Privacy policy

Your sign-in details and profile identify your Aelix account. Credit balances, subscriptions and public-generation preferences apply to this site.

When you choose Google sign-in, Aelix requests the openid, email and profile permissions. It uses your stable Google account identifier, email address, email-verification information and name to authenticate you and create or connect your Aelix account. It does not request access to Gmail messages, Google Drive files, calendars or contacts, and does not receive your Google password.

When you choose GitHub sign-in, Aelix requests the read:user and user:email permissions to read your profile and email addresses. It uses your stable numeric GitHub account ID, your primary email address when GitHub marks it verified, and your name or username to sign you in or connect your account. A verified primary email is required to create a new account. Aelix does not request repository access or receive your GitHub password.

Where Apple sign-in is available, Aelix requests name and email permissions. It uses the verified Apple account identifier, email information and name when provided to sign you in or connect your account. Apple may supply a private relay email address. Aelix does not receive your Apple password.

Aelix stores the provider identifier and its association with your account, an optional provider email, and account information such as your email, display name and creation date. These sign-in integrations do not save provider profile photos or retain access or refresh tokens. Password accounts store a password hash; accounts created only through social sign-in have no password hash.

A matching email does not automatically connect an existing account. You can sign in with your existing method and connect an available sign-in provider from Account. Your display name can be changed in Account and may identify you as the author of creations you choose to share publicly.

If you enable two-step verification, Aelix stores an encrypted authenticator secret, hashed recovery codes and security state used to verify sign-ins and protect account changes. Temporary authentication challenges and rate-limit records help prevent misuse.

The service stores prompts, selected models and settings, uploaded reference media, generated outputs, generation status and error information, and credit-usage records to run creative tools and show your history. Chat features store messages and associated attachments.

SuperAgent also stores conversation summaries, generated files and saved preferences or facts in its knowledge map. Relevant conversation content, attachments and memories can be included as context in later model requests.

For purchases and subscriptions, Aelix keeps payment-provider identifiers, subscription information and credit transaction records. Your account email may be used for checkout and verification emails, including when it originally came from Google or GitHub sign-in.

Google, GitHub and, where enabled, Apple handle their respective sign-in flows. The integrations include Vercel for hosting and media storage, Neon for the account and application database, Stripe for payments, and Resend for verification email delivery.

Creative and chat requests send relevant prompts, context and reference media to Kie.ai and the selected AI services. SuperAgent models can use OpenAI or DeepSeek directly. SuperAgent can also process files and run code in a Vercel-hosted workspace when those tools are used.

Optional SuperAgent app connections are separate from account sign-in. Where available and connected by you, Google Drive, Gmail, Slack, Notion or a custom tool server can supply content for your requests. Aelix stores connection settings and encrypted access credentials, which can include refresh tokens. Retrieved content and tool results may be saved with the conversation and sent to its selected AI provider. Disconnecting an app does not delete content already saved in conversations.

The Discord link opens a separate service. Information you choose to provide there is handled through Discord.

Account authentication, requested creative tools, saved history and payment processing use information needed to provide the service you request and perform our contract with you (GDPR Article 6(1)(b)). Optional app connections process the content you ask the connected feature to use.

Security controls, abuse prevention and necessary technical diagnostics support our legitimate interests in protecting accounts, preventing misuse and keeping the service reliable (Article 6(1)(f)). These purposes do not authorize unrelated use of your creative content.

We process information needed to comply with applicable accounting, tax and privacy-request obligations (Article 6(1)(c)). Where optional public sharing is based on your consent, Article 6(1)(a) applies. You can stop future sharing in Account and request removal of previously published personal information through Privacy requests.

Aelix operates from Germany, but this does not mean that every provider processes information only in Germany or the European Economic Area. Hosting, payments, email, sign-in and selected AI services may process information internationally, depending on the service and configuration.

When you choose a model that uses DeepSeek directly, the relevant request content is sent to DeepSeek. Its published privacy policy describes processing and storage in China. Other providers, including Vercel and OpenAI, publish data-processing terms that describe international-transfer protections such as standard contractual clauses where applicable.

The arrangements that apply depend on the provider and processing involved. Contact us through Privacy requests for information about the recipients, processing locations and applicable transfer safeguards for your data. This notice does not promise EU-only processing or zero retention by every provider.

If you enable public generations, future applicable outputs, prompts, settings and reference media can appear in Explore with your display name and can be viewed, downloaded or reused by others. Disabling it affects future creations; it does not make existing public creations private.

Uploaded and generated media use public Vercel Blob URLs. Anyone who has one of these URLs may be able to access that media, even when it is not listed in Explore. Account access controls should not be understood as making every media URL private.

Files created by SuperAgent's document tools use separate encrypted storage and account-authorized downloads. This protection does not change the access rules for ordinary uploaded or generated image and video links.

Aelix uses a sign-in cookie to keep you signed in for up to 30 days. Social sign-in also uses temporary cookies to check that the request belongs to your browser and session. These checks last up to 10 minutes, with a separate completion cookie lasting up to 2 minutes. Temporary cookies are cleared during completion and error handling.

Two-step verification uses a temporary sign-in challenge cookie lasting up to five minutes. The Cookies and browser storage page explains these cookies and browser controls.

Browser storage saves SuperAgent model preferences. The installable app caches an offline notice; it does not cache chat or API responses.

Account, history, content and transaction records are stored to provide the features described above. Confirmed Studio uploads that remain unattached are scheduled for cleanup after six hours; attached media is retained for its associated content, and cleanup is asynchronous.

Account and creative-history records remain stored while your account or associated content is retained. A deletion request triggers a review of what can be erased and what must be retained for an applicable legal obligation, an unresolved transaction or a legal claim. Any retained information must be limited to the relevant purpose; we will explain material retention limits when responding to your request.

Privacy and consumer-request records preserve the declaration, receipt time and handling information needed to respond and demonstrate how a request was handled. Service-provider copies and backups can have separate retention and deletion processes; deletion from the visible account does not by itself establish that every provider copy has been erased.

You can change your display name and future public-sharing preference in Account. Signing out clears the session cookie. Removing permission for Aelix in a sign-in provider does not itself delete information already held by Aelix.

SuperAgent provides conversation deletion and separate editing/deletion controls for saved memories. Deleting a conversation does not itself remove separately saved memories. Active work or unresolved credit reservations can temporarily prevent conversation deletion. Attachments no longer used by other content are scheduled for cleanup after deletion.

Use Privacy requests to submit an account access/export request, an acknowledged deletion request or another privacy request and download its receipt. Submitting a request starts a review; it does not immediately erase the account, provide a complete data export or cancel a subscription. You can also contact support if you cannot sign in.

Depending on the circumstances, you can request access to your personal data, correction, erasure, restriction of processing and data portability. You can object to processing based on legitimate interests and withdraw consent for consent-based processing. Withdrawing consent does not affect processing that was lawful before withdrawal.

We respond without undue delay, normally within one month of receiving a request. If the law permits an extension for complexity or the number of requests, we will explain it within the first month. We may ask for proportionate information to confirm your identity. Exercising these rights is normally free of charge.

You may complain to a competent data protection supervisory authority, including one where you live or work. You can contact us first, but doing so is not a condition for making a complaint or seeking a judicial remedy.