Who we are
Aerandil is a UK limited company (company number [company number], registered office [registered office address]). We provide a typed data platform that hospitality businesses run their operations on.
This policy explains how we handle personal data for which we are the controller — principally visitors to this website and the people we deal with at prospective and current customers, partners, and job applicants. For questions about it, contact privacy@aerandil.com.
The two roles we play
It matters which hat we are wearing when we handle personal data.
As a controller, we decide how and why we process the personal data we collect directly — website visitors, enquiries, customer and partner contacts, and applicants. This policy governs that processing.
As a processor, when our business customers use the platform they upload personal data about their own guests and staff. For that data our customer is the controller and we act on their documented instructions under a Data Processing Agreement. If you are a guest of a business that uses Aerandil and you want to exercise your rights over your data, please contact that business directly — they are the controller, and we support them in responding.
What we collect
- Information you give us. When you contact us, express interest as a design partner, or apply for a role: your name, email address, company, role, and the content of your message.
- Customer account information. Business contact details and the authentication identity of personnel at customer organisations. Operator sign-in is provided through our identity partner.
- Technical information. Standard server and security logs — IP address, browser user-agent, timestamps, and the pages requested — collected by our hosting and security infrastructure to operate and protect the service.
Cookies & tracking
This website is deliberately privacy-light. It uses no analytics, advertising, or social-media tracking cookies, embeds no third-party trackers, and self-hosts its fonts — so simply browsing the site makes no call to a third-party font or analytics provider.
The only cookies that may be set are strictly-necessary ones used by our hosting and content-delivery provider to serve and secure the site. We do not use cookies to profile you or track you across other websites.
How we use personal data
We use personal data for the purposes below, each resting on a lawful basis under UK and EU data protection law.
- To respond to you. Answering enquiries and providing information you request — taking steps prior to a contract, and our legitimate interest in responding to people who contact us.
- To provide & secure the service. Operating, securing, and improving the platform and website — performance of our customer contracts, and our legitimate interest in running a reliable, secure service.
- To manage relationships. Administering customer, partner, and applicant relationships — performance of a contract and our legitimate interests.
- To meet legal obligations. Complying with tax, accounting, and other legal and regulatory duties — compliance with a legal obligation.
- Our commitments. We do not sell personal data, and we do not make automated decisions that produce legal or similarly significant effects. Where we rely on legitimate interests we weigh them against your rights, and you can object at any time.
Sharing & sub-processors
We share personal data only with service providers who help us run Aerandil, under contract and only as needed. A current sub-processor list is available, and our Data Processing Agreement governs processing we carry out on behalf of customers.
- Cloud infrastructure. Amazon Web Services — hosting and the managed database tier.
- Operator identity. WorkOS — single sign-on and multi-factor authentication for operator access.
- Legal & corporate. We may disclose data where required by law, to protect our rights, or in connection with a corporate transaction — with appropriate safeguards in place.
International transfers
We are UK-based, and we host customer data in the region a customer's residency settings require — built so EU data stays in the EU, UK data in the UK, and US data in the US.
Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards — UK adequacy regulations, the UK International Data Transfer Agreement, or EU Standard Contractual Clauses — together with a transfer risk assessment where one is required.
Retention
We keep personal data only as long as necessary for the purposes above, then delete or anonymise it. Enquiry and prospect data is kept for as long as we need it to deal with your request and our relationship; account data for the life of the customer relationship and as long as the law requires afterwards.
Within the platform, data is held under per-category retention windows and is erasable on request — see the security whitepaper for the technical detail.
Security
We protect personal data with the controls set out in our security whitepaper: encryption in transit and at rest, database-level tenant isolation, least-privilege access, an immutable audit log, and a signed software supply chain. No method of transmission or storage is perfectly secure, but security is built into how the platform works rather than added around it.
Your rights
Under UK and EU data protection law you have the right to access your data; to have it corrected or erased; to restrict or object to its processing; to data portability; and to withdraw consent where we rely on it. You will not be treated less favourably for exercising any of these rights.
If you are a US resident, you have rights under laws such as the CCPA/CPRA to know about, access, delete, and correct your personal data, and to opt out of its 'sale' or 'sharing' — which we do not do.
To exercise a right, email privacy@aerandil.com. If your request concerns data we process on behalf of a business customer — for example, if you are their guest — please contact that business, who is the controller; we will assist them in responding.
Complaints
We would like the chance to resolve any concern first, so please contact us. You also have the right to complain to a data protection regulator. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EEA it is your local supervisory authority.
Children
Aerandil is a business-to-business platform and is not directed to children. We do not knowingly collect personal data from children through this website.
Changes & contact
We may update this policy as our service and obligations evolve. We will post the new version here and update the date below; we will flag material changes where appropriate.
Questions, requests, or complaints: privacy@aerandil.com. [Registered office address and EU representative details to be listed here once confirmed.]
- Last updated. June 2026
- Contact. privacy@aerandil.com