1. Introduction

AltheonIQ ("we," "us," or "our") is a product of Arrington Innovative Solutions, LLC ("AIS"). This Privacy Policy describes how we collect, use, store, and protect your personal information when you use the AltheonIQ application, website (altheoniq.app), and related services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use the Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your email address, display name, and authentication credentials. If you sign in via Google OAuth, we receive your name, email, and profile picture from Google.

2.2 Session and Wellness Data

When you use AltheonIQ, we collect information you voluntarily provide during sessions, including:

Conversation messages with Lumen (our AI guide)
Session categories and initial statements
AI-generated analyses, root causes, and recommendations
Mood check-in entries (emotion, intensity, notes)
Journal entries (content, type, AI prompts used)
Wellness plan progress and habit tracking data
Streak and usage statistics

2.3 Payment Information

Payment processing is handled entirely by Stripe. We do not store credit card numbers or full payment details on our servers. We retain your Stripe customer ID and subscription status for account management.

2.4 Technical Information

We automatically collect device type, browser information, IP address, and usage analytics to improve the Service.

3. How We Use Your Information

To provide, maintain, and improve the Service
To personalize your experience and AI-guided sessions
To generate analyses, trend insights, and wellness recommendations
To process payments and manage subscriptions
To send transactional emails (account verification, payment confirmations, session summaries)
To enforce our Terms of Service and protect against misuse
To comply with legal obligations

4. Data Storage and Security

Your data is stored securely using Supabase (PostgreSQL with Row-Level Security), ensuring that each user can only access their own data. All data is transmitted over encrypted HTTPS connections. AI conversations are processed through Anthropic's Claude API with enterprise-grade security.

While we implement industry-standard security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

5. AI-Generated Content and Conversations

Your conversations with Lumen are private to your account.We do not sell, share, or use your conversation data to train AI models. Conversations are processed by Anthropic's Claude API to generate responses, and are subject to Anthropic's data handling policies. We retain your conversation history so you can review past sessions, analyses, and track your progress over time.

6. Third-Party Services

We use the following third-party services:

Supabase — Authentication and database hosting
Anthropic (Claude) — AI conversation processing
Stripe — Payment processing
Resend — Transactional email delivery
Vercel — Application hosting
Google — OAuth authentication (optional)
PostHog — Product analytics. User sessions are identified by a pseudonymous ID. We use PostHog to understand how features are used so we can improve the Service. PostHog is operated under a Data Processing Agreement in compliance with GDPR. When you delete your account, your PostHog analytics profile is also deleted.
ElevenLabs — AI voice synthesis (Premium Voice feature). Text submitted for voice synthesis is processed by ElevenLabs to generate audio. Audio is not stored by AltheonIQ. Please review ElevenLabs' Privacy Policy for their data handling practices.

Each third-party service operates under its own privacy policy and data handling practices.

7. Data Retention and Deletion

We retain your data for as long as your account is active. You may request deletion of your account and all associated data at any time through the account settings page or by contacting us at privacy@arringtonis.com. Upon receiving a deletion request, we will permanently remove your data within 30 days, except where retention is required by law.

Specific retention periods for operational data:

Rate limit and generation logs — deleted automatically after 24 hours
Affiliate click records — pseudonymized IP addresses are retained for 90 days, then permanently deleted
Session and wellness data — retained for the life of your account; deleted when you delete your account

8. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

Access and receive a copy of your personal data
Correct inaccurate personal data
Request deletion of your personal data
Object to or restrict processing of your data
Data portability (receive your data in a structured format)
Withdraw consent at any time

To exercise any of these rights, contact us at privacy@arringtonis.com.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy, please contact:
Arrington Innovative Solutions, LLC
Email: privacy@arringtonis.com
Website: arringtonis.com