Privacy Policy | Aion Labs

How Aion Labs handles your personal data.

This policy explains what personal data we collect when you use the Aion Labs website, API, dashboard and Email Agents, how we use it, and what rights you have. In short: we keep the data needed to run your account and bill you, we do not store the content you send to the models through the API or browser chat, we do not use your content to train models, we do not sell data, and we use no advertising or analytics cookies.

1. Who we are

The controller of your personal data is:

Deep Forge sp. z o.o.
Sąd Rejonowy dla m.st. Warszawy w Warszawie, XIV Wydział Gospodarczy KRS, KRS 0001036658
NIP 1231533694, REGON 525348120
Share capital: 10 000,00 PLN
Email: [email protected]

We operate under the brand "Aion Labs". For any question or request about your personal data, write to [email protected] with "Privacy" in the subject line.

2. What data we collect

Account data — your email address, password, username, language preference and sign-up details such as the IP address you registered from. If you sign in with a third-party identity provider, we receive your email address and basic profile information from it.
Billing data — card payments are handled by our payment provider, which acts as the seller of record for the payment transaction and handles card details, receipts and VAT. We receive confirmation of your payments and store your Credit balance and transaction history. We never see your card number.
Usage and technical data — for each request to the API or dashboard we record metadata such as time, model, token counts, cost, response status and IP address. We do not record the content of your requests.
Content you send to the models — the prompts you send through the API or browser chat and the responses you receive are processed to generate the response and returned to you. We do not store them.
Email Agent data — if we run an Email Agent for you, we store its configuration, the tasks and messages you exchange with it, and the emails it receives and sends, for as long as the agent exists.
Correspondence — anything you send us when contacting support or making a complaint.

Providing your data is voluntary, but without your email address and payment details we cannot provide the Service.

3. Why we use your data

to provide the Service, run your account and process your requests — because it is necessary to perform our contract with you;
to take payment and keep accounting records — to perform the contract and to meet our legal obligations;
to keep the Service secure, prevent abuse and fraud, fix faults and defend legal claims — on the basis of our legitimate interest in running a secure service;
to send you service messages (verification, password reset, billing and security notices, changes to the Terms) — to perform the contract;
for any other purpose only with your consent, which you can withdraw at any time.

We may automatically suspend accounts that show clear signs of abuse. If this happens to you, contact us and a person will review the decision.

4. Who we share data with

We do not sell personal data. We share it only with service providers who process it on our behalf and under our instructions: hosting and infrastructure providers, our payment provider, our email delivery provider, and the identity providers you choose to sign in with. We may also disclose data where the law requires it or to protect our rights, and to a successor if our business is transferred.

5. International transfers

Some of our providers are located outside the European Economic Area, mainly in the United States. Where that is the case we rely on the safeguards provided for by the GDPR, such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

6. How long we keep data

We keep account data for as long as your account exists; billing and accounting records for the period required by law (5 years from the end of the financial year); technical logs for up to 12 months; Email Agent data until you delete the agent; and correspondence for as long as needed to handle the matter and any resulting claims. You can delete your account at any time from the dashboard; we then delete your data except where we are legally required to keep it.

7. How we protect data

We protect your data with appropriate technical and organisational measures, including encryption in transit and access controls that limit access to staff who need it.

8. Cookies

We use only the cookies strictly necessary for the Service to work: keeping you signed in, protecting forms against forgery and remembering your language. We do not use analytics or advertising cookies.

9. Your rights

You have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw any consent you have given. To exercise these rights, write to [email protected]; we respond within the time limits set by the GDPR. You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

10. If you correspond with an Email Agent

Emails sent by an Email Agent are generated by an AI system acting on the instructions of its owner, our customer. The owner is responsible for the agent and for your personal data in that correspondence; we process it on the owner's behalf. If you have questions about it, contact the owner or write to us and we will pass your request on.

11. Age

The Service is for adults. We do not knowingly process the personal data of anyone under 18 and we delete such accounts when we become aware of them.

12. Changes to this policy

We may update this policy from time to time. When the changes are material we notify account holders by email before they take effect.

Effective date: 17 October 2026.