Privacy
policy.

1. Who we are

AerStudio is operated by Gheorghiu C. Andrei PFA, a sole trader registered in Romania (tax ID 43579225, trade register F12/80/2021), based in Cluj-Napoca. We are the data controller for the data described here. Contact: hello@aerwebdesign.com.

2. What we collect

When you contact us

The enquiry form asks for your name, email address, phone number and a short description of your project. We use them only to reply to you and to prepare an offer.

When you sign in to the AerStudio platform

The admin area (admin.aerwebdesign.com) and client panels are available only to people we have invited. To sign you in we process your email address and, when you choose Sign in with Google, the basic profile Google shares with us: your name, email address and profile picture. We also keep the date of your last sign-in and a secure session cookie that keeps you logged in.

Data inside the platform

Content you or your team add to the platform (website content, leads, contacts) is processed on your behalf, under the agreement we sign with your business.

3. Google user data

Sign in with Google is used only to confirm your identity. We request the openid, email and profile scopes and nothing else. We do not read your Gmail, Drive, Calendar or contacts, we do not use Google user data for advertising, and we do not sell or share it. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

4. Cookies and analytics

The public website sets no advertising or analytics cookies. The platform uses strictly necessary cookies for your signed-in session.

5. Legal basis

We process enquiry data to take steps at your request before a contract, platform account data to perform our contract with you or your business, and security logs on the basis of our legitimate interest in keeping the service safe.

6. Service providers

We use a small set of providers who process data on our instructions:

• Vercel: website and platform hosting.
• Supabase: database and sign-in, hosted in the European Union (Frankfurt).
• Resend: sending sign-in links and enquiry emails.
• Cloudflare: DNS and email routing.
• Google: Sign in with Google, when you choose it.

Where a provider transfers data outside the European Economic Area, the transfer relies on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

7. How long we keep data

Enquiries are kept for up to 2 years after our last conversation. Platform accounts are kept while access is active and deleted within 30 days after access ends, unless your business asks otherwise. Invoices and contracts are kept for the period required by Romanian law.

8. Your rights

You can ask for access, correction, deletion, restriction, portability or object to processing by writing to hello@aerwebdesign.com. You can also remove AerStudio from your Google account at any time from your Google account permissions page. If you believe your data is handled incorrectly, you can complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro).

9. Security

Data travels over encrypted connections, access to the platform is limited to invited people, and each client business sees only its own data.

10. Changes

When this policy changes, we update the date at the top of this page.