Never sold pledge
This is our permanent, unconditional commitment. Not a terms-of-service clause that can be revised overnight. Not a marketing tagline. A plain-English promise about how your compliance data is treated — and how it never will be.
Last reviewed: May 2026
The pledge, in one sentence:
"We will never sell, share, or monetise your data in any way beyond delivering the Aegis Firma service you pay for."
— Aegis Firma team
What this means in practice
Your data is never sold
We will never sell, rent, lease, or auction your personal data or your organisation's compliance data to any third party — ever. This is not a marketing promise. It is written into our Data Processing Agreement and backed by GDPR Article 28.
No advertising networks, ever
We do not run advertising on Aegis Firma. We do not share behavioural data with ad networks. We do not use Facebook Pixel, Google Ads remarketing, or any third-party tracking pixel. We run no third-party web analytics — no Google Analytics, no Mixpanel, no Segment, no Hotjar, or any other analytics vendor. Any product-usage measurement stays first-party on our own infrastructure.
Your data never trains AI models
The policies, DPIAs, assessments, and evidence you create in Aegis Firma are your intellectual property. They are never used to train any AI model. Aegis Firma generates documents from static, deterministic templates — your organisation's content is never sent to a third-party AI provider at request time.
No transfers without consent
Your data is only shared with sub-processors that are strictly necessary to deliver the service (Supabase for storage, Resend for transactional email, Cloudflare for content delivery, LemonSqueezy for payments). Every sub-processor has a signed DPA and Standard Contractual Clauses. We notify you 30 days before adding a new sub-processor.
Ownership never changes
If Aegis Firma is ever acquired, merged, or shut down, your data will be: (a) migrated to the new operator under the same terms, (b) exported to you in full, or (c) deleted — your choice. A change of ownership does not change your rights. We will never "grandfather in" new data practices without your explicit consent.
We make money only when you pay us
We make money when you pay us for the Aegis Firma service — through subscriptions and one-time compliance packages — and only then. There is no hidden monetisation layer. Your data has zero commercial value to us beyond the service we provide you.
What we do share (and why)
| Recipient | What is shared | Why | DPA |
|---|---|---|---|
| Supabase (EU) | All app data | Database & storage provider | Signed |
| Resend | Recipient email, content | Transactional email delivery | Signed |
| Cloudflare | IP (ephemeral), request logs | CDN & DDoS protection | Signed |
| LemonSqueezy | Name, email, billing address | Payment processing | Signed |
Full sub-processor list available in your Data Processing Agreement. We notify all customers 30 days before adding a new sub-processor.
How to hold us accountable
- • Email privacy@aegisfirma.com to request a copy of your data, a deletion, or a sub-processor list at any time.
- • Our DPA is available on request and is included in all paid plans automatically.
- • If you believe we have violated this pledge, you can file a complaint with your national data protection authority. We will cooperate fully.
- • We publish a quarterly transparency report at aegisfirma.com/trust/transparency that covers sub-processor changes, DSR volume, and security events.