Privacy Policy
Last updated: April 7, 2026 · Effective: April 21, 2026
Aerostack Inc. ("Aerostack," "we," "us," or "our") operates the developer platform at aerostack.dev and related services (collectively, the "Platform"). This Privacy Policy explains exactly what data we collect, why we collect it, how we store and protect it, who can access it, and how you can control or delete it.
We built Aerostack for developers who care about how their tools handle data. We have written this policy in plain language so you can actually read and understand it — not just click through it.
By using the Platform you agree to this Privacy Policy. If you do not agree, please do not use the Platform.
A note for OpenClaw and local AI agent users
If you use Aerostack to manage an AI agent running on your local machine (e.g. via the @aerostack/gateway bridge), your agent's tool calls — including parameters like file contents, shell commands, and database queries — flow through our platform so we can provide approval gates, audit trails, and activity monitoring. This section explains exactly what we store and how you control it. We take this seriously: see Sections 1.6, 5, 6, and 8 for the specifics.
1. Information We Collect
1.1 Account & Identity Information
When you register for an Aerostack account we collect:
- Name and email address
- Password (hashed with PBKDF2 at 600,000 iterations; never stored in plaintext)
- Profile avatar (stored in Cloudflare R2)
- Optional: GitHub or Google OAuth identity linked to your account
1.2 Usage & Technical Data
As you use the Platform we automatically collect:
- API request logs (endpoint, method, response code, latency, timestamp)
- IP address and approximate geographic region (derived from Cloudflare headers)
- Browser type, operating system, and referrer for dashboard sessions
- Usage metrics: request counts, token consumption, storage used, realtime connections
- Error traces and performance telemetry
1.3 Project & Content Data
Data you create or upload through the Platform:
- Projects, API configurations, schema definitions, and environment variables
- Community listings: functions, MCP servers, skills, and agents you publish
- Files, media, and documents stored in project R2 buckets
- Database records stored in project-scoped D1 databases
- AI knowledge base documents indexed for retrieval-augmented generation (RAG), stored as vector embeddings in Cloudflare Vectorize and raw documents in R2
1.4 Payment & Billing Information
Subscription payments are processed by Razorpay. We do not store full card numbers or CVV codes. We retain Razorpay customer IDs, subscription status, billing interval, and invoice history for accounting and support purposes. We plan to add Stripe as an additional payment option in the future; this policy will be updated accordingly.
1.5 Communications
If you contact us via email or Discord, we retain the contents of those communications to respond to your request and improve support quality.
1.6 Agent Activity & Tool Call Logs
This is the most important section for users of the AI agent gateway and OpenClaw bridge. When an AI agent (such as Claude Code, Cursor, or any MCP client) connects to Aerostack and executes tool calls, we store the following in our D1 database:
- Tool call name — e.g.,
shell_exec,read_file,query_db - Full tool call parameters — this may include file paths, file contents, shell commands, database queries, API request bodies, and any other data the agent passes to a tool
- Execution outcome — whether the call was auto-approved, blocked pending your approval, approved by you, or denied by you
- Approval metadata — who approved or denied, timestamp, and any notes
- Risk level — the classification assigned by our Guardian engine (low / medium / high / critical)
Why we store this: The audit trail and approval system are core features of the platform. Without storing tool call data, we cannot show you what your agent did, enforce approvals, or let you review past activity.
Staff access: Aerostack staff can access stored tool call logs, including parameters, for purposes of customer support, debugging, abuse investigation, and legal compliance. We do not routinely review your agent's activity. Access is logged and limited to authorised personnel. We do not use your agent's tool call data to train AI models.
Retention: See Section 5 for plan-based retention periods. You can delete your activity log at any time from the dashboard — see Section 8.
1.7 Connected OAuth Accounts
When you connect third-party services (such as GitHub, Google, Slack, Notion, Linear, or other OAuth providers) to your workspace, we store encrypted OAuth access and refresh tokens in Cloudflare KV using AES-GCM encryption. These tokens are used solely to perform actions you explicitly authorise — for example, allowing your AI agent to read a GitHub repository or create a Notion page on your behalf.
