Privacy Policy

Aislera ("Aislera", "we", "us", "our") provides an AI assistant that reads wedding-related emails and delivers summaries by email or WhatsApp. This policy explains how we handle personal data.

Data controller: Aislera. Contact: hello@aislera.co.uk.

• Account data: name, email address, authentication identifiers from Supabase.
• Profile data: Wedding date, phone number, country code and user preferences. A phone number is required to create an account, but WhatsApp delivery can be disabled in your settings.
• Connected mailbox data: the email address of the Gmail or Microsoft account you link, and its OAuth access and refresh tokens.
• Email content we access: Email headers, including sender and recipient addresses, subject lines and dates, and message bodies of emails retrieved for analysis. Aislera uses these details to identify wedding-related supplier conversations and generate summaries, actions and deadlines. We may also access attachment metadata, including filenames, file types and sizes, where available.
• Generated content: AI-generated summaries, action items, deadlines, supplier updates and follow-up information derived from email content.
• Delivery data: WhatsApp / email delivery status and timestamps.
• Technical data: IP address, browser, device, log data.
• Payment data (if you subscribe): handled by Stripe — we do not store card numbers.

When you connect Gmail (via the Google Gmail API) or Outlook (via Microsoft Graph), Aislera accesses email data using read-only permissions. We retrieve email information needed to identify wedding-related conversations, group them by supplier and generate summaries.

Email content may be processed temporarily during retrieval and automated classification, including before we determine whether a message is relevant to your wedding. We use this processing to identify relevant supplier conversations, actions, deadlines and follow-ups.

We store selected email metadata, such as sender, subject, thread ID and timestamps, together with AI-generated summaries and related action information, where needed to provide your dashboard and daily briefings. We do not retain a permanent copy of your entire mailbox.

Aislera does not use your email data for advertising or sell it to third parties. No human at Aislera routinely reads your emails. Access by authorised engineers may occur when necessary for debugging or safety, subject to internal controls.

Use of Google data: Aislera uses data obtained through Google services only to provide and improve the user-facing features described in this Privacy Policy, in accordance with the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google user data for advertising or sell it to third parties.

Aislera's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Use of Microsoft data: Aislera uses data obtained through Microsoft services, including email content, only to provide the features described in this Privacy Policy, such as identifying wedding-related conversations and generating summaries, actions and deadlines. We do not use Microsoft user data for advertising or sell it to third parties.

Google and Microsoft OAuth tokens are stored encrypted at rest in our database (Supabase, hosted on eu-west-1). Tokens are used only to fetch emails on your behalf. You can revoke access at any time from your Google Account or Microsoft Account settings, or from within Aislera by disconnecting your mailbox — this deletes the tokens from our systems.

To provide Aislera's email analysis and summarisation features, we use third-party AI services. Email content and related information required to provide these features may be processed through third-party AI services. We may use different AI models from time to time as our services develop. We currently use OpenRouter as an AI API and routing service. OpenRouter transmits AI requests to the AI model provider selected by Aislera.

We use AI services to analyse and summarise email content and identify information such as supplier updates, actions, deadlines and follow-ups. The information sent for AI processing may include the contents of relevant email messages and information necessary to understand the email conversation. AI processing is used to provide the features described in this Privacy Policy. Aislera's AI services do not send emails or take actions in your email account.

Model training: Aislera does not use your email content to train or develop its own artificial intelligence models. We restrict the use of submitted data by our AI service providers for model training, in accordance with the applicable provider policies and service terms.

Data retention: We take steps to minimise the retention of information processed by our AI service providers. Some information may be retained by providers for purposes such as safety, security or abuse prevention, in accordance with their applicable policies and service terms. We cannot guarantee zero data retention by all providers.

• Providing the service (reading your mailbox, generating summaries, sending briefings) — performance of a contract with you.
• Sending WhatsApp / email briefings — performance of a contract and, where required, your consent (which you can withdraw at any time).
• Security, fraud prevention, service improvement — legitimate interests.
• Legal and regulatory compliance — legal obligation.
• Marketing communications — consent (opt-in only).

• Account data: for the life of your account.
• Email content and AI summaries: Kept until you disconnect your mailbox or delete your account, then purged within 30 days.
• OAuth tokens: deleted immediately when you disconnect your mailbox or delete your account.
• Logs and analytics: 30 days.

Some processors (e.g. OpenRouter, WhatsApp, Microsoft, Google) may process data outside the UK / EEA, including in the United States. Where required, transfers are protected by the UK International Data Transfer Addendum, EU Standard Contractual Clauses and/or the EU–US and UK–US Data Privacy Framework where a processor is certified.

The location in which processing takes place may vary depending on the service and infrastructure used by our providers. Where personal data is transferred outside the UK, we use an appropriate legal safeguard under applicable UK data protection law.

• Supabase — authentication, database and file storage.
• Google (Gmail API) — mailbox access when you connect Gmail.
• Microsoft (Graph API) — mailbox access when you connect Outlook.
• OpenRouter — AI model routing and processing of email content and metadata.
• WhatsApp delivery: WhatsApp Business API.
• Payments: Stripe.
• Hosting / infrastructure: Cloudflare.

Third-party service providers receive personal data only as necessary to provide services to Aislera. We do not sell your personal data, use it for third-party advertising, or share it with data brokers. We do not permit third-party service providers to use your personal data for purposes unrelated to providing the services they provide to Aislera, except where required by law or otherwise permitted under applicable data protection law.

Under UK GDPR and EU GDPR you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• request deletion of your data;
• restrict or object to processing;
• data portability;
• withdraw consent at any time (without affecting prior processing);
• lodge a complaint with your supervisory authority — in the UK, the Information Commissioner's Office (ICO).

Exercise any right by emailing hello@aislera.co.uk. We respond within one month.

You can disconnect Gmail or Outlook at any time from the Aislera dashboard — this removes the OAuth tokens and stops all further email access. To delete your account and all associated data, use the delete option in your account settings or email hello@aislera.co.uk. We complete deletion within 30 days, subject to any legal retention obligations.

Cookies used: Only strictly necessary cookies for authentication and session management. We do not use advertising cookies.

We use TLS in transit, encryption at rest for sensitive fields (including OAuth tokens), access controls and audit logging. No system is perfectly secure — please report suspected issues to hello@aislera.co.uk.

Aislera is not directed at people under 18 and we do not knowingly collect data from children.

We may update this policy. Material changes will be notified by email or in-app before they take effect.

Privacy questions: hello@aislera.co.uk