Aerion
Privacy Policy
Last updated: 4 October 2026
1. Who we are
Aerion is an SEO auditing service operated by PT Zharkwave Global Group (“we”, “us”), of Jl. Panca Marga No. 49, Sleman, Daerah Istimewa Yogyakarta 55285, Indonesia. We are the data controller for the personal data described here.
For anything in this policy, including requests to access or delete your data, contact info@zharkwave.com.
2. What we collect, and why
| Data | Why we hold it | How long |
|---|---|---|
| Email address, name and profile picture | To create your account, sign you in, and address you. Supplied by you at sign-up, or by Google if you sign in with Google. | Until you delete your account |
| Password | Only if you sign up with an email and password. Stored as a salted hash — we cannot read it, and neither can anyone who obtains the database. | Until you delete your account |
| Session records — IP address and browser user-agent | To keep you signed in and to let you see and end sessions you do not recognise. | 30 days from sign-in, then deleted automatically |
| Projects: the website addresses you add | They are what the tool audits. | Until you delete the project or your account |
| Audit and crawl results: pages found, their titles, headings, links, markup, and the issues detected | To show you the report, and to show how a site changed between audits. | Page-audit history 365 days; the 24 most recent site crawls; the 12 most recent interlinking reports; the 120 most recent indexation snapshots |
| Tracked keywords and their ranking history | To chart position over time, which is the whole point of tracking. | The 730 most recent snapshots per keyword |
| Usage counters — how many audits and crawls you have run | To enforce the limits of your plan. | Until you delete your account |
| Subscription and plan status | To give you access to what you have paid for. | For as long as required by tax and accounting law |
| In-progress crawl checkpoints | So a crawl interrupted by a restart resumes instead of starting over. | Deleted when the crawl finishes; at most 2 days for one that failed |
We do not collect special-category data (health, religion, political opinion, and similar), and you should not put any into a project name or note.
3. Google account data
Signing in with Google, and connecting Google Search Console or Google Analytics, are both optional. If you use them, this is exactly what happens.
What we request
- Sign-in: your email address, name and profile picture, to create and identify your account.
- Search Console (read-only): your search performance data — queries, impressions, clicks, positions — and your list of verified properties.
- Search Console (sitemaps): requested only if you choose to submit sitemaps from inside Aerion. Decline it and everything else still works.
- Google Analytics (read-only): requested only if you choose to connect Analytics, to show traffic alongside your rankings.
What we do with it
We use it to display your own data back to you inside Aerion, and to combine it with your audits — for example, showing which pages lost clicks after a change. That is the only use.
Limited Use
Specifically, data obtained from Google APIs is never:
- sold, or transferred to anyone, except as needed to provide the feature you asked for, for security purposes, or where the law requires it;
- used for advertising of any kind, including personalised or retargeted advertising;
- used to train, fine-tune or improve any AI or machine-learning model — ours or anyone else’s;
- read by a human, other than you, unless you have given explicit permission for a specific support request, it is needed for security, or the law requires it.
Disconnecting
You can disconnect Google at any time from inside Aerion, which deletes the access and refresh tokens we hold. You can also revoke access from your Google account permissions page.
4. Websites you ask us to audit
When you run an audit, our crawler requests pages from the address you gave us, identifying
itself as ZharkwaveSEOBot, obeying robots.txt, and limiting how fast
and how many pages it requests. It reads publicly available pages; it does not sign in, submit
forms, or attempt to reach anything behind a login.
Only audit sites you own or have permission to audit. If those pages contain other people’s personal data, you are the controller of it and we process it on your behalf under section 2.
5. Who else sees your data
We do not sell data or share it for advertising. We use these processors, each only for the feature named:
| Service | What it receives | For what |
|---|---|---|
| Google (sign-in, Business Profile, Search Console) | Your OAuth authorisation | Sign-in, Business Profile, Search Console and Analytics data, PageSpeed measurements |
| Cloud hosting provider (data stored in Singapore) | Everything Aerion stores, as described in section 2 | Running the service and storing its data |
| Search and maps data providers | Keywords and domains you ask about | Keyword research, backlink data, and search-result positions |
| AI text provider | The page content or brief you submit to an AI feature | Generating article and landing-page drafts, and AI suggestions. Only when you use those features. |
| Web page reading services | Addresses of public web pages Aerion is asked to read | Reading public pages that refuse a direct request |
| Stock photo provider | Your image search terms | Finding stock images, when you use that tool |
| Email delivery provider | Your email address and the message | Sending sign-in, verification and scheduled report emails |
We may also disclose data where the law compels us to, or to protect the security of the service and its users.
6. AI features
Some tools generate text with a third-party AI model. What you submit to those tools is sent to the AI text provider listed above to produce your result and is not used by us to train models. Nothing is sent to an AI provider unless you use one of those tools.
7. Cookies
Aerion sets one cookie, zw_session. It holds a random session token, is marked
HttpOnly so scripts cannot read it, and is sent only to Aerion. It exists solely
to keep you signed in and expires after 30 days.
There are no advertising cookies, no analytics cookies, and no third-party trackers. Nothing on Aerion follows you across other websites. Some preferences — light or dark mode, your language — are stored in your own browser and never sent to us.
8. How your data is protected
- Everything travels over HTTPS.
- Passwords are stored as salted hashes, never in a readable form.
- Session cookies are
HttpOnly, and only a hash of the token is stored on the server, so the database alone cannot be used to impersonate you. - The application runs as an unprivileged user with write access to its data directory only.
- Data is stored on servers operated by our cloud hosting provider in Singapore.
No service can promise perfect security. If a breach affects your personal data, we will tell you and the relevant authority as the law requires.
9. Your rights
You can ask us to:
- give you a copy of the data we hold about you;
- correct anything inaccurate;
- delete your account and everything in it;
- stop processing your data, or object to it;
- export your data in a portable form.
You can delete individual projects and their audit history yourself from inside Aerion. To delete your whole account, email info@zharkwave.com and we will do it within 30 days. If you are in the UK, EU or another region with a data-protection authority, you also have the right to complain to it.
10. Children
Aerion is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, tell us and we will remove it.
11. International transfers
Your account and audit data is stored in Singapore. The processors listed in section 5 operate internationally, so data sent to them may be processed elsewhere. Where the law requires a safeguard for such a transfer, we rely on the standard contractual clauses or the equivalent mechanism offered by each processor.
12. Changes to this policy
If we change this policy we will update the date at the top. If a change materially affects how we handle your data, we will email you before it takes effect.
13. Contact
Questions, requests, or complaints: info@zharkwave.com.