Privacy Policy
1. Controller
Livius Despang, Am Seegraben 22, 01139 Dresden, Germany, email: team@aeravia.de
2. Waitlist
When you join our waitlist, we store your email address, the language you selected and the time of sign-up. You will then receive a confirmation email, sent via Resend (USA): you are only on the waitlist once you click the link it contains (double opt-in). Without that confirmation we will not send you any further messages. As proof of consent we also record the time of the confirmation and a pseudonymized hash of the IP address used for it (no plain-text IP). The legal basis is Art. 6(1)(a) GDPR (consent); for the record of consent additionally Art. 6(1)(f) GDPR in conjunction with the obligation to demonstrate consent under Art. 7(1) GDPR. We use the data solely to inform you about the launch and development of AERAVIA and to invite you to the closed beta. When we unlock your address for the beta, we store in your waitlist entry the time of the approval and the time at which we sent you the invitation email with the login link; the invitation is also sent via Resend (USA). When you sign in to the console, we check your email address against this approval. The legal basis for the invitation is your consent (Art. 6(1)(a) GDPR), and for the check at sign-in Art. 6(1)(b) GDPR (beta user relationship). The approval and invitation times are deleted together with the waitlist entry. The data is stored until you withdraw your consent or the purpose no longer applies. You can withdraw your consent at any time by an informal email to team@aeravia.de; your data, including the records of consent, will then be deleted.
3. Live demo
When you use our live demo, we process your email address and the company and project details you enter in order to perform the AI matching and draft the application (Art. 6(1)(b) GDPR) and to limit abuse (Art. 6(1)(f) GDPR; our legitimate interest is protecting the service against overload and abuse). To generate the results, the project and company details (company name, website, location, etc.) — without your email address — are transmitted to Anthropic (Claude API); the contracting party is Anthropic Ireland, Limited, and processing is carried out by Anthropic PBC in the USA. This may trigger an automated web search in which the company name or website reaches a search engine via the search tool. Anthropic does not use inputs submitted via the API to train its models by default and, according to its own statements, generally deletes inputs and outputs within 30 days; longer only in exceptional cases, for example for violations of its usage policy or because of legal obligations. Please do not enter confidential information or third parties' personal data into the description. To limit abuse, we also store a pseudonymized hash of your IP address (no plain-text IP) and your email address as usage counters. We store matching inputs to improve the matching (Art. 6(1)(f) GDPR) for 12 months: profile details with a project description shortened to 500 characters, the matching result and your email address; they are then deleted automatically. The results are generated automatically and do not constitute legal or tax advice.
4. Customer account and sign-in
For the closed beta we set up a customer account by invitation. Sign-in works without a password via a login link sent to your email address; emails are sent via Resend (USA). For this we process your email address, the times of registration and sign-in, and the log of sign-in events that Supabase keeps for authentication. To keep you signed in, we set technically necessary session cookies. The legal basis is Art. 6(1)(b) GDPR (beta user relationship). Data is kept until your account is deleted. You can delete your account yourself at any time; we then remove the account together with saved applications, review reports, uploaded documents and API keys, as well as the data stored under your email address from the waitlist, the live demo, matching inputs and deadline alerts.
5. Saved applications and application copilot
In your account you can save application drafts and have the application copilot review and revise them. We store the profile and company details, the draft, review reports and revised versions. To review and revise saved drafts, we transmit the draft with the related profile and company details — without your email address — to Anthropic, as described in section 3; this may trigger an automated web search. The legal basis is Art. 6(1)(b) GDPR. Data is kept until you delete the application or your account. If drafts contain third parties' personal data, please note the data processing notice.
6. Application cockpit and documents
In the application cockpit you can record the status of your application (phase, submission date, decision outcome, amount approved) and upload documents (PDF, PNG, JPG, DOCX, XLSX, at most 15 MB each). The purpose is managing your funding application; the legal basis is Art. 6(1)(b) GDPR. Files are transmitted encrypted and stored in non-public storage with Supabase in the EU; only you can retrieve them. They are not transmitted to Anthropic or any other AI service. Data is kept until you delete the file, the application or your account; aborted uploads are deleted after 24 hours. If documents contain third parties' personal data (e.g. employees, shareholders), please note the data processing notice.
7. API keys and console
On request we set up a console account with API keys for programmatic access to the matching. We store the company details, the technical usage allowance with its bookings and, per key, its name, a non-secret prefix, status, time of creation and last use, and request counters per time window. The key itself is stored only as a SHA-256 hash, never in plain text. Matching details submitted via the interface may be transmitted to Anthropic as described in section 3; they are not stored as matching inputs. The legal basis is Art. 6(1)(b) GDPR. Data is kept until your account is deleted.
