Privacy Policy

1. Overview & Accountability

Aetheron Engine Labs ("Aetheron," "we," "us," or "our") is a Canadian applied technology and computational research entity committed to protecting the privacy of our institutional partners, defense stakeholders, job applicants, and website visitors. This policy covers personal information collected through aetheronengine.com and related institutional correspondence.

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Quebec's Law 25 and the private-sector privacy acts of Alberta and British Columbia.

Aetheron has designated an accountable Privacy Officer to oversee statutory compliance (contact details in Section 10). This policy does not apply to client operational telemetry processed within self-hosted or air-gapped environments, which is governed strictly by underlying licensing and services agreements.

2. Information We Collect

We collect only what is necessary to support our business relationships.

Provided by you:

• Name, work email, job title, organization and phone number submitted through our contact or brief request forms.
• Information needed to confirm you are authorized to receive restricted materials under a mutual non-disclosure agreement (MNDA).
• Resumes and application details for open roles. Where a role requires security screening, we collect the information needed for it only with your written consent.

Collected automatically:

• Technical data (IP address, browser type, device type, timestamps, referring page) and general geographic location derived from your IP address.

What we do not collect:

• We do not collect sensitive data such as health information, financial account numbers, government identification numbers or biometric data through this site.
• Please do not send classified, export-controlled or otherwise restricted information through this site or by ordinary email. Contact us first and we will arrange an appropriate channel.

3. Purpose & Use

We use your information strictly to:

• Respond to inquiries and brief requests, and evaluate prospective client suitability.
• Confirm authorization before sharing restricted materials under an MNDA.
• Send product updates where you have consented, or where Canada's Anti-Spam Legislation (CASL) otherwise permits. Every message includes an unsubscribe option.
• Assess job applications.
• Improve our website and protect against security risks.
• Meet our legal obligations.

We rely on your consent, which may be implied where the purpose is obvious (for example, replying to a message you sent us), or on another basis the law permits. We will ask for your consent again before using your information for a new purpose.

Aetheron does not sell, rent, or trade your personal information to third parties.

4. Cookies & Consent

Our website uses strictly necessary technical cookies to maintain site security and session performance, alongside basic analytics to measure aggregated traffic. We do not deploy third-party behavioural advertising cookies, retargeting campaigns, or social-media tracking pixels.

Your choice: You can manage or disable cookies through your browser settings, though certain functional aspects of the site may be restricted.

Quebec residents: Technologies that could identify, locate, or profile users are deactivated by default in accordance with Law 25. These are enabled only upon express opt-in via our cookie banner, and preferences can be modified at any time.

5. Cyber Security & Incident Response

Aetheron implements technical and organizational safeguards suited to the sensitivity of the information, including encryption in transit and at rest, access controls with multi-factor authentication, monitoring and patching of internet-facing systems, and confidentiality obligations for staff and service providers.

Privacy breaches:

If a breach involving your personal information creates a real risk of significant harm (or, under Quebec law, a risk of serious injury), we will notify you and the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec, as required. We keep a record of every such breach for at least 24 months.

Critical Cyber Systems Protection Act (CCSPA):

Canada's An Act respecting cyber security (Bill C-8, Royal Assent June 2026) enacts the CCSPA, which is being brought into force in phases. Where our products are deployed by designated operators in federally regulated sectors, such as finance, our architecture is designed to support those clients' obligations under the CCSPA, including:

• protecting critical cyber systems from compromise;
• maintaining cyber security programs within client-controlled environments;
• reporting cyber security incidents to the designated authority where required; and
• keeping cyber security directions confidential, as the Act requires.

This policy governs only personal information collected through this site. How our products handle client data is set out in our client agreements.

6. Third-Party Disclosures

We only share information with:

• Service providers: contractually bound partners who host our site, run analytics, send our emails or support recruiting. They may use the information only on our instructions, and we remain accountable for it.
• Customers and partners: where needed to perform a contract, and the authority conducting any security screening you have consented to.
• Legal requirements: where required by a court order, warrant or law, or by a lawful direction from a Canadian cyber security authority.
• Regulatory reporting: where a privacy breach or cyber security incident triggers mandatory reporting under federal or provincial law. Some regulatory communications must be kept confidential, and we will handle them accordingly.
• Business transfers: in a financing, merger or sale of our business, where the other party agrees to protect the information as the law requires.

7. Retention

We retain personal information only as long as necessary to fulfil the business purpose or meet legal and contractual obligations. For example:

• unsuccessful job applications: 12 months, unless you agree to a longer period;
• website security logs: 90 days, unless needed to investigate an incident;
• records of privacy breaches: at least 24 months.

If we use your information to make a decision about you, we keep it long enough for you to request access to it. Once no longer required, data is securely destroyed or anonymized.

8. Your Privacy Rights

Under Canadian privacy law, and subject to legal limits, you have the right to:

• Access and correct your personal information.
• Withdraw your consent to future use, subject to legal or contractual restrictions.
• Request deletion or de-indexing, where the law provides for it.
• Data portability: receive computerized information you gave us in a structured, commonly used format, where Quebec law provides for it.
• Unsubscribe from our emails at any time.

To exercise any of these rights, contact our Privacy Officer (see Section 10). We may need to verify your identity. We will respond within 30 days, or tell you within that time if we need an extension the law allows. If we refuse a request, we will explain why in writing.

9. International Transfers & Cross-Border Data Processing

Aetheron Engine Labs. operates within Canada. Certain vetted third-party service providers that support our communications, hosting, and operational infrastructure may process or store personal information in the United States or the European Union. Information stored outside Canada is subject to the statutory laws of those foreign jurisdictions and may be accessible to local courts, law enforcement, and national security authorities under lawful access frameworks.

Prior to transferring personal information concerning Quebec residents outside the province of Quebec, we conduct a formal Privacy Impact Assessment (PIA) to verify that the information receives adequate protection in accordance with Quebec Law 25. Across all jurisdictions, we enforce strict contractual clauses, technical safeguards, and confidentiality covenants to ensure your personal information retains a level of protection comparable to the standards required under PIPEDA and provincial privacy legislation.

10. Contact, Governance & Complaints

If you have questions regarding this Privacy Policy, wish to access or update your information, or choose to exercise any statutory rights, direct correspondence to our designated privacy authority:

Privacy Officer

S. Patel

Aetheron Engine Labs.

Toronto, Ontario, Canada

Direct Inquiry: privacy@aetheronengine.com

We review and address all formal privacy inquiries within 30 days. If an inquiry or complaint is not resolved to your satisfaction, you retain the legal right to escalate the matter to the appropriate supervisory authority:

• Federal: Office of the Privacy Commissioner of Canada (OPC)
• Alberta: Office of the Information and Privacy Commissioner of Alberta (OIPC)
• Quebec: Commission d'accès à l'information du Québec (CAI)
• British Columbia: Office of the Information and Privacy Commissioner for British Columbia (OIPC)