Privacy Policy
Version 1.1 — effective 2026-08-17
This policy explains what personal data aerelontech.hu collects, why, and what
you can do about it. It is written under the EU General Data Protection
Regulation (GDPR) and Hungarian Act CXII of 2011 on informational
self-determination.
1. Controller
AerelonTech Kft.
- 1023 Budapest, Árpád Fejedelem útja 26-28, 5. floor, Hungary
- Company registration number:
01-09-458461 - EU VAT number:
HU33087867 - E-mail:
sandor@aerelontech.hu
We are not required to appoint a Data Protection Officer and have not appointed one. Privacy questions go to the address above.
2. What we collect, why, and on what legal basis
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Google account name, e-mail address, Firebase user ID | Creating your account, signing you in, tying purchases to you | Contract — Art. 6(1)(b) | Until you ask us to delete the account |
| Order data: product, price, currency, time, order reference | Selling and delivering the package, and e-mailing you the confirmation with your download link | Contract — Art. 6(1)(b) | 8 years (accounting law) |
| Billing country, and company name or VAT number if you give one | Reconciling orders and evidencing where a sale was made | Legitimate interest — Art. 6(1)(f) | 5 years |
| Billing name and address in full, payment card details | Taking payment, calculating tax, issuing your invoice | We never see or store these — Paddle is the seller and handles them under its own privacy notice | — |
| Confirmation given before download, and download records (time, source IP, file version and hash) | Evidencing delivery and the withdrawal position, including where a refund or chargeback is disputed | Legal obligation and legitimate interest — Art. 6(1)(c), (f) | 5 years (limitation period) |
| Support and withdrawal correspondence | Answering you, handling refunds | Contract and legitimate interest — Art. 6(1)(b), (f) | 5 years |
| Analytics events and identifiers (see §4) | Understanding how the site is used | Consent — Art. 6(1)(a) | 14 months |
| E-mail address given to the waitlist form | Telling you when a product launches | Consent — Art. 6(1)(a) | Until you unsubscribe |
| Server and access logs | Keeping the site up and secure, preventing abuse | Legitimate interest — Art. 6(1)(f) | 90 days |
Our legitimate interests are running a secure service, preventing fraud and unauthorised sharing of paid downloads, and being able to prove what we delivered and when.
Your billing details are given to Paddle, not to us. Paddle is the seller and needs them to charge the correct tax and issue your invoice; we receive only what is listed above. Analytics and waitlist consent are entirely optional and nothing on the site depends on them.
3. Cookies and local storage
We use as few as we can. Nothing in the "analytics" row below is set until you accept.
Strictly necessary — no consent required
session— a cookie our backend sets after sign-in, so gated documents can check that it is really you. Expires with the session.- Firebase Authentication stores your sign-in token in your browser's local storage. Without it you would be signed out on every page load.
at-cookie-consent— local storage entry remembering the choice you made in the cookie banner. Storing it is what stops us asking again.
Analytics — only after you accept
- Google Analytics 4 sets
_gaand_ga_<id>cookies (up to 2 years) to distinguish visitors. IP anonymisation is on. We do not use GA for advertising, remarketing or profiling, and we have not enabled Google Signals.
Set by third parties on their own pages or frames
- Paddle sets cookies on its own checkout, whether shown as an overlay on our page or on its own pages, for fraud prevention and to run the payment.
- Pages that embed a Gridd visualisation, or the waitlist form, load a frame from that provider, which may set its own storage.
You have not made a choice yet. .
Blocking cookies in your browser also works. Blocking the strictly necessary ones will break sign-in and downloads.
4. Analytics
We use Google Analytics 4 (measurement ID G-4TF7Z7HQB9). The Google
Analytics script is not loaded at all until you accept in the cookie banner —
if you decline or ignore it, no request to Google is made and no analytics
identifier is created.
We use it only in aggregate, to see which pages are read. We do not try to identify individuals from it and we do not combine it with your purchase data.
5. Who else processes your data
| Recipient | Role | What they get | Where |
|---|---|---|---|
| Paddle.com Market Ltd (England and Wales, no. 8172165) — or Paddle.com Inc. for buyers in the United States | Merchant of record. Not our processor: Paddle is the seller and an independent controller for the sale, deciding for itself how it handles your data under its own privacy notice | Name, e-mail, billing address, VAT number, card data, order details. Plus, where a refund or chargeback for your order is disputed, the download records described in §2 | United Kingdom / US |
| Google Ireland Ltd. (Firebase Authentication) | Sign-in | Google account identity, e-mail, sign-in metadata | EU / US |
| Google Ireland Ltd. (Google Analytics) | Analytics, only with consent | Usage events, analytics identifier, truncated IP | EU / US |
| Google Ireland Ltd. (Google Forms) | Waitlist form, where embedded | What you type into the form | EU / US |
| Resend (Plus Five Five, Inc.) | Transactional email — purchase receipts and order notices | E-mail address, name, order reference | EU |
| GetLaunchList | Waitlist sign-ups, where that form is used | E-mail address | US |
| Our accountant and invoicing provider | Bookkeeping and the invoice we issue to Paddle | Payout and settlement data. We do not issue an invoice in your name, so your billing details are not part of it | Hungary |
| Hungarian Tax and Customs Administration (NAV) | Statutory invoice reporting | The invoice we issue to Paddle. Your purchase is not separately reported to NAV by us | Hungary |
We do not sell personal data, and we do not share it for anyone else's marketing.
Because Paddle is the seller, we no longer issue a tax invoice in your name or report your purchase to the Hungarian tax authority — Paddle invoices you under its own registrations. That is why the billing data we hold is now limited to what §2 lists.
Where a recipient processes data in the United States, the transfer relies on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses. Transfers to the United Kingdom rely on the European Commission's adequacy decision for the UK.
6. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects for you. VAT rate determination from your billing country is an automatic calculation, not a decision about you.
7. Your rights
You may ask us to:
- access the data we hold about you, and get a copy;
- rectify anything inaccurate;
- erase it ("right to be forgotten") — subject to invoice data we must keep by law for 8 years;
- restrict or object to processing based on legitimate interests;
- port the data you gave us to another provider in a machine-readable form;
- withdraw consent at any time, for analytics or the waitlist. Withdrawing does not affect processing already carried out.
Write to sandor@aerelontech.hu. We answer within one month. There is no charge
unless a request is manifestly unfounded or excessive.
8. Complaints
If you think we have handled your data badly, please tell us first — we would rather fix it. You also have the right to complain to the Hungarian supervisory authority:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
1055 Budapest, Falk Miksa utca 9-11., Hungary
Postal address: 1363 Budapest, Pf. 9.
ugyfelszolgalat@naih.hu — +36 1 391 1400 — naih.hu
If you live in another EU country you may complain to your own supervisory authority instead. You may also go to court.
9. Security
Access to your data is limited to what is needed to run the service. Traffic is served over HTTPS. Paid files are stored in private object storage and are never publicly addressable — every download is streamed through our backend after we check that you are signed in and that you bought the product.
10. Children
The Site is not aimed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, write to us and we will delete it.
11. Changes
We may update this policy. The current version and its effective date are always at the top of this page; material changes will be announced on the Site.