Privacy Policy

Last updated: 09 September 2026

1. Controller

The data controller is Evosolve KFT, Hungary. Contact: [email protected]

2. Data We Collect

We collect: name, email address, company name, phone number, and website domain — provided voluntarily via our contact form or client portal. We also collect service usage data via server logs. If you are a paying client, we additionally process customer conversations routed through our AI (chat widget messages, WhatsApp messages, email bodies) and any third-party data you explicitly connect (see Section 8).

3. Purpose & Legal Basis

Data is processed for the purpose of providing B2B services. Legal basis: contract performance (Art. 6(1)(b) GDPR) and legitimate interest (Art. 6(1)(f) GDPR).

4. Data Retention

We keep personal data only for as long as we need it. Specific retention periods by data type:

• Client account data (name, email, company, billing info) — retained for the duration of the contract. On account closure or cancellation, deleted within 30 days, except where required by law (see billing records below).
• Billing & invoice records — retained for 8 years as required by the Hungarian Accounting Act (Act C of 2000, §169). This applies to invoices, receipts, payment records, and VAT documentation. Non-negotiable legal requirement.
• Customer conversation records (chat transcripts, WhatsApp messages, email bodies) — retained for the life of the client's subscription plus 90 days for dispute resolution, after which they are permanently deleted.
• Customer contact data captured via AI conversations (names, emails, phone numbers of end-customers) — follows the same window as conversation records above, unless an end-customer requests earlier deletion via auroai.eu/privacy/request.
• Leads (entries created from "hot-lead" detection) — retained for 3 years from last activity, then deleted.
• AI-generated content (posts, newsletter drafts, summaries) — retained until the client deletes them or the subscription ends + 90 days.
• Knowledge base docs uploaded by a client — retained until the client deletes them from their dashboard. Chunks and embeddings expire alongside.
• OAuth tokens & third-party integration data (Google Calendar, Outlