Aelos

Privacy policy

Last updated: October 9, 2026

Aelos Inc. ("we", "us") operates aelos.net (the marketing site) and app.aelos.net (the authenticated product) and offers coordination services for Americans planning retirement in France. This policy describes what personal information we collect, how we use it, and the choices you have.

Information we collect

  • Contact form submissions. When you fill out the form on our Contact page, we collect your name, email address, the situation you selected, and the message you wrote.
  • Direct email. When you email us at contact@aelos.net, ali@aelos.net, or arnaud@aelos.net, we receive the content you send us.
  • Account information (app.aelos.net). When you sign in to the authenticated product, we receive an email address and — if you choose Google sign-in — your Google profile name and profile picture. These come from Google's openid, email, and profile scopes. We do not request, receive, or store your Google password, contacts, calendar, files, or any other data from your Google Account beyond those three scopes. If you add a passkey, we store its public key, the kind of device or password manager that holds it, its name, and when it was added and last used; your fingerprint, face and device passcode never leave your device. We also count whether passkey sign-ins work on each kind of browser and device, without any name, email or IP address.
  • Documents you upload (app.aelos.net). Your Aelos vault holds the documents your file needs — passport and civil-status scans, proof of address, bank and financial statements, insurance and tax paperwork — together with the details we read from them so we can name each document and file it against the right step. An AI model reads each upload to do that; the Service providers and sub-processors section below names the providers involved.
  • Basic analytics. We use Google Analytics on the marketing site to understand which pages are visited and how visitors arrive. This collects aggregated, pseudonymous usage data (page views, referrers, approximate location, device type). We do not sell this data.
  • Calls booked via Calendly. If you book a call through our Calendly link, Calendly collects your name, email, and scheduling preferences on our behalf. A phone number you give when you book is used to reach you if the video call doesn't connect and, if you tick the box to receive texts, to text you about that call (see Text messages below). What you tell us about your move when you book (when you hope to be in France, who is moving, anything you ask us to look at) goes into our customer records, so the call can start from it.
  • Consultation calls. The calls you book with us are recorded and transcribed by Granola, a meeting-notes service. We keep the notes and transcript, and an AI model reads them so that what you told us on the call is reflected in our records and, when we prepare a proposal for you, in its first draft. The Service providers and sub-processors section below describes both.
  • Advertising. The marketing site uses the Meta (Facebook/Instagram) pixel and Conversions API, the Google Ads tag, the Reddit pixel and OpenAI's ChatGPT Ads pixel to see which of our ads work. They receive the pages you view, your IP address and browser details, their own ad cookies, and, when you book a call or give us your email, a hashed version of your email (for Meta, your name too), never in plain text; each platform uses the hash to match the event to an ad it showed you. The Reddit and OpenAI pixels may also hash an email you type into a form. When a call you booked takes place, or you become a client, we also let Meta and Google know in the same way, with the amount of a purchase. To link this to the ad you clicked, we keep their ad cookie ids with your booking for 90 days. The platforms may use this to show our ads to people who have visited our site or are similar to our clients, and to stop showing them to people who already are. We never share your phone number, your documents, anything said on a call, or details of your health, visa, citizenship, finances or family. We honor the Global Privacy Control signal: if your browser sends it, none of this happens for you.

How we use it

  • To reply to your inquiry and, with your permission, continue the conversation.
  • To evaluate whether we are a good fit for your situation.
  • To keep our record of your situation current from what you tell us on a call or by email, and to prepare a proposal for you after a consultation.
  • To authenticate your account on app.aelos.net and identify you across sessions. The email address and profile data received via Google sign-in are used solely to create and identify your Aelos account; they are not used for advertising, profiling, or shared with any party other than the sub-processors listed below.
  • To improve the website based on aggregated analytics.

We do not sell your personal information for money. What we share with Meta, Google, Reddit and OpenAI for advertising may qualify as "sharing" under California law. You can opt out at any time by turning on Global Privacy Control in your browser, which we honor automatically, or by emailing contact@aelos.net; an opt-out also covers a later call or purchase. We do not send marketing emails unless you have explicitly asked to receive them. We do not use data received from Google APIs to develop, improve, or train generalized AI or machine-learning models.

