Privacy Policy

Who we are

Anthenos is a product of Aethric LLC (“Aethric”, “we”, “us”). Anthenos is an AI operator for the customer and procurement portals that suppliers, manufacturers, distributors and other businesses work in. It handles routine portal work — such as acknowledging purchase orders, submitting invoices, uploading shipping and fulfilment information, and checking order, invoice, shipment and payment statuses — detects exceptions, asks a person to approve sensitive actions, and keeps a record of everything it does.

This policy explains how we handle personal information when you visit anthenos.com, create an account, use Anthenos, or contact us. Aethric LLC’s registered address is To be confirmed by Aethric LLC: its registered address. Privacy questions and requests go to hello@aethric.llc.

Our role, and yours

For account, billing, website and security information, Aethric decides why and how the information is used, and is responsible for it as a controller (or “business”, in California’s terms).

For the business content a customer puts into Anthenos or authorises Anthenos to reach — purchase orders, invoices, shipment details, portal records, documents and the people named in them (“Customer Content”) — the customer decides what Anthenos processes and why. For that content Aethric acts on the customer’s behalf, as a processor (or “service provider”), under the customer’s instructions and our Data Processing Addendum. If your information reached Anthenos through one of our customers, please also contact that business about it.

What information we collect

Account information

• Your name and email address.
• The organization you work for, as the name of your Anthenos workspace, and your role in it.
• Authentication information. A password is stored only as a one-way scrypt hash; the password itself cannot be read back. If you choose “Continue with Google”, we receive your Google account identifier, email address and name, and keep no Google access token.
• Sign-in sessions: which account and workspace each belongs to, when it was last used and when it expires. Your IP address and browser are not stored with them.
• Workspace information: its settings, its members and their roles, the portals it works in, and the rules it sets for which actions need approval.

Billing information

Your plan, its status and dates, the subscription and customer identifiers our payment processor, Stripe, gives us, and the price and terms you were shown when you started a plan or trial. Card details are entered on Stripe’s own pages and processed by Stripe; we do not receive or store your card number.

Product usage and technical information

• Actions performed in your workspace — work items created, approvals given or refused, portals added, settings changed — with when they happened and who performed them. This is your workspace’s activity record and audit trail.
• A security audit log of events such as sign-ins, billing changes and connections, which can include the acting person’s email address and a keyed hash of the IP address the request came from.
• Records of AI model use: which model, how much it was used, the cost, and how long it took.
• Server logs and diagnostics: requests, errors, timestamps and the identifiers of the workspaces involved, with passwords, tokens and keys removed. Our hosting provider’s request logs may also record technical information such as your IP address and your browser’s user agent.
• To slow down anyone guessing passwords, sign-in and sign-up attempts are counted against a keyed hash of your IP address and of the email address used.

We do not use analytics tools to record which pages you view or how you move through Anthenos.

Portal and workflow data

To complete the work your business authorises, Anthenos processes the information that work involves, which can include:

• purchase order information: numbers, dates, line items, quantities and prices;
• invoice information: numbers, amounts, dates, terms and line items;
• shipment and fulfilment information: carriers, tracking numbers, dates, quantities;
• order, invoice, shipment and payment statuses, and portal records;
• documents you upload or that a workflow uses, and the identifiers and metadata needed to match one record to another;
• the customers and portals your workspace works with, including their names and addresses;
• the evidence Anthenos keeps of each step: what it read back from a portal to verify the result, any exception it found, and who approved what.

This information may include personal information about your staff, your customers’ staff and other business contacts, such as names, work email addresses and phone numbers that appear in business documents.

Connected accounts and systems

You may connect third-party systems — such as customer portals, email, ERP systems, business applications and APIs — and authorise Anthenos to access the information needed to complete your workflows. Email and business-application connections are made through Composio, which holds the access the connection grants; Anthenos keeps an encrypted reference to the connection and the connected account’s display name or email address. What Anthenos reads through a connection is used for the work that needed it and kept with that work.

Credentials and sign-ins

Some portals and systems need a sign-in. Authentication credentials and tokens are protected using technical safeguards, including encryption where supported by the system. Specifically:

• When you sign in to a portal or other system through Anthenos’s secure sign-in, what you type is encrypted while it waits to be entered into that system, and deleted as soon as it has been.
• The resulting signed-in session, API keys you give Anthenos, and the references to connected accounts are stored encrypted (AES-256-GCM), and are decrypted only on our servers when a workflow needs them.
• Our systems must be able to use these credentials to do the work you ask for. Access to them is limited to the parts of the service that need them.

When you contact us

If you email us — for support, a demo, a privacy request or anything else — we receive what you send, including your email address and anything you include. The demo form on our website composes an email in your own mail program; nothing you type in it is sent to us until you send that email.

AI processing

Anthenos may process authorised business data with AI models to interpret documents, understand portal interfaces, classify incoming work, detect exceptions and assist with completing workflows. Depending on the task, a request to a model can include the work being done, text extracted from a document, and a description of a portal page with secrets, anything shaped like a token and the query values in page addresses removed.

Passwords, what you type into secure sign-in, and signed-in sessions are not sent to AI models. Text read from a document or a portal is treated as information, not as an instruction to Anthenos.

By default, model requests go through OpenRouter to hosted models, and Anthenos asks OpenRouter to route them only to model providers that state they do not retain or train on request data. Anthenos can also be configured to use model providers such as OpenAI or Anthropic directly. Each provider processes requests under its own terms; the Subprocessors page lists the providers we use. We do not use Customer Content to train AI models.

AI output can be wrong. That is why Anthenos verifies results against the portal where it can, flags exceptions, and asks a person to approve sensitive actions.

How we use information

• To provide and operate Anthenos.
• To create your account, authenticate you and keep you signed in.
• To execute the workflows you authorise, in the portals and systems you connect.
• To verify outcomes, detect exceptions and request human approvals.
• To maintain activity records and audit trails.
• To prevent fraud, abuse and security incidents.
• To provide support and respond to your requests.
• To improve the reliability and performance of the product.
• To bill for your plan and apply its limits.
• To comply with legal obligations and enforce our terms.
• To tell you about changes to the service, these policies or your account.
• With your permission, to measure which of our ads and pages lead to sign-ups and purchases, as Marketing measurement describes.

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases: performing our contract with you or your organization (providing the service and billing); our legitimate interests in operating, securing and improving Anthenos and communicating with customers, balanced against your rights; your consent, for optional cookies and marketing measurement, which you can withdraw at any time; and compliance with legal obligations.

Customer Content stays yours

Customer Content remains the customer’s. We do not claim ownership of your purchase orders, invoices, shipment information, documents or any other business information you provide or authorise Anthenos to access.

You give Aethric a limited licence to host, copy, process and display Customer Content only as needed to provide Anthenos to you, to keep it secure, to support you, and for other purposes you agree to — as the Terms of Service and the Data Processing Addendum describe. We do not sell Customer Content or use it for advertising.

How information is shared

We share information only as this policy describes:

• Infrastructure and cloud hosting providers, which run our servers and database and keep our logs.
• Authentication providers, such as Google when you choose “Continue with Google”.
• Payment processing: Stripe, for subscriptions, checkout and the billing portal.
• AI and model providers, as AI processing describes.
• Marketing measurement: Whop, only if you allow marketing, as Marketing measurement describes. We use no analytics provider.
• Customer-authorised integrations: the portals, systems and accounts your business connects or instructs Anthenos to use, including Composio for connected accounts. These receive what a workflow sends them, and handle it under their own terms.
• Professional advisers, such as lawyers, accountants and auditors, under duties of confidentiality.
• Legal requirements: where we believe in good faith that the law, regulation, legal process or a government request requires it, or to protect the rights, property or safety of our customers, the public or Aethric.
• Corporate transactions: as part of a merger, acquisition, financing, reorganisation or sale of all or part of our business, subject to this policy’s protections.

The providers that process personal information on our behalf are listed, with what each does, on the Subprocessors page.

We do not sell personal information for money. Some privacy laws, including California’s, treat letting an advertising partner’s pixel collect information for cross-context advertising measurement as “sharing”. The only such technology on our site is Whop’s pixel, which runs only if you allow marketing. You can opt out at any time with Reject optional, through Cookie settings, or by sending a Global Privacy Control signal, which we honour.

Marketing measurement

If you allow marketing — in the cookie choice on our website, through Cookie settings, or in the Cookie Policy — Anthenos loads Whop’s pixel on the pages people arrive by: the front page, pricing, signing up and logging in, and the page after a sign-up or a checkout. It never loads inside your workspace, and it never loads until you have allowed marketing.

It tells Whop, the ad platform we measure our ads with:

• that one of those pages was viewed: its address, its title and the page that led to it — only when the address holds nothing but ad parameters such as utm_source;
• that an account was created, a trial started or a plan was first paid for, with the amount of a payment;
• an identifier Whop keeps for your browser and one it derives from how your browser is set up, with your browser’s language, time zone, screen size and user agent, and the IP address it connects from.

It is never sent your name, your email address, anything you type, or anything from your workspace. We use what it tells us to decide where to advertise. Whop uses it to measure the ads it runs for us, under its own privacy policy, and may pass sign-ups, trials and purchases to the ad networks those ads ran on. You can withdraw at any time through Cookie settings: the pixel then sends nothing more, and what it kept in your browser is removed. With a Global Privacy Control signal, it never runs.

Emails

Anthenos does not currently send email to customers: approvals, workflow notifications, security notices and service updates are shown in the product. Stripe may email payment receipts and billing notices about your subscription, according to its settings.

We do not send marketing email today. If we start, we will send it only where the law allows, every marketing email will include a way to unsubscribe, and unsubscribing will never turn off the service, security or billing notices your account needs.

Data retention

We keep information for as long as we need it for the purposes in this policy. In particular:

You can ask us to delete your information at any time, as Your privacy rights describes. We may keep some information where we need it for security, to prevent fraud or abuse, or to meet legal obligations.

Security

We use reasonable administrative, organizational and technical safeguards designed to protect personal information, including:

• encryption in transit: Anthenos is served only over HTTPS, with HSTS;
• encryption of sensitive secrets and tokens at rest with AES-256-GCM, and passwords stored only as scrypt hashes;
• access controls: every request is scoped to the workspace of the person making it, and workspace roles — owner, admin, operator and viewer — limit who can approve work, change settings and manage billing;
• audit logging of security-relevant and consequential actions;
• least-privilege permissions: Anthenos reads freely within what you authorise, and sensitive actions can be set to wait for a person’s approval;
• monitoring: health checks, operational alerts and logs that let us notice and investigate failures.

No method of transmission or storage is completely secure, and we cannot promise that information will never be accessed, disclosed or changed without authorisation. The Security page has more detail, and how to report a problem.

Your privacy rights

Depending on where you live, you may have the right to ask us to:

• give you access to the personal information we hold about you;
• correct information that is inaccurate or incomplete;
• delete your information;
• give you a copy in a portable format, where applicable;
• restrict, or object to, how we use it, where applicable;
• withdraw a consent you gave, such as for marketing cookies, without affecting what was done before;
• opt out of the “sale” or “sharing” of personal information, or of targeted advertising, where applicable.

Some of this you can do yourself: “Download your data” in Settings gives you a copy of your data, “Delete account” in Settings deletes your account and the workspaces you alone own, and Cookie settings changes your cookie choice. For anything else, write to hello@aethric.llc. We will verify your request before acting on it, may ask you for information to do so, and will respond within the time the law requires. You may use an authorised agent where the law allows. We will not discriminate against you for using your rights.

If your information is in Anthenos because one of our customers put it there, we will refer your request to that customer and help them answer it.

European Economic Area, United Kingdom and Switzerland

You have the rights above under the GDPR, the UK GDPR or Swiss law, subject to their conditions, and the right to lodge a complaint with your local data protection authority. We would appreciate the chance to address your concern first.

California

In the last 12 months we have collected the categories of information this policy describes: identifiers (such as name, email address and IP address), commercial information (such as plan and billing history), internet or network activity (such as actions in the product and server logs), professional information (such as your organization and role), and account credentials. We collect them from you, from your organization, from systems you connect, and automatically, for the purposes in How we use information, and disclose them to the categories of recipients in How information is shared. We use account credentials only to provide and secure the service. We do not sell personal information for money; the marketing measurement described above may be “sharing”, and you can opt out of it as described there. California residents may use the rights in this section by writing to hello@aethric.llc.

International transfers

Aethric is based in the United States, and Anthenos and its providers process information in the United States and in other countries where they operate, which may not be the country you live in and may have different data protection laws. Where the law requires it, we use appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses and the UK’s equivalent.

Cookies and similar technologies

Anthenos uses the cookies and browser storage listed in the Cookie Policy: necessary ones that keep you signed in and secure; with your permission, preference storage that remembers settings such as your appearance choice; and, if you allow marketing, the identifiers Whop’s pixel keeps. None is for analytics. You can change your choice at any time through Cookie settings.

Children

Anthenos is a business product and is not directed to children. Accounts are for people aged 18 or over acting for a business, as the Terms of Service require. We do not knowingly collect personal information from children; if you believe a child has given us information, write to hello@aethric.llc and we will delete it.

Changes to this policy

We may update this policy as Anthenos changes or the law requires. The dates at the top of the page say when the current version took effect and when it last changed. If we make a material change, we will tell account holders in the product, or by other reasonable means, before it takes effect.

Contact

Write to hello@aethric.llc with any question about your information or this policy. Aethric LLC operates Anthenos.