Last updated: 28 October 2026
This policy describes what AirPunk does with your data — what we collect, why, who else processes it, and how you get it back or delete it. It is written to match what the product actually does, not to cover every hypothetical.
Authentication is handled by Clerk. We receive an account identifier, your email address, and — if you sign in with Apple or Google — the identifier that provider returns. We never receive or store your password. If you use Sign in with Apple with Private Relay, we only ever see the relay address, never your real one.
Display name, avatar image URL and bio. All optional.
Brand name, mission, product descriptions and prices, target audience, visual references and any assets you upload. This is the raw material the system works from.
Generated websites, product pages, ad creative, copy, images and video, plus the missions, quality scores and generation history behind them.
When someone buys from a site AirPunk built for you, we process the order — buyer email, order contents and amounts — so it can be recorded and fulfilled. Payment card details are handled by Stripe and never reach AirPunk's servers.
Your subscription and credit balance. On the web, payment is processed by Stripe; on iOS, by Apple through RevenueCat. In both cases we store the resulting state, not your card.
Server logs, IP address, browser and device information, error reports, usage events, and per-mission accounting of the AI capacity a generation consumed.
On iOS, a device token so Apple can deliver notifications you asked for.
AirPunk runs on third-party infrastructure. These are the providers that may process your data, and what each one does:
| Provider | What it does |
|---|---|
| Clerk | Authentication and identity, including Sign in with Apple and Google |
| Stripe | Payments — AirPunk subscriptions and checkout on your storefronts |
| Apple & RevenueCat | In-app purchases and receipts on iOS |
| Anthropic | Text and reasoning generation |
| OpenAI | Text and image generation |
| Replicate | Image and video model hosting |
| Cloudflare R2 | Storage and delivery of generated assets |
| Neon | The PostgreSQL database |
| Render | Application and site hosting |
| Resend | Transactional, order and discount email |
| Apple (APNs) | Push notification delivery |
| Sentry | Error monitoring |
| Amplitude | Product analytics for the signed-in application, hosted in the EU — you can opt out in the app's Settings |
| Meta | Advertising campaigns — only if you use the advertising features |
The brand information you enter is sent to the AI providers above so they can generate your content. We use their business API offerings; their handling of submitted content is governed by their own terms. We do not sell your data, and we do not use your content to train our own models.
Several of these providers are established in the United States. Transfers outside the EEA rely on the European Commission's Standard Contractual Clauses or an equivalent adequacy mechanism.
Under the GDPR you may access, correct, export, delete or restrict your personal data, object to processing, and withdraw consent where processing is based on it. Two of these are built into the product rather than left to email:
GET /api/v1/users/{your-id}/export. You can only export your own data.
For anything else — or if you would rather we did it — write to airpunk@thesocialcie.com. You also have the right to lodge a complaint with the French data protection authority, the CNIL.
If a merchant connects an existing Shopify store, AirPunk reads order identifiers, order totals, currency, test and cancellation status, and payment status through Shopify's API. We use these fields only to calculate and display the store's total historical revenue in AirPunk. We do not request buyer names, addresses, email addresses, or phone numbers, and do not keep individual Shopify orders. We keep the store domain, encrypted access tokens, sync status, and the resulting aggregate total while the connection remains active.
The merchant authorizes this processing by connecting the store and can disconnect it in AirPunk. Disconnecting, deleting the associated brand, or a verified Shopify shop-redaction request deletes the connection, its tokens, and its aggregate total. We do not sell or use Shopify order data for advertising or decisions about individual buyers. Questions about this processing or customer privacy requests can be sent to airpunk@thesocialcie.com.
Account and brand data: for as long as your account exists. After deletion we remove it, except what we are legally required to retain — invoices and accounting records are kept for 10 years under French law — and the minimum needed to prevent abuse and fraud.
Before AirPunk opened to the public we ran a waitlist. Those historical signups are retained as a record; the waitlist itself is closed and no longer collects anything. Write to us to have yours removed.
If you play the Bonus Table on airpunk.ai and enter your email address to activate a discount, we keep that address, the answer you picked at the table, the language of the page, the time, and the campaign parameters of your visit. We use it only to send you the activation email and a few reminders to create your account. Every email carries a one-click unsubscribe link. An address that was never confirmed by opening the link in the email is deleted after 12 months; write to us to have yours removed sooner.
The AirPunk marketing site and dashboard use the separate AirPunk acquisition Meta Pixel only if you select “Accept cookies”. With your permission, the browser and our server send matching page visits, completed registrations, paywall views and checkout starts to Meta using the same event ID, so each action can be counted once. For a paid AirPunk checkout, our server may send a Purchase event to Meta with the payment value, currency and a hashed checkout email. You can change your choice at any time. Dashboard: Settings → Cookies. Landing: the “Cookie choices” link in the footer. The choice is stored in one cookie shared by airpunk.ai and the dashboard, so a signed-out visitor can withdraw consent from the landing footer. Rejecting prevents this advertising measurement. This does not apply to customer websites or their ads. The Bonus Table on airpunk.ai remembers in your browser's local storage that its discount offer was shown, closed or completed — never your email address — and counts how many times each step of the offer happens, as anonymous totals with no identifier and no cookie. Inside the application, browser storage is used strictly to keep you signed in (via Clerk), to remember interface state such as your active brand, and to record product-analytics preferences. The signed-in application measures product usage with Amplitude (EU-hosted): events like "a window was opened" tied to your internal account identifier — never your email, your prompts, or the content AirPunk creates for you. You can turn this off at any time in Settings → My data.
AirPunk is a business tool and is not intended for anyone under 16. We do not knowingly collect data from children.
Data is encrypted in transit. Access to production systems is restricted, credentials are held outside the codebase, and payment credentials never touch our servers. Shopify access tokens are encrypted before storage, and the database holding the Shopify connection is encrypted at rest by our database provider. No system is perfectly secure, and we will notify you and the CNIL as required if a breach affects your data.
If we change how we handle your data, we update this page and the date at the top. Material changes will be communicated to account holders.