1. Who is responsible
MB Instakademija (company code 304829880, registered office Tulpių g. 15, LT-44163 Kaunas, Lithuania; "we") runs the aeratus product family. We are the controller of the personal data this policy describes. Contact: hello@aeratus.app. We have not appointed a data protection officer because the law does not require one for us; privacy questions go to the same address.
2. Our two roles
- We decide how we process data about visitors to aeratus.app and to our products' own marketing pages; people who join a waitlist or write to us; users of accounts on our products; contacts at customer organisations, including billing contacts; and students' personal gslk accounts — the student's own profile, competencies and conversations with the AI coach (section 6). For this data we are the controller.
- Our customers decide about the data in their workspaces: attendees, registrants and speakers on vox, people who subscribe to an organisation's newsletter or vote in its polls, and the people an organisation lets edit one of its events; respondents on scito forms; people who use a q assistant; club and programme records on gslk — memberships, applications, club websites and club events; and authors, reviewers and readers of journals on mag. Text that you submit to an AI feature inside an organisation's workspace, and its result, are part of that organisation's data too. For all of this the organisation is the controller and we are its processor under our Data Processing Agreement. The organisation's own privacy notice applies, and requests should go to it. If you write to us about such data, we pass your request to the organisation and help it answer.
3. What we process, why, on what basis and for how long
| Who | Data | Purpose | Legal basis | Kept for |
|---|---|---|---|---|
| Website visitors | IP address, browser and device data, page requested, time — in hosting and security logs | Deliver the sites and protect them from abuse | Legitimate interest, Art. 6(1)(f) GDPR | Our database and server-function logs: 7 days. Our web host (Lovable) and network provider (Cloudflare) also keep request logs, as controllers in their own right, for their security and operation under their own privacy notices; we keep no copies |
| Waitlist | Email; optionally name, organisation, interests and a note; how you reached the form (referring site, campaign tags, page, browser language); a hashed network identifier to limit repeated sign-ups | Contact you when access opens for your organisation | Consent, Art. 6(1)(a) — given by submitting the form, which you can withdraw at any time | Until you withdraw; at the latest 12 months after we contact you about access, or 24 months after you joined if we never do |
| People who write to us | Name, email, message, attachments | Reply and keep a record of the exchange | Legitimate interest; steps before a contract, Art. 6(1)(b) | 24 months after the last message |
| Account users | Email, name, password (stored only as a hash by our authentication provider), language, photo if you add one, organisation memberships and roles, invitations, notification preferences, consent records, and a record of the terms you accepted (which version, when, and where — at sign-up, on joining or on creating an organisation); if you sign in with Google or Facebook where we offer it, the identifier, name, email and picture that provider shares | Provide the account and the Services | Contract with you, Art. 6(1)(b), or our and your organisation's legitimate interest in providing the Services to it, Art. 6(1)(f) | While the account exists; deleted when the account is deleted, except billing and security records kept for the periods below |
| Customer and billing contacts | Organisation name, billing contact, billing address and tax ID (collected by Stripe), plan, invoices, payment status | Sell and bill the Services; keep accounts | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) | Accounting documents 10 years, as Lithuanian accounting rules require |
| Service emails | Email address, message, delivery status | Account, security, billing and event notices; product updates only if you opt in | Contract and legitimate interest; consent for product updates | Delivery logs up to 12 months |
| Security and audit | IP address, browser identification string (user agent), changes to accounts, memberships and organisations' settings, and to vox's plans, hashed keys used for rate limits | Keep the Services secure, investigate incidents, show what happened | Legitimate interest; the duty to secure data, Art. 32 GDPR | Audit records 24 months; rate-limit records no longer than 12 months |
| AI usage metering | User, organisation, feature, model, number of tokens, time | Enforce plan limits, bill AI credits, prevent abuse | Contract, Art. 6(1)(b), or legitimate interest, Art. 6(1)(f) | 24 months |
| Platform staff change log | When our platform staff switch a vox feature on or off or change its settings (such as its minimum plan), change an organisation's exception for a feature, change an organisation's edition of vox (classic or new), or turn the platform-wide switch for the new edition on or off: which staff account made the change, when, the values before and after the change, and the reason, where one is given. When our platform staff archive an organisation or bring it back, take it off a product's list of organisations or put it back (for vox this also takes its public event site offline, or back online), or switch an organisation's access to q, gslk or scito on or off: which staff account made the change, when, the values before and after the change, and the note or reason, where one is given. When our platform staff change the settings of a built-in design (its name, visibility, order or plan, or which organisations are exempt from its plan): only the staff account that made the latest change and when, with no history of earlier changes and no reason. Three of these changes are also written to the security audit log (row "Security and audit") together with the IP address and the browser identification string (user agent) of the request: a change of an organisation's vox edition, a change of the platform-wide switch for the new edition, and taking an organisation off vox's list or putting it back (which switches its public event site off or on). The other records hold no IP address or device data | Account for changes to the service: show who changed what, when and why | Legitimate interest, Art. 6(1)(f) GDPR | Feature, exception and edition records: for as long as the platform runs; they stay after an organisation is deleted and then name it only by its internal identifier. Archive, product-list and product-access records: kept as audit records (row "Security and audit"). The security audit log copy of those three changes (with IP address and user agent): as audit records. Design settings: until the next change to that design replaces them, or until the design is reset to its default |
| Testing copies of an organisation's vox workspace | The organisation's published events only, never drafts or events awaiting its approval (event texts can mention people by name), with guests' names replaced by pseudonyms; contact details, attendees, question authors and photo uploaders removed; made-up attendees at addresses that cannot receive mail | Try a new version of vox on the organisation's own content before it reaches that organisation; only our platform administrators can open the copy, and it is never public and sends no email to anyone outside our staff | Done for the organisation, as its processor, and only on its written instruction (DPA Annex I), with a note of who gave it and when kept with the copy; the organisation's own legal basis applies | Until we rebuild it or the organisation asks us to delete it; at the latest when its contract ends |
| Backups of an organisation's vox site taken before a new look is put live | The site's previous appearance settings, design and page texts, as the organisation published them (they can name its contact person with a phone number and email address) | Undo the change exactly if needed | Done for the organisation, as its processor (DPA Annex I); the organisation's own legal basis applies | Until the organisation asks us to delete them; at the latest until its data is deleted at the end of its contract |
| People an organisation invites to edit one of its vox events (event-only editors) | The invited e-mail address (stored in lower case); which event and organisation; who invited and when; when the invitation expires (14 days after it is made) and when it was accepted or cancelled; and only a one-way hash of the one-time link, never the link itself. When the person accepts: a record that their account may edit that event, with who added them and when. The organisation's administrators see, for that event, the editors' e-mail address and name and the open invitations. An editor sees the organisation's name and, for that one event only, its texts, dates, venue and programme (also while it is unpublished), its format, language, status, cover image and web address, and the names of the speakers on its sessions; an editor sees nothing else in the workspace | Let an organisation's administrators give someone access to edit one event and nothing else; check that the person who accepts holds an account with the confirmed invited address. We do not send the invitation: an administrator sends it from their own e-mail program or copies the link, so no e-mail provider of ours handles it | Done for the organisation, as its processor (DPA Annex I); the organisation's own legal basis applies. The person's own account data stays under "Account users" above | An editor's access: until the organisation removes it, or the event, the organisation or the person's account is deleted. An invitation record: deleted no sooner than 30 days after it was accepted, cancelled or expired — we do this the next time someone is invited to the same event — or when the event or the organisation is deleted. There is no scheduled deletion, so it can stay longer, and it is not removed when the invited person deletes their account; write to hello@aeratus.app and we delete it sooner |
| People who subscribe to an organisation's newsletter on its vox event site (where it offers one) | The e-mail address (stored in lower case); the name, if the person gives one; the language; the exact consent sentence they were shown, its version and the time they agreed; and, once they confirm, the time they confirmed. When a sign-up is confirmed, the address is also added to the organisation's address book (source "newsletter") and to its list of newsletter subscribers. To limit repeated sign-ups, rate-limit records hold a hashed network key and a hash of the address (see "Security and audit"). The organisation's administrators and organisers see its subscribers, their state (waiting for confirmation, confirmed, unsubscribed) and when they agreed | Let an organisation send its own news by e-mail to people who asked for it. Double opt-in: we first send one confirmation e-mail, and the organisation can mail the person only after they press the button in it. Newsletters go out through our e-mail provider (Resend, section 6); each one carries a one-click unsubscribe link, which records the opt-out on the address-book entry | Done for the organisation, as its processor (DPA Annex I). The organisation's legal basis is the person's consent, Art. 6(1)(a) GDPR: given by ticking a box that is never pre-ticked and names the organisation, then confirmed from the person's mailbox; it can be withdrawn at any time with the unsubscribe link in any newsletter. The sign-up form carries the organisation's collection notice | Until the organisation erases it — its administrators have an "Erase data" button that removes the consent record and the address-book entry the sign-up created — or the organisation is deleted. After someone unsubscribes, the address stays with the note that they opted out, so that they are not mailed again, until the organisation erases it. There is no automatic deletion yet of sign-ups nobody confirmed (they give no permission to send anything), so one can stay until it is erased; write to hello@aeratus.app and we delete it sooner |
| People who vote in a poll at an organisation's vox event | The answer or answers chosen, and a vote key used only to count one vote per person in each poll: for a visitor who is not signed in, a salted hash of the network (IP) address, different for every poll; for a signed-in person, their account identifier. The key is pseudonymous personal data. No name, e-mail address, cookie or browser-storage entry is used or kept on the person's device. The organisation's administrators see the number of votes per answer, never who voted; the audience sees the totals only if the organiser chose to show them while voting, and always after the poll closes | Count one vote per person in each poll (and let the person change it), and show the audience the results of the organisation's live poll | Done for the organisation, as its processor (DPA Annex I); the organisation's own legal basis applies | Until the organisation deletes the poll — its votes go with it — or its event or the organisation is deleted; there is no other scheduled deletion. A vote cast while signed in is not removed when the person deletes their account; write to hello@aeratus.app and we remove it. Rate limits on voting use the same key in rate-limit records, kept no longer than 12 months |
Content you create inside an organisation's workspace (for example an event you drafted) is that organisation's data and stays when you delete your account; the organisation controls it.
