Privacy policy · data handling and retention
This policy explains what data the aileo GEO platform (the “Platform”) collects in the course of providing subscription services, why it is collected, where it is stored, how long it is retained, and how you can export and delete it. Effective date: 2026-09-22. Operating entity: Sinnet Cloud Data Co., Ltd.
1. What data we collect
| Data category | Specific fields | Source | Purpose |
|---|---|---|---|
| Account data | Username, name, email address, mobile number (optional), password hash, role and brand scope | Provided by you at registration or when created by a tenant administrator | Authentication, permission decisions, seat metering |
| Tenant and subscription data | Tenant name, tenant identifier, contact email address, plan, subscription cycle, number of seats, settlement method, AWS Marketplace buyer identifier | Generated at registration, subscription or commercial contracting | Service activation, billing and settlement, entitlement verification |
| Usage metering data | Cumulative totals and itemized ledgers for content publications, GEO monitoring runs, source API calls and seat counts | Recorded automatically when you use platform features | Quota verification, invoice generation, product analytics |
| Business content data | Brand profiles, content drafts and versions, review comments, GEO monitoring samples, source articles and view counts | Created by you within the Platform or submitted through the source API | Delivering the core service; generating static pages served directly to AI engines |
| Security audit data | Logs of sign-ins and sign-outs, permission changes, configuration changes and content state transitions; IP address, User-Agent identifier, session identifier | Recorded automatically by the system | Security protection, incident investigation, compliance auditing |
| Technical data | Request path, response status code, elapsed time | Recorded automatically by the system | Availability monitoring and fault diagnosis |
We do not collect: national identity numbers, biometric characteristics, precise geolocation, address books or photo albums. We do not use third-party advertising tracking scripts or cross-site cookies. The Platform displays no advertising of any kind.
2. How we use this data
- To provide and operate the GEO content management service you subscribe to, including content review and publication, direct structured data output, and AI visibility monitoring;
- To verify plan quotas and generate usage bills, giving a clear notice when a quota is exceeded rather than charging silently;
- To authenticate accounts and isolate permissions, ensuring that data cannot be accessed across tenants or across brands without authorization;
- Security protection, including sign-in rate limiting, detection of anomalous sign-ins and audit trails;
- Product improvement, on the basis of aggregated statistics from which no specific individual or specific client can be identified.
We will not use your business content data to train any general-purpose large model, and we will not sell or exchange personal information with third parties.
3. Where data is stored
Data for the standard edition is stored on Alibaba Cloud ECS within mainland China (region: China East 1, Hangzhou), in a SQLite database (WAL mode) with no direct public-network connection, accessible only to the local service process. If you choose to purchase an overseas-region edition through AWS Marketplace, your business data is stored in the corresponding AWS region, and the specific region is as stated on the product page at the time of subscription.
4. How long we retain data
| Data category | Default retention period | Action on expiry |
|---|---|---|
| Account and tenant data | For the duration of the subscription and for 30 days after cancellation | Enters the deletion process after 30 days |
| Business content data | For the duration of the subscription and for 30 days after cancellation | Enters the deletion process after 30 days |
| Usage metering data | Two full accounting years | Used for reconciliation and tax compliance; aggregated and archived on expiry |
| Security audit logs | 12 months | Automatically purged on expiry |
| Session records | Session lifetime (12 hours by default) plus expiry cleanup | Automatically deleted |
| One-time tokens (reset / activation) | 60 minutes (72 hours for activation), or after first use | Invalidated immediately |
| Public static pages | After content is withdrawn, the page becomes a “retired” page. noindex, no longer indexed | The page is retained but marked as retired, so that links do not break |
5. Your rights and how to exercise them
- Access and correction: a tenant administrator can correct company details under “Tenant & subscription” in the console; account profiles are maintained by the tenant administrator under “User management” in the console.
- Export: a tenant administrator can export this tenant's content, GEO monitoring samples and usage ledger (CSV / JSON).
- Deletion: individual content items, individual brands or an entire tenant can be deleted. Deleting a tenant is irreversible and also deletes its brands, accounts, content and monitoring data.
- Withdrawal of consent: simply stop using the service and cancel the subscription; processing ceases when the service ends.
- Complaints and appeals: raise them through the contact details below and we will respond within 15 business days.
6. Cross-border transfers
Data in the mainland China edition does not leave the country by default. Only when you actively subscribe to an overseas-region edition (for example, purchasing through AWS Marketplace) is the relevant data stored in the overseas region you select; in that case we follow the requirements of Chapter III of the Personal Information Protection Law, using lawful mechanisms such as standard contracts, and we clearly state the data landing region on the subscription confirmation page.
7. Protection of minors
The Platform is intended for enterprise and organizational users. It does not provide services to minors and does not knowingly collect the personal information of minors. If we discover that such information has been collected in error, we will delete it immediately.
8. Cookies and local storage
The Platform uses only one strictly necessary session cookie (aileo_sid), with the attributes HttpOnly + SameSite=Lax + Path=/, used to keep you signed in after you close the browser;
it uses no cookies for advertising or cross-site tracking. The cookie ceases to be valid when you sign out or when the session expires.
9. Security measures
- Passwords are stored using scrypt (N=16384, r=8, p=1, keylen=64) with a random per-account salt, and verified using a constant-time comparison;
- Session tokens are managed in the database and can be forcibly revoked; changing a password, changing a role or disabling an account automatically terminates all of that account's sessions;
- Failed sign-ins are rate limited along two dimensions, “username + IP” and “IP”; eight failures within 10 minutes trigger a lockout;
- All write operations are checked for same-origin; we do not trust
X-Forwarded-Forby default, preventing forged headers from bypassing IP rate limiting; - Security response headers including CSP, HSTS, X-Content-Type-Options and X-Frame-Options are enabled site-wide;
- Directory traversal is blocked at two layers, and error messages never expose stack traces or server-side source code.
10. Changes to this policy
If this policy changes materially, we will give 15 days' advance notice through in-site notifications and email, and we will update the effective date and revision record on this page.
11. Contact details
Email of the person responsible for personal information protection: zheng.wang@sinnet-cloud.cn
Telephone: 4006-888-535
Postal address: 23F, Tower B, Far East International Plaza, 317 Xianxia Road, Changning District, Shanghai
Security issues and vulnerability reports: see .well-known/security.txt
Related documents: Terms of service · Pricing · Talk to sales