- Tokens are never logged, never sent to AI model providers, and never shared with third parties
- Tokens are injected at call time only — they are not included in tool call logs
- You can revoke any connected account at any time from the dashboard; revocation immediately deletes the stored token
1.8 Bot & Messaging Platform Data
If you create an AI bot connected to Discord, Telegram, WhatsApp, Slack, or Web Chat, messages sent to your bot by end users are processed through the Platform to generate AI responses. Specifically:
- Message content is passed to your configured AI model provider (e.g., Azure OpenAI, Google Gemini) to generate a response
- Conversation history is stored in D1 per the retention periods in Section 5, subject to your plan
- Aerostack does not use bot conversation data to train AI models
- End users of your bot are subject to the privacy practices of the messaging platform they use (e.g., Telegram's Privacy Policy, WhatsApp's Privacy Policy) in addition to this policy
If you are building a bot for end users, you are responsible for informing those users that their messages are processed by an AI system.
1.9 Mobile App — Device Tokens
The Aerostack mobile app (iOS and Android) uses Firebase Cloud Messaging (FCM) to send push notifications for approval requests and activity alerts. We store your device's FCM push token to deliver notifications. We do not use this token for any purpose other than sending you notifications you have enabled. You can revoke notification permissions at any time through your device settings or the app settings screen.
1.10 Secrets & API Keys Vault
When you store third-party API keys or secrets in your workspace (for injection into MCP server calls), they are encrypted with AES-GCM and stored in Cloudflare KV. Secrets are:
- Never stored in plaintext
- Never included in tool call logs or audit trails
- Never sent to AI model providers
- Injected into MCP calls at runtime only, in memory
- Permanently deleted when you remove a secret from the dashboard
2. How We Use Your Information
- Operate the Platform — authenticate users, route API requests, enforce quotas, deliver edge function results, and power the approval and audit system.
- Billing & Subscriptions — process payments, issue invoices, manage plan upgrades and cancellations.
- Security & Fraud Prevention — detect abuse, apply rate limits, investigate suspicious activity, enforce Guardian approval policies.
- Product Improvement — analyze aggregated, anonymized usage patterns to prioritise features and fix performance issues.
- Customer Support — investigate issues you report, which may require reviewing your activity logs or tool call data.
- Communications — send transactional notifications (OTP codes, billing receipts, approval alerts, important service notices). We do not send marketing emails without your explicit consent.
- Legal Compliance — respond to lawful requests and enforce our Terms of Service.
What we never do
- ✗ Sell your personal information to third parties
- ✗ Use your project data, tool call logs, or API traffic to train AI models
- ✗ Share your data with advertisers
- ✗ Read your agent's activity logs for any purpose other than support, debugging, or legal compliance
- ✗ Use your stored OAuth tokens or secrets for any purpose other than executing actions you authorised
3. Data Sharing & Third-Party Processors
We share data only as described below. All sub-processors are bound by data protection agreements.
| Processor | Purpose | Data Shared |
|---|---|---|
| Cloudflare | Infrastructure — Workers, D1, R2, KV, Durable Objects, Vectorize | All Platform data. Processed at the edge globally. |
| Razorpay | Payment processing | Name, email, billing address, payment method tokens |
| Resend | Transactional email delivery | Email address, message content (OTP codes, receipts, alerts) |
| Azure OpenAI | AI inference (when you use AI Gateway or bots) | Prompts and model parameters you or your agent submits. Not tool call logs. |
| Google Gemini | AI inference (when configured as model provider) | Prompts and model parameters you or your agent submits. Not tool call logs. |
| Firebase (Google) | Mobile push notifications | FCM device token only. No message content. |
| GitHub / Google | OAuth login (optional) | OAuth token; we store only your profile name and email |
We do not share tool call parameters, file contents, database query results, or shell command outputs with any AI model provider. Only the message or prompt you or your agent explicitly sends to an AI model is passed to that provider.
4. Cookies & Local Storage
The Platform uses minimal browser storage:
- Strictly necessary cookies — session tokens required for authentication. No tracking cookies.
- Local storage — theme preference (light/dark) and dashboard UI state. No personal data.
