Privacy Policy

What personal data Maverik collects, why, who we share it with, how long we keep it, and the rights you have under India's Digital Personal Data Protection Act, 2023.

Last updated 27 October 2026 · Applies to Maverik AI, a subsidiary and proprietary product of Aetheron Solutions.

Pre-launch draft. Maverik AI is not yet generally available. This document is published so you can see how we intend to handle your data, and it will be reviewed by counsel before launch. For anything you need in writing now, email support@aetheron.ai.

1. Who we are

Maverik AI (“Maverik”, “we”, “us”) is a subsidiary and proprietary product of Aetheron Solutions (“Aetheron”), India. This policy explains how we process personal data when you visit our website, create an account, or use the Maverik platform.

For personal data you give us about yourself, Aetheron is the Data Fiduciary under the DPDPA. For personal data your business uploads or connects about its own customers and leads, your business is the Data Fiduciary and Maverik processes that data on your instructions as a Data Processor (see our Data Processing Addendum).

2. Personal data we collect

Data you give us

Account data: name, work email, password (stored only as a secure hash), workspace and role.
Business data: brand name, website, industry, offers, brand voice, and assets you upload.
Billing data: billing name, address, GSTIN if provided, and payment status. Card details are handled by our payment processor; we do not store full card numbers.
Communications: messages you send us through the contact form, email, or support.

Data from platforms you connect

Profile and page data, posts, ad accounts, campaign metrics, and lead form submissions from Meta, Google, YouTube, LinkedIn, Pinterest, WhatsApp, and other connected services, limited to the scopes you approve.
OAuth access tokens, stored encrypted.

Data collected automatically

Device and log data: IP address, browser type, pages viewed, and timestamps, used for security and reliability.
Product usage: features used, agent runs, credits consumed, and errors, used to operate and improve the service.
Cookies as described in our Cookie Policy.

3. Why we use it

Purpose	Data used	Basis under the DPDPA
Provide the platform and run your agents	Account, business, and connected-platform data	Consent you give when you sign up and connect each platform
Billing, invoicing, and tax compliance	Account and billing data	Consent, and legitimate uses for compliance with law
Security, fraud prevention, and audit logging	Log, device, and usage data	Legitimate uses permitted under Section 7
Support and service communications	Account data and messages	Consent
Product improvement using aggregated, de-identified usage	Usage data	Consent
Marketing emails about Maverik	Name and email	Separate, optional consent you can withdraw at any time

We do not sell personal data. We do not use your content or your customers' data to train AI models without your explicit, separate consent.

4. AI processing

Maverik's agents send parts of your brand and campaign data to AI model providers to generate research, copy, images, and video. We send the minimum needed for the task, keep customer personal data out of prompts unless you explicitly enable it, and only use providers whose terms prohibit training on our customers' data. See our Data Use & AI Policy for details.

Sub-processors that host, store, and process data for us, such as cloud hosting, AI model providers, email delivery, and payment processing. The current list is on our Sub-processors page.
Platforms you connect, when you approve an action that writes to them (for example publishing a post).
Aetheron group entities that help us run the service, under the same obligations as this policy.
Authorities, when the law requires it, and only to the extent required.

6. International transfers

Some sub-processors process data outside India. We transfer personal data only to countries not restricted by the Government of India under Section 16 of the DPDPA, and under contracts that require appropriate security. Data residency for enterprise workspaces is agreed per engagement.

7. How long we keep it

Account and workspace data: while your account is active.
After you delete a workspace or close your account: deleted or anonymised within 30 days, except where we must keep it longer by law.
Invoices and tax records: as long as Indian tax law requires.
Security and audit logs: up to 12 months, longer if needed to investigate an incident.
Backups: overwritten on a rolling schedule; deleted data leaves backups within 35 days.

8. Your rights

Under the DPDPA you can:

Ask for a summary of the personal data we process about you and how we process it.
Ask us to correct, complete, update, or erase your personal data.
Withdraw consent at any time. This does not affect processing done before you withdrew.
Nominate another person to exercise your rights if you die or become unable to.
Have your grievances addressed by us, and then, if you are not satisfied, complain to the Data Protection Board of India.

Email support@aetheron.ai with the subject “Privacy”. We respond within the time set by the DPDPA and its rules. We may need to verify your identity first. If your data was uploaded by a business that uses Maverik, we will pass your request to that business, which is responsible for answering it.

9. Security

Data is encrypted with AES-256 at rest and TLS 1.3 in transit. Access is role-based down to individual resources, and actions are recorded in immutable audit trails. SOC 2 is on the roadmap. Maverik AI and Aetheron Solutions are not SOC 2 certified today.

If a personal data breach occurs, we will inform the Data Protection Board of India and affected people as the DPDPA requires.

10. Children

Maverik is a business tool and is not intended for anyone under 18. We do not knowingly process children's personal data. If you believe a child has given us personal data, contact us and we will delete it.

11. Grievance Officer and contact

Grievance Officer, Aetheron Solutions. Email: support@aetheron.ai. Registered office address to be published before general availability.

We will acknowledge a grievance within 24 hours and aim to resolve it within 15 days, as required by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 where they apply.

12. Changes

We will post changes here and update the date at the top. For material changes we will notify account owners by email before they take effect.