Text messages

If you tick the box to get texts when you book a consultation, we text the mobile number you gave a booking confirmation and reminders before the call, each with a link to join, reschedule or cancel it: up to 3 texts per booking. If you text us, our team may reply about your call. The box is optional; you don't need it to book a call or to buy anything from us. Message and data rates may apply. Reply STOP to any of our texts to stop them, or HELP for help. We keep a record of your consent: when you gave it and the wording you saw.

We do not sell or share your mobile number, or your consent to receive texts, with third parties or affiliates for their marketing or promotional purposes. Twilio, our texting provider, receives your number only to deliver the texts. The full terms are in our text message terms.

Service providers and sub-processors

We rely on a small number of third-party services to operate the site and the authenticated product. Each processes only what is needed for the function described:

  • Vercel — hosts both aelos.net and app.aelos.net and processes inbound HTTP traffic.
  • Supabase — the database and file storage behind app.aelos.net. It holds your sign-in identifiers (email address, name, profile picture, passkey public keys, and the access tokens that keep you signed in), your household's profile and the answers you give at each step, your payment and membership records, the documents in your vault and the details we read from them, the proposal PDFs we draft for you, and an archive of the email conversations you have with us. Located in the United States.
  • Resend — delivers the email we send you: contact-form replies, calculator recaps and reports from the marketing site, purchase summaries and payment receipts, the notice before a scheduled payment and the message when a card is declined, membership deadline and renewal reminders, and confirmations of the requests you send your concierge. It receives your email address and the content of each message.
  • Google — when you choose Google sign-in, Google handles the authentication itself; we receive only the openid/email/profile fields described above.
  • Google Analytics — aggregates marketing-site usage.
  • Google Ads — measures ad-campaign performance and builds advertising audiences (conversion tag); receives usage events and hashed contact identifiers, including when a booked call takes place or you buy, suppressed entirely when your browser sends a Global Privacy Control signal.
  • Calendly — schedules founder calls and sends their reminder emails.
  • Twilio — sends the texts about your booked call to people who asked for them, and handles STOP and HELP replies.
  • Meta — measures ad-campaign performance and builds advertising audiences (pixel and Conversions API); receives usage events and hashed contact identifiers, including when a booked call takes place or you buy, suppressed entirely when your browser sends a Global Privacy Control signal.
  • Reddit — measures ad-campaign performance and builds advertising audiences (pixel); receives usage and conversion events and hashed contact identifiers, suppressed entirely when your browser sends a Global Privacy Control signal.
  • OpenAI — measures the performance of our ads in ChatGPT (pixel); receives usage and conversion events and hashed contact identifiers, suppressed entirely when your browser sends a Global Privacy Control signal.
  • Stripe — processes payments for Aelos services; receives your name, email address, and payment details when you purchase and, on the three-part Move payment schedule, keeps your card on file for the scheduled payment you authorized at checkout. Located in the United States.
  • Front — our customer-communication workspace; the email you send us, the requests you submit in the app, the messages you send your concierge, and our replies are processed and stored there. Located in the United States.
  • Attio — our customer-relationship system; stores contact details and inquiry context for people who reach out to us, what we learned about your situation and plans from your calls and emails with us, and an internal estimate of how likely you are to become a customer, worked out from what you told us (how settled your move is, your timeline, what you need, who decides with you, and whether Aelos can take your case). Located in the United States.
  • Granola — records and transcribes the consultation calls you book with us; it receives the call audio and the names and email addresses of the people on the call, and returns the notes and transcript we keep.
  • Vercel AI Gateway / Anthropic — Anthropic models process your information through the gateway in four places. When we use AI to help draft responses to your messages, the message thread and a summary of your file are processed through them (the summary leaves out your tax identifiers, full dates of birth, contact details, and the contents of your documents); drafts are always reviewed by a human before anything is sent. When you upload a document to your Aelos vault, the file itself is sent to an Anthropic model so we can identify what it is, name it, file it against the right step, and read the few key fields that step needs (for example the expiry date on a passport or the closing balance on a statement); this applies to the documents you upload — passport and civil-status scans, bank statements, insurance and tax paperwork. Images are sent as uploaded; PDFs are trimmed to their first pages before sending. After a consultation call, and for the email threads in our sales and contact inboxes, an Anthropic model reads the call notes and transcript or the thread to keep our customer records in Attio current and, when a proposal is appropriate, to write its first draft, which we review before it is sent to you. The files you attach to a message to your concierge are sent, as attached (an iPhone photo converted to JPEG), to an Anthropic model that describes each one and transcribes its text in a few lines; Social Security numbers, IBANs, card numbers, email addresses, and phone numbers are removed from that description before it is stored or read by anything else. Your data is not used to train models.

Service partners

Delivering Aelos services requires working with vetted professional partners — this is inherent to what you purchase from us. When your relocation or membership reaches the relevant step, we share the information and documents that step requires with the partner who performs it: our visa-administration partner (visa application preparation, appointment booking, residence-permit validation, driver's-license exchange), our court-listed sworn translator (civil-status documents), our healthcare-enrollment partner (French health-system enrollment), and our cross-border tax partner (annual filings). Documents are shared through expiring, revocable, access-logged links — never as permanent email attachments — and each product step tells you which partner is involved before you reach it. Some engagements (for example with a French expert-comptable or an estate attorney) are contracted by you directly with the professional, as French professional rules require.

We do not transfer or disclose your information to third parties for purposes other than the operations described above.

Retention and deletion

We keep contact form submissions in our email inbox for as long as they are useful to our working relationship.

For app.aelos.net: when your Move finishes or your membership lapses, your documents and the records of your file stay available to you, read-only, for at least three years — you can sign in and download anything you want to keep, whenever you want it. We keep them because visa renewals, tax years and residency questions all reach backwards, and a document you needed in 2026 is often the one a préfecture or a tax authority asks for in 2029. We keep account and payment records for the same period, or longer where tax and company law requires it. Nothing is deleted on a schedule we haven't told you about, and you can ask us to delete it sooner at any time.

You may request access to, correction of, or deletion of any data we hold about you — including your account on app.aelos.net — at any time by emailing contact@aelos.net. If your account was created via Google sign-in, you can also revoke Aelos's access at any time from your Google Account at myaccount.google.com/permissions.

Your rights

If you are in the European Union, the United Kingdom, or California, you have the rights granted by GDPR, UK GDPR, and CCPA/CPRA respectively, including the right to access, correct, port, or delete your data, and the right to lodge a complaint with your local regulator. California residents also have the right to opt out of the "sale" or "sharing" of personal information: we treat the Global Privacy Control browser signal as a valid opt-out request and honor it automatically, on every page.

Cookies

The marketing site sets a small number of cookies used by Google Analytics, by the Meta pixel (_fbp and _fbc), by the Google Ads tag (_gcl_*), by the Reddit pixel (_rdt_uuid, _rdt_cid) and by OpenAI's pixel (__oppref, __obref). It also sets its own first-party cookie, aelos_attr, which remembers how you reached the site (the campaign, ad or website that referred you, on your first visit and your latest) for 90 days after your last visit. It is sent to every aelos.net site, including app.aelos.net, so an account you open there is linked to the campaign that brought you; it never carries an ad click identifier. The authenticated product (app.aelos.net) sets httpOnly session cookies that keep you signed in; these are essential to the service and cannot be disabled. Advertising cookies (_fbp, _fbc, _gcl_*, _rdt_*, __oppref, __obref) are suppressed automatically when your browser sends the Global Privacy Control signal; analytics and advertising cookies can also be disabled via your browser settings or a browser extension, without affecting functionality.

Children

The site is not directed to children under 16 and we do not knowingly collect information from them.

Contact

Questions about this policy? Email contact@aelos.net.