Privacy.

Who runs this site

Aedonyx is the trading name of JEM Consulting Associates, Inc., a New York corporation on Long Island, New York. Questions about your information go to james@aedonyx.io or (516) 417‑2498.

When you read the site

• No advertising or tracking cookies. The public pages set no cookies, so there is no cookie banner.
• A visitor count. Aedonyx runs its own copy of Umami, an open-source analytics program, on its own server. It counts page views and a few clicks. It records which pages are read and when, including the full page address; the site you came from; your browser, operating system and device type; your screen size and browser language; the country, region and city worked out from your address; and when you press the email, call, contact or save-contact buttons. Your IP address is not stored: it is hashed with a rotating salt into an identifier that cannot be reversed and that expires. The count records nothing you type into a form. There is no Google Analytics, no advertising network, no tracking pixel and no session recording.
• Server logs. The server writes one line per request with your IP address, the page and your browser. The logs are used to keep the server running and to block abuse, and are deleted after a short time.

When you use the Discuss a project form

The form asks for your name, your email and a description of what you need. With it the server records the time and your IP address, which are used to tell real inquiries from automated ones.

• The inquiry is stored on Aedonyx's server in New York.
• A copy is emailed to james@aedonyx.io. The email is sent by Brevo, an email service based in France; the domain's mail forwarding (Porkbun, United States) passes it to a Google (Gmail) mailbox. Those three handle it only to deliver it.
• Aedonyx uses it to reply, to stop spam and abuse, and for any work that follows. Your details are not sold or rented, are not shared except with the services that deliver them, and are not added to a mailing list.
• An inquiry that becomes a project is kept with the project's records. One that does not is kept until you ask for it to be deleted.

When you ask for a portal account

The portal's request form asks for your company, your name, email and phone, your website, your business address and a message. With it the portal records the time, your IP address and your browser, to tell real requests from automated ones and to limit how often one connection can send.

• The request is stored on Aedonyx's server in New York and emailed to Aedonyx through Brevo, as in section 3.
• Aedonyx uses it to decide whether to open an account and to set one up. The request stays on file, approved or declined, with the date and who decided, until you ask for it to be deleted.

When you have a client portal account

The portal at aedonyx.io/portal/ is for Aedonyx's clients. It holds:

• Your account: name, email, phone and job title, and the role your company gave you.
• Your company's billing details: company name, contact, billing email, phone and address, your invoices and payment records, and, if you pay online, the payment method's label (for example "Visa ending 4242") and Stripe's reference for your company.
• Sign-in security: your password, stored only as a one-way hash; your authenticator app secret and recovery codes if you turn on two-step sign-in; and, if you choose text message codes, your mobile number.
• What you send: support requests, the messages in them, and files you upload.
• Security records: each sign-in session with its IP address and browser, failed sign-in attempts with the email tried and the IP address, and an activity log of actions on the account (for example "invoice paid", "request opened") with the IP address. These are used to keep accounts secure and to answer "who did this?".

Cookies in the portal are only the ones it needs to work: your sign-in; a security token that blocks forged requests, which is set as soon as you open the sign-in or request page; a short-lived cookie that carries a status message to the next page; a cookie that recognises a browser you have used before, so the portal can email you when a new one signs in; and whether you left the side menu open or closed. None is used for advertising or shared with anyone.

Who else handles portal information:

• Brevo (France) sends the portal's emails: invitations, password resets, sign-in alerts, invoices and notices.
• Twilio (United States) sends text-message sign-in codes, only if you choose that method. Your number is used for sign-in codes and nothing else.
• Stripe (United States) takes card and bank payments. Your full card or bank account number goes to Stripe and is never stored by Aedonyx; Aedonyx keeps the payment method's type and last four digits and a record of each payment.
• Have I Been Pwned checks new passwords against known breaches. Only the first five characters of a one-way hash of the password are sent; the password itself never leaves the server.

Support access. To answer a support request Aedonyx can view your company's portal as you see it. Each time this happens it is recorded with the time and who did it.

Websites Aedonyx hosts for clients

If you visit a website that Aedonyx hosts for one of its clients, that website belongs to the client. The client decides what its site collects; Aedonyx stores and serves it on the client's behalf, keeps the server logs described in section 2, and does not use those visitors' information for anything else. Questions about a client's site go to that business, under that site's own privacy page.

AI tool engagements

Tools Aedonyx builds for a client run in the client's own environment and on the client's own AI provider account, as the engagement's written agreement sets out. Client files Aedonyx is given during an engagement are used for that engagement only and are handled as the agreement says.

Where your information is

Aedonyx's servers are in New York, rented from DigitalOcean. Email passes through Brevo (France), Porkbun (United States) and Google (United States); text codes through Twilio (United States); payments through Stripe (United States); the password check through Have I Been Pwned. Aedonyx does not otherwise move your information outside the United States.

How long it is kept

Only as long as it is needed. Server logs and backups are deleted after a short time. Inquiries and account requests are kept until you ask for them to be deleted, or with the project's records if they become a project. Portal accounts are kept while your company is a client; invoices and payment records are kept as long as tax law requires.

Security

Aedonyx keeps reasonable safeguards for the information it holds: encrypted connections, passwords stored as one-way hashes, two-step sign-in available on every portal account, sign-in throttling and lockout, and key-only administrative access to its servers. If a breach affects your information, Aedonyx will tell you as New York law requires.

Your choices

• Ask what Aedonyx holds about you, have it corrected, or have it deleted: email james@aedonyx.io. Deletion is honoured unless the information is part of a record Aedonyx must keep, such as an invoice.
• Portal users can change their own name, phone, password, sign-in method and email notices on the Account page.
• You do not have to use either form. Email instead.
• Aedonyx does not sell personal information and does not track you across other sites. It does not respond to browser "Do Not Track" signals because there is nothing to turn off. No third party tracks you on this site.

Children

This site is for businesses and is not directed at anyone under 18. Aedonyx does not knowingly collect information from children.

Changes

This page carries its effective date. Changes are made here. A change that affects how information you already gave is used will be emailed to you.