information when you visit our website, use the Aeotter platform, communicate with us, or otherwise interact with our services.

We aim to handle personal information in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), where those laws apply to us. This policy should be read together with our Terms of Service and any product-specific notices that apply to your use of Aeotter.

If there is an inconsistency between this policy and a specific notice provided at the time information is collected, the specific notice will explain the relevant collection or use.

2. What personal information we collect

The information we collect depends on how you interact with Aeotter and which features you use. It may include:

Free AI visibility check: your email address, website address, business name, business category and optional location.
AI visibility check data: questions generated for a check, AI answers received, whether your business was mentioned, cited links, and results from a scan of your public homepage, robots.txt and sitemap.xml.
Subscriber and account information: email address, website and business details, competitors you choose to track, tracked questions, weekly tracking results, audit results, recommendations, alerts and monthly usage.
Account and sign-in information: account identifiers, plan details, your password (stored only as a salted hash, never in plain text), hashed one-time sign-in codes we email you for two-step verification, the secret used to check authenticator-app codes if you choose to set one up, hashed session, trusted-device and password-reset link tokens, and records of sign-in attempts (email address, IP address and time) used to prevent abuse.
Transaction information: billing name, billing email, billing address, any business tax ID you provide (such as a GST or VAT number), subscription status and history, invoices and Stripe customer and subscription identifiers. Payments are processed by Stripe; we do not receive or store full card numbers.
Technical and abuse-prevention information: IP address (including to limit free checks to three per day), browser information, log data, timestamps and diagnostic information.
Support and correspondence: enquiries, feedback, support requests, cancellation feedback you choose to give, and records of communications with us.
Marketing preferences: your consent choices and records of marketing communications.

We do not intend to collect sensitive information. Please do not enter sensitive information into Aeotter.

3. How we collect personal information

We may collect personal information:

directly from you when you run a free check, subscribe, set up or use your account, contact us or request support;
automatically through your browser or device when you use our website or services; and
from service providers (such as Stripe) or other third parties where permitted by law.

Where it is reasonable and practicable, we will collect personal information directly from the individual concerned. If we receive information about you from another person or organisation, we will take reasonable steps to notify you of the matters required by APP 5, unless an exception applies.

4. Why we use personal information

We may use personal information for purposes including:

creating, authenticating and administering accounts, including emailing you a temporary password when your account is created (which you must change when you first sign in), requiring two-step verification (a code we email you, or an authenticator app if you set one up), and sending password reset links if you ask for one;
supplying, operating, maintaining and improving Aeotter;
running free AI visibility checks and subscriber tracking; generating questions; submitting tracked questions to AI model providers; preparing reports, dashboards, alerts, audit results and recommendations; and scanning publicly accessible business homepages, robots.txt files and sitemap.xml files. Aeotter does not log in to or submit forms on scanned websites;
providing customer support and responding to enquiries;
processing subscriptions, payments, tax and invoices;
protecting the platform, detecting misuse, preventing fraud and maintaining security;
monitoring performance, diagnosing errors and improving functionality, including using Cloudflare Workers AI to generate questions and extract competitor names;
complying with legal obligations and responding to lawful requests;
sending service emails, such as your account details, sign-in codes, password reset links, weekly reports, alerts, monthly recaps and billing notices; and
sending marketing communications where permitted by law.

We will not use personal information for an unrelated secondary purpose unless the individual has consented, the individual would reasonably expect that use and it is permitted by the APPs, or another exception under applicable law applies.

5. Direct marketing and electronic messages

We may send marketing emails about Aeotter where permitted by applicable law. You can opt out of marketing emails by using the unsubscribe link in the message or by contacting us at hello@aeotter.com. We will action opt-out requests within the period required by law (no more than five business days).

Where the Spam Act 2003 (Cth) applies, commercial electronic messages must meet its requirements, including consent, accurate sender identification and a functional unsubscribe facility. We do not treat the existence of an email address alone as consent to receive marketing messages.

Service and transactional messages (for example, account, sign-in, security, report or billing notices) are not marketing messages.

6. When we disclose personal information

We may disclose personal information to:

hosting, cloud infrastructure and data storage providers (Cloudflare);
AI service providers used to run checks and tracking (OpenRouter, which routes requests to OpenAI, Google and Perplexity models, and DataForSEO, which returns Google search and Google AI Overviews results);
our email delivery provider (Mailgun), which sends account, sign-in, report and billing emails;
payment processing, billing and tax calculation providers (Stripe, including Stripe Tax);
professional advisers, auditors, insurers and consultants;
a purchaser or successor entity in connection with a business sale, restructure or transfer; and
regulators, law enforcement agencies, courts or other parties where required or authorised by law.

We disclose only the information reasonably required for the relevant purpose. Our service providers process information on our behalf under their own terms and are expected to protect it and use it only for authorised purposes.

We do not sell personal information.

