Privacy Policy

This policy explains what personal information Aard Pty Ltd (ABN 48 697 662 383, “Aard”) collects, how we use it, and the choices you have. It applies to our website, MCP server, and API.

What we collect

• Account information — name, work email, organisation — provided when you sign up.
• Usage metadata — timestamps, tool names, request counts and the content of each request — the question or parameters sent to a tool, capped at one kilobyte — used to operate the service and to improve how it answers.
• Connection information recorded with each request — your IP address, the User-Agent string sent by your client software, and the country and network your request reaches us from. We use this to identify which client applications are calling the service, to enforce rate limits, and to investigate abuse.
• Billing information for paid plans is processed by Paddle.com Market Limited, our merchant of record. Card numbers never touch our servers. Paddle handles payment processing, tax collection, and invoicing on our behalf; their processing is governed by Paddle's privacy policy in addition to this one.
• Support correspondence you send to us, retained for the duration of the issue.

How we use it

We use the information above to provide the service, enforce rate limits, prevent abuse, bill paid accounts, and improve Aard's accuracy. We do not sell personal information. Query content is not used to train models without your explicit, account-level opt-in.

Retention

Operational logs, including the connection information described above, are retained for ninety days and then deleted automatically. Account records are retained while your account is active. As an exception to the ninety-day default, webhook notifications from our payments provider are retained in full for up to 180 days for audit and reconciliation purposes, then deleted by the scheduled retention purge. You may request deletion at any time and we will remove personal information within thirty days, except where retention is legally required.

Sharing

We share information with subprocessors who help us run the service (hosting, payments, email). A current list is available on request. We may disclose information if required by law, and will notify affected users unless prohibited.

Your rights

Depending on your jurisdiction you may have the right to access, correct, export or delete your personal information. Contact privacy@aard.ai to exercise any of these rights.

One limit on deletion and export, stated plainly. When a request reaches us through a credential belonging to an organisation rather than to you personally, the usage record we keep is attributed to that organisation. Those records include the connection information described above, and an individual's deletion or export request does not reach them: they belong to the organisation, whose administrator can ask us about them. They are still covered by the ninety-day retention limit above, which deletes them automatically. The same applies to requests we cannot attribute to any account at all — for example an unauthenticated request — where the ninety-day deletion is the only mechanism, because there is no subject for us to match a request against.

Contact

Questions about this policy, or about how your information is handled, can be sent to privacy@aard.ai.