Privacy policy
Updated 18 October 2026Learning and simulation
Aiterrios is a website for learning about AI agents, building workflows and experimenting with simulated business records. Business Sandbox invoices, journals and payments are simulation records: they do not transfer real money, file taxes or constitute professional accounting services. This purpose does not make information you enter anonymous. Use fictional examples rather than real personal or confidential business information.
Information stored by the website
Sign-in uses Google or the available ChatGPT sign-in service. Aiterrios stores the provider identity needed to recognize your account, verified email where supplied, your chosen username, account status and session records. It also stores your workflows, saved versions, connection settings, encrypted credentials, sandbox records, uploaded files, execution inputs and results, and conversation memory when used. Information you put in prompts or tool results may therefore appear in your private execution history.
Why information is processed
Account and workspace information supports the features you request. Session, authorization, audit and limited diagnostic records support security, abuse prevention and troubleshooting. Limited website measurements help understand usage. Where data protection law applies, providing requested services and legitimate interests in securing and maintaining the website are the relevant purposes and grounds; these do not remove your applicable rights.
AI providers and connected services
When you run a connected model, the relevant prompt, conversation context, attachments and tool results are sent to the selected AI provider. Your API key authenticates that request from the server. Connected tools can send data to the services and destinations configured in your workflow. BYOK means you supply the credential and your provider charges for usage; it does not mean the content stays on Aiterrios. Aiterrios uses Sites hosting infrastructure and Cloudflare Workers, D1 and R2 for website processing and storage. Sign-in providers process authentication under their own policies. Processing locations, transfers and retention at external providers depend on the provider and your account configuration; Aiterrios does not promise local-only processing or zero provider retention.
Private workspaces and deliberate sharing
Business records, workflows, credentials and execution history are protected by account and workspace authorization. They are not made public merely because registration is open. Universe usernames, profiles, avatars, visible status and social posts are social information visible to other eligible users. Messages are available to their participants. Workflow publishing, workflow sharing and shared AI connections have their own audience and permission settings. Review those settings before sharing; public forms and published endpoints can accept information from their visitors. Sharing a connection does not disclose its plaintext key or automatically share all sandbox records.
Credentials and security
Saved provider credentials and OAuth secrets use server-side AES-256-GCM encryption with owner-bound authentication. Credential lists return metadata rather than saved plaintext keys. Login sessions use secure HTTP-only cookies, with hashed session tokens stored on the server. Business data, prompts and execution history are not encrypted by the credential vault and are not end-to-end encrypted. No website can guarantee that loss, misuse or unauthorized access will never occur. Never paste keys into prompts, workflow text or public posts; use the credential controls.
Cookies, browser storage and measurement
Essential cookies support sign-in, session security and form protection. Browser storage also retains interface preferences and a tab-session measurement identifier. Website analytics record normalized page categories, approximate network geography, browser/device categories and external referrer hostname. The application derives a keyed monthly visitor estimate using the incoming network address; its analytics table does not store the raw IP address, full URL query or account ID. Do Not Track and Global Privacy Control signals are respected by this measurement. Hosting and external services may separately process request metadata.
Retention
Your workspace records, files, saved workflows, execution history and memory generally remain until you remove them through the relevant controls or delete your account; there is no general automatic age-based expiry for all workspace content. The application keeps limited operational diagnostics for up to seven days, with a maximum of 500 entries per module; expiry is applied during recording and reads exclude older records. Analytics use a 90-day window, with deletion of expired rows on ingestion. Security/audit identifiers, revocation evidence and records required to prevent duplicate operations may persist. Protected backup and recovery copies are separate from the active workspace; no immediate deletion from every backup or external provider is promised.
Your controls and account deletion
You can edit your profile, remove available execution records, clear workflow memory, revoke or remove connections and use the available export controls. Profile contains Delete account with an explicit confirmation. Deletion removes active account identity and private workspace content, revokes access and queues uploaded objects for deletion. Storage failures are retried, so file removal may finish after the account is disabled. Opaque internal identifiers and security evidence may remain without an active login identity. Account deletion cannot recall copies others already obtained or automatically delete content retained by an external service.
Data protection rights
Depending on the law that applies, you may have rights to access, correction, deletion, restriction, portability or objection, and to complain to the competent data protection authority. Self-service controls do not replace rights available under applicable law. Aiterrios is the website name; this notice does not identify Google as the operator responsible for data stored in Aiterrios.
Privacy contact
For privacy questions or requests to exercise your data protection rights, email privacy@aiterrios.com. Include only the information needed to identify your account and explain your request. Never send passwords, API keys or authentication codes.
Changes
This policy describes the current implementation. Material changes to data handling require this notice to be updated. Last updated: 18 October 2026.