8. Deadline alerts
If you enable deadline alerts in your account, we send you at most one email per day about new funding programmes matching your profile and deadlines ending in less than 14 days; for deadline notices we also use the programmes of your own saved applications. For this we store your email address, language, company size, federal state and funding categories from your most recent application, the time and pseudonymised IP hash of your consent, and the sending status (time of the last email and deadlines already notified). The legal basis is Art. 6(1)(a) GDPR (consent via confirmation link, double opt-in); for the record of consent additionally Art. 6(1)(f) GDPR in conjunction with the obligation to demonstrate consent under Art. 7(1) GDPR. Emails are sent via Resend (USA). Data is kept until you unsubscribe via the link in every alert email, in your account or by email to team@aeravia.de, and at the latest until your account is deleted; unconfirmed sign-ups are deleted after 7 days.
9. Contact by email
If you write to team@aeravia.de, we process your email address, the content and the metadata of the message in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry concerns your account or your use of AERAVIA, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries). Incoming emails to this address are forwarded by Cloudflare Inc. (USA), which also manages the DNS records of our domain, via email routing to a mailbox at Google (Gmail, Google LLC, USA). We keep the messages until your enquiry has been dealt with, unless statutory retention obligations apply.
10. Hosting and database
This website and the application are hosted and delivered by Vercel Inc. (USA). Database, sign-in and file storage are operated for us by Supabase Inc. (USA); the storage location is a data centre within the EU. Waitlist, live-demo and deadline-alert data (email address, subscription profile, sending status) as well as customer accounts, saved applications, review reports and uploaded documents are stored there. Data processing agreements pursuant to Art. 28 GDPR are in place with both providers.
11. Payment processing
The payment features are currently switched off during the beta; no payment processing takes place. For paid offerings in the console area (credit packages) we will use Stripe as our payment service provider; the contracting party is then Stripe Payments Europe, Ltd. (Ireland), which in turn relies on Stripe, Inc. (USA). When you buy a package, Stripe acts as a processor for the customer and invoicing data required for it (name, billing address, email address, payment method and amounts) on the basis of Art. 6(1)(b) GDPR (performance of a contract) and a data processing agreement pursuant to Art. 28 GDPR. The payment itself then runs on a page hosted by Stripe: payment details such as card numbers are entered there directly and never reach our servers. Invoice history, payment methods and billing address are subsequently managed in Stripe's customer portal.
12. Transfers to third countries (USA)
With the following providers, personal data is transferred to the USA and thus to a third country (Art. 44 et seq. GDPR). The safeguard per provider: Vercel Inc. (hosting) is certified under the EU-US Data Privacy Framework, with the EU Standard Contractual Clauses applying in addition; for Anthropic (AI processing) the contracting party is Anthropic Ireland, Limited, and processing by Anthropic PBC (USA) relies on the EU Standard Contractual Clauses; Resend Inc. (email delivery) is certified under the EU-US Data Privacy Framework; for Supabase Inc. (database, storage location EU) the EU Standard Contractual Clauses apply; Cloudflare Inc. (DNS and email forwarding) is certified under the EU-US Data Privacy Framework, with the EU Standard Contractual Clauses applying in addition; Google LLC (mailbox) is certified under the EU-US Data Privacy Framework; for Stripe, Inc. the EU Standard Contractual Clauses will apply to any future payment processing. You can obtain a copy of the Standard Contractual Clauses on request to team@aeravia.de. Despite these safeguards, access by US authorities cannot be fully ruled out.
13. Retention period
We store personal data only for as long as necessary for the respective purpose. Account data, saved applications, review reports, uploaded documents and API keys are kept until you delete them, and at the latest until your account is deleted; aborted uploads are deleted after 24 hours. Waitlist data, including the records of consent, is kept until you withdraw consent, and deadline-alert data until you unsubscribe. Matching inputs from the live demo are deleted automatically after 12 months; the other details collected in the demo (email and project information) once the purpose no longer applies or at your request. The usage counters contain only a pseudonymous IP hash and the email address, are limited to what is necessary to prevent abuse, and are cleaned up regularly. Email enquiries are kept until they have been dealt with. Vercel keeps runtime logs for one hour on the plan we use.
14. Server log files
When the website is accessed, our host processes technically necessary data (IP address, time, page requested, browser) in server log files. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the security and stability of operations, for example error analysis and defending against attacks. Vercel keeps runtime logs for one hour on the plan we use. This data is not merged with other data sources.
15. Cookies & analytics
This website uses no tracking cookies, no analytics cookies and no third-party reach measurement. There is no cross-device tracking and no creation of personal user profiles. We only set cookies where they are technically necessary — for example to sign you in to your account.
16. No automated decision-making
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). AI results — matches, drafts, review reports — are suggestions; whether and how you use them is your decision.
17. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw consent at any time with effect for the future; this does not affect the lawfulness of processing carried out before the withdrawal. Providing your data is not required by law or contract; without an email address, however, you cannot use an account, the live demo or deadline alerts. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR); the competent authority is the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte), Devrientstraße 5, 01067 Dresden, Germany.
18. Right to object under Art. 21 GDPR
Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR) — for example matching inputs, usage counters, records of consent or server log files — you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. An informal objection to team@aeravia.de is sufficient.
19. Version
This privacy policy is dated October 2026.