Privacy Policy

1. Who we are

AECO Shield is operated by AECO.digital, an independent intelligence service for the AEC technology market. Our contact email is hello@aeco.digital.

2. Data we collect

We collect the following data when you use the platform:

• Account data: email address and password (hashed) when you create an account.
• Assessment data: your responses to the Digital Maturity Assessment (40 questions across 7 dimensions), project context inputs, and FitScore session data.
• Usage data: pages visited, tools viewed, filter selections, and session timestamps — used to improve the platform.
• Payment data: billing is handled entirely by Stripe — we do not store card numbers, CVV, or full payment details on our servers. We store only the Stripe customer and subscription identifiers plus subscription state (tier, status, current period end) needed to gate paid features.

3. How we store your data

All data is stored in Supabase (PostgreSQL) with row-level security (RLS) policies. Your firm's assessment data is private by default — only accessible to authenticated users in your account. Public registry data (tool scores, ACS bands) is visible to all users. The platform is deployed on Vercel with global CDN. Environment variables and API keys are never exposed client-side.

4. How we use your data

• To provide and improve platform features (FitScore, maturity assessments, registry).
• To generate narrative summaries via the Anthropic Claude API — called server-side only. Your data is not used to train AI models.
• To send transactional emails (account confirmations today; subscription receipts once paid tiers launch) via our email provider.
• To generate anonymised, aggregated benchmark data shown across the platform (no individual firm data is exposed).

5. We do not sell your data

We do not sell, rent, or share your personal data with third-party advertisers or data brokers. Assessment data is never shared with AI tool vendors or used to influence published scores. Editorial independence is a foundational principle of this platform.

6. Data retention

Your data is retained while your account is active and is exportable on request at any time. A retention schedule for lapsed or cancelled subscriptions (read-only period, archive, deletion) is in progress and will be documented here. Audit-log records are retained for 7 years per our published Quality Policy — this applies regardless of subscription state. You may request full deletion of your account and associated data at any time by emailing hello@aeco.digital.

7. Cookies

We use session cookies for authentication (managed by Supabase Auth). We do not currently use analytics cookies or third-party advertising cookies. If analytics are added later to understand page-level usage, this policy will be updated first and the cookies will be disclosed here.

8. Your rights

You have the right to access, correct, or delete your personal data at any time. To exercise these rights, email hello@aeco.digital with the subject line "Data Request". We typically respond within 5 business days.

9. Changes to this policy

We may update this privacy policy from time to time. Material changes will be communicated by email to registered users. Continued use of the platform after changes constitutes acceptance of the updated policy.

10. Contact

Questions about this policy: hello@aeco.digital