7. Overseas disclosure and storage

We use the following providers, which may process information outside Australia:

Cloudflare (hosting, database and Workers AI);
OpenRouter (routing AI requests), OpenAI (ChatGPT models), Google (Gemini models) and Perplexity (AI models). AI requests include tracked questions, which may include your business category and location, and OpenRouter may use web search; DataForSEO (Google search and Google AI Overviews results), which receives tracked questions and a search location;
Mailgun (email delivery, using its United States region); and
Stripe (payments, invoicing and tax calculation).

These providers may process information in the United States and other countries where they or their sub-processors operate, depending on their infrastructure and routing.

Where APP 8 applies, we will take reasonable steps to ensure that an overseas recipient does not breach the APPs in relation to the information, unless an exception applies. In some circumstances, Australian law may make us accountable for an overseas recipient's handling of personal information.

8. Cookies, analytics and similar technologies

Our site sets these cookies:

aeo_s — a strictly necessary sign-in session cookie, set only when you sign in. It is HttpOnly and Secure, lasts up to 30 days, and is removed when you sign out.
aeo_td — a strictly necessary "trust this device" cookie, set only if you tick that option when signing in. It lets you skip the emailed code on that device for up to 30 days. It is HttpOnly and Secure and is cancelled when you change your password.

We do not use analytics, advertising or tracking cookies, pixels or third-party analytics tools. Our hosting provider keeps standard server logs (such as IP address and request details) for security and operations. Stripe sets its own cookies on its hosted checkout and billing pages under its own privacy policy.

You can control cookies through your browser settings. Blocking the sign-in cookie will stop you from signing in to your account.

9. Security of personal information

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. Our safeguards include encryption in transit (HTTPS), storing passwords and sign-in tokens only as hashes, mandatory two-step verification, limits on repeated sign-in attempts and free checks, and restricting administrative access.

Free-check report links are private, hard-to-guess links. Anyone you share such a link with may be able to view it, so please keep them private. Your dashboard only opens after you sign in with your password and a verification code.

No method of transmission or storage is completely secure. You should use a strong, unique password, keep your email account secure (we send sign-in codes to it), protect your login details and notify us promptly if you suspect unauthorised access to your account.

If we become aware of an eligible data breach, we will assess and respond in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.

10. How long we keep personal information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing the service, maintaining business and financial records, resolving disputes, enforcing agreements and meeting legal obligations. Our retention periods are:

Free AI visibility check data (email, website, business details, check results and related IP and rate-limit records): up to 12 months after the check, then deleted.
Free check limit record: We keep the website address checked, without time limit, to enforce the free-check limit; the email address used follows the 12-month free-check retention above. You can ask us to delete it by emailing hello@aeotter.com.
Subscriber account data (account, tracking results, audits and recommendations): while your subscription is active and for up to 90 days after it ends, so you can return or retrieve it, unless you ask us to delete it sooner.
Billing, invoice and tax records: 7 years, as required by Australian tax law. These records are held by our payment provider, Stripe.

When information is no longer required, we take reasonable steps to destroy it or permanently de-identify it, unless we are required or authorised by law to retain it.

11. Access and correction

You may request access to personal information we hold about you and ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. You can also ask us to delete your account and data, subject to the retention periods above.

To make a request, contact us using the details in section 15. We may need to verify your identity before responding. We will respond within a reasonable period and in accordance with the APPs. In some circumstances, the Privacy Act permits us to refuse access or correction; if we do, we will explain the reasons and any available complaint options, unless the law prevents us from doing so.

12. Third-party websites and services

Our website or platform may contain links to third-party websites, and our reports may include links cited by AI engines. Those services operate under their own privacy policies and terms. We are not responsible for the privacy practices of independent third parties. You should review their policies before providing personal information to them.

13. Children's privacy

Aeotter is intended for business use and is not designed to be directed to children. We do not knowingly seek to collect personal information directly from children. If you believe a child has provided personal information to us, contact us so that we can assess the appropriate steps.

14. Complaints

If you have a concern or complaint about how we have handled your personal information, contact us using the details below. Please provide enough information for us to understand and investigate the issue.

We will acknowledge and investigate your complaint and aim to provide a response within a reasonable period, ordinarily within 30 days. If we need more time, we will let you know.

If you are not satisfied with our response, or we have not responded within a reasonable period, you may complain to the Office of the Australian Information Commissioner (OAIC):

Website: https://www.oaic.gov.au/
Privacy complaints information: https://www.oaic.gov.au/privacy/privacy-complaints

The OAIC may ask you to contact us first and give us an opportunity to resolve your complaint.

15. Contact us

For privacy questions, access, correction or deletion requests, or complaints, contact:

Privacy Officer — Aeotter
Operated by: Arclume Digital, a sole trader business based in Sydney, NSW, Australia
Email: hello@aeotter.com

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our services, business practices or legal requirements. The current version will be published on our website with its updated date. Where a change materially affects how we handle personal information, we will take reasonable steps to bring it to the attention of affected users.