Data Processing Notice
1. What this notice is
This notice explains when your use of AERAVIA requires a data processing agreement under Art. 28 GDPR (DPA) and how to obtain one. It is not itself such an agreement and not legal advice. The controller for AERAVIA is Livius Despang, Am Seegraben 22, 01139 Dresden, Germany, email: team@aeravia.de.
2. No DPA is needed for our own customer data
For the data arising from your sign-up and use — email address, company details, sign-in events, usage and allowance data, and the information from the waitlist and the live demo — the provider is itself the controller under the GDPR and not your processor. A DPA is neither required nor possible for this. The privacy policy sets out what is processed for which purpose.
3. When processing on your behalf arises
Processing on your behalf can arise in two cases: (1) you enter third parties' personal data into the free-text fields about your company and project — for example the names of employees, shareholders or contacts — and those details end up in the generated draft or review report that you store in your account. (2) You upload documents in the application cockpit that contain third parties' personal data (e.g. CVs, shareholder lists, payroll records). To that extent the provider stores this data on your behalf. Only in these cases does the provider process personal data on your behalf, and only then is a DPA required.
4. Recommendation for the test phase
During the closed beta we ask you to avoid such details: describe your company and project without names, contact details or other information about identifiable persons, and use placeholders such as “management” or “project lead” where needed. If documents you upload contain such details, redact them unless the funding body requires them. To the extent you do so, no processing on your behalf arises; third-party data required by the funding body is processed by the provider on your behalf under section 3. The same request appears in the privacy policy and in the terms of use.
5. DPA on request
If you do need to submit third parties' personal data, please request the DPA beforehand by email to team@aeravia.de and conclude it before entering such data. The agreement is concluded in text form and covers the subject matter and duration, the nature and purpose of the processing, the categories of data subjects, your rights to issue instructions, our duties to assist, notify and delete, and the sub-processors listed below.
6. Sub-processors
Currently engaged are: Vercel Inc. (USA) for hosting and delivery of the application; Supabase Inc. for the database, sign-in and file storage (application documents), with storage in the EU; Anthropic (contracting party Anthropic Ireland, Limited, processing by Anthropic PBC, USA) for the language-model processing used in matching, drafting and reviewing — Anthropic does not use inputs submitted via the API to train its models by default and does not receive uploaded documents; Resend (USA) for sending the login links, the waitlist confirmation emails and the deadline alerts, and the beta access invitations. Stripe is intended for processing payments for paid offerings (Stripe Payments Europe, Ltd., Ireland, involving Stripe, Inc., USA), as described in the privacy policy; during the free beta the payment features are switched off, so no payment processing takes place. While a DPA is in place, we will give advance notice before replacing or adding a sub-processor.
7. Transfers to third countries
Vercel Inc., Anthropic PBC, Resend Inc. and Supabase Inc. are located in the USA, as is Stripe, Inc. for any later payment processing, so to that extent data is transferred to a third country (Art. 44 et seq. GDPR). Vercel Inc. is certified under the EU-US Data Privacy Framework, with the EU Standard Contractual Clauses applying in addition; Resend Inc. is certified under the EU-US Data Privacy Framework; for Anthropic PBC, Supabase Inc. and Stripe, Inc. the EU Standard Contractual Clauses apply. Despite these safeguards, access by US authorities cannot be fully ruled out.
8. Technical and organisational measures
All transmission is encrypted (TLS). Stored drafts and review reports are isolated per account: the database enforces access to your own records through row level security, so access across accounts is not possible. Documents are kept in private storage; access only for the owning account (storage RLS), downloads via signed links valid for 60 seconds. API keys are stored only as a SHA-256 hash, never in plain text. For the application's abuse counters we store only a hash of the IP address, never the address itself; independently of that, IP addresses occur in the technically necessary server log files, as described in the privacy policy. The full description of the measures forms an annex to the DPA.
9. Deletion
You can delete stored drafts, review reports and uploaded documents yourself in your account at any time; they are removed entirely together with the account. After the test phase ends, or after a DPA is terminated, we delete the data processed on your behalf unless a statutory retention obligation applies.
10. Version
This notice is dated 15 October 2026.