We do not sell personal data, do not use it for advertising, and do not make decisions about you with legal or similarly significant effects by automated means alone.
4. Where the data comes from
Most of it comes from you. Some comes from others: your organisation, when it invites you, adds you as a member, speaker or contact, or names you as its billing contact; Stripe, which tells us whether a payment succeeded; and Google or Facebook, if you choose to sign in with them where we offer it.
5. Do you have to give it to us?
You do not have to give us any data. But without an email address we cannot create an account, and without billing details we cannot sell a paid plan — the law requires invoices to name the buyer. The waitlist and product updates are entirely optional.
6. Who receives data
We use service providers that process data on our instructions under data-processing terms — with one disclosed exception, our web host Lovable, which has not yet signed a data processing agreement with us (see the sub-processor page): hosting and content delivery (Lovable, Cloudflare); database, authentication and file storage (Supabase, EU region in Stockholm); email delivery (Resend) and our mailbox (Hostinger); payments (Stripe, which also acts as an independent controller for some purposes, such as fraud prevention and its legal obligations); and AI models (Anthropic, and OpenAI for search in q). The current list, with locations and safeguards, is on our sub-processor page. We may also disclose data to professional advisers, auditors and authorities where the law requires it, or to a buyer of our business under the same protections.
7. Transfers outside the EEA
Some providers process data in the United States or elsewhere outside the European Economic Area. We transfer data only with a safeguard under Chapter V GDPR: the EU–US Data Privacy Framework where the provider is certified, or otherwise the European Commission's Standard Contractual Clauses, together with technical measures such as encryption in transit and sending a feature only the data it needs. The exception, until its data processing agreement is signed, is Lovable's global network, as the sub-processor page explains. You can ask us for a copy of a safeguard.
8. Personal gslk accounts
Students who create a personal gslk account hold it under the gslk terms of use and the gslk privacy notice, which describe the specific data (profile, competencies, conversations with the AI coach, the optional public person page and mentor listing, and optional research participation) and the consents involved. We are the controller of the account and of that data. What a student does inside a club — membership, applications, the club's events and website — is the club's or the programme's data, which they control (section 2); they see the student's own data only as far as the student's role and choices allow, as the gslk notice explains.
9. Cookies and similar technologies
If you have not agreed to more, we use only storage that is strictly necessary — for example to keep you signed in and to remember your language and your choices. Some customers switch on analytics tools on their own pages; those run only after you accept them on that site. Details for each product are in the Cookie Policy.
10. How we protect data
Encryption in transit (TLS); encryption at rest by our infrastructure providers; separation of each organisation's data enforced in the database (row-level security); access to live data limited to authorised administrators; rate limiting; audit logs; daily backups kept for 7 days. Annex II of the Data Processing Agreement has the detail.
11. Your rights
You can ask us for access to your data, correction, deletion, restriction of processing and a portable copy; you can object to processing based on legitimate interest and withdraw consent at any time (without affecting processing before withdrawal). Some rights are self-service: in vox and gslk you can delete your account in its settings, vox emails contain a link to download or delete your registration data, and every vox newsletter has a one-click unsubscribe link. For q, scito and mag accounts, and for everything else, write to hello@aeratus.app. We answer within one month; for complex requests we may extend this by two months and will tell you why. We may ask you to confirm your identity.
You may complain to the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, ada@ada.lt, vdai.lrv.lt, or to the authority where you live or work.
12. Children
Our Services are not directed at children. Accounts are for people aged 16 or over. If you believe a child has given us personal data, write to us and we will delete it.
13. Changes
We update this policy when our processing changes; the version date is shown at the top. We tell account holders about material changes by email or in the Services.
14. Contact
MB Instakademija · Tulpių g. 15, LT-44163 Kaunas, Lithuania · company code 304829880 · hello@aeratus.app