We do not use third-party advertising cookies or behavioral tracking pixels.
5. Data Retention
5.1 Agent Activity Logs & Bot Conversation History
Retention is based on your subscription plan:
| Plan | Retention Period | |
|---|---|---|
| Free | 30 days — auto-deleted after 30 days | |
| Starter | 90 days | |
| Pro | 6 months | |
| Business | 1 year |
Regardless of your plan, you can delete your activity log at any time from the dashboard — see Section 8. Deletion is immediate and permanent.
5.2 Other Data
- Account data — retained while your account is active. Deleted within 30 days of account closure, except where required by law.
- API request logs — 90 days on Starter; configurable on Pro and above.
- Billing records — retained for 7 years for tax and accounting compliance (legally required).
- Project data (D1 databases, R2 files) — retained until you delete the project or close your account. Cloudflare Time Travel (30-day point-in-time restore) applies.
- OAuth tokens — retained until you revoke the connection.
- FCM device tokens — retained until you disable notifications or uninstall the app.
- Encrypted backups — retained for up to 30 days.
6. Data Security
We implement industry-standard safeguards including:
- Passwords hashed with PBKDF2 (600,000 iterations); automatic re-hash on login to latest standards
- Authentication tokens hashed with SHA-256 before storage
- All data in transit encrypted with TLS 1.2+
- Data at rest encrypted by Cloudflare (AES-256)
- OAuth tokens and workspace secrets encrypted with AES-GCM before storage in Cloudflare KV
- JWT short-lived access tokens (15 min) with rotating refresh tokens
- OTP rate limiting: 3 attempts per window; 60-minute lockout on failure
- Cloudflare DDoS protection and WAF on all API endpoints
Important note on tool call logs: Agent activity logs stored in D1 (tool call parameters, shell commands, file contents, etc.) are protected by Cloudflare's at-rest AES-256 encryption but are not additionally encrypted at the application layer. Authorised Aerostack staff can access this data for support and compliance purposes.
No system is 100% secure. If you discover a security vulnerability, please report it to security@aerostack.dev.
7. International Data Transfers
Aerostack is incorporated in the United States. The Platform runs on Cloudflare's global edge network. By using the Platform, you acknowledge that your data may be processed in any country where Cloudflare operates data centers.
For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on Standard Contractual Clauses (SCCs) as the legal mechanism for cross-border data transfers.
8. Your Rights & Data Controls
You have the following rights. Most of these can be exercised directly from the dashboard without contacting us.
8.1 In-Dashboard Controls
- Delete activity log entries — go to Settings → Data & Privacy → Activity Log. Delete individual entries or all activity in bulk. Deletion is immediate and permanent.
- Set activity retention — choose to retain less data than your plan maximum.
- Revoke OAuth connections — go to Settings → Connections. Revocation immediately deletes the stored token.
- Revoke API keys — go to Settings → API Keys.
- Export your data — go to Settings → Data & Privacy → Export. Download your activity logs, project configs, and account data as JSON.
- Delete your account — go to Settings → Personal Info → Danger Zone. All data is deleted within 30 days, except billing records required by law.
8.2 Rights by Request
To exercise any right not available in the dashboard, email privacy@aerostack.dev. We respond within 30 days.
- Access — request a copy of all personal data we hold about you.
- Correction — update inaccurate information.
- Portability — receive your data in a machine-readable format.
- Objection / Restriction — object to or restrict certain processing activities.
- Withdraw Consent — where processing is based on consent (e.g., marketing emails), withdraw at any time.
9. Children's Privacy
The Platform is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us at privacy@aerostack.dev and we will delete it promptly.
10. Third-Party Links & Marketplace
The Platform includes an MCP Marketplace and community listings created by third-party developers. Aerostack is not responsible for the privacy practices of third-party APIs, MCP servers, or services you connect to through the marketplace. Review each provider's privacy policy before use.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-dashboard notice at least 14 days before taking effect. The "Last updated" date at the top of this page reflects the most recent revision. Your continued use of the Platform after changes take effect constitutes acceptance of the updated policy.
12. Contact Us
For privacy-related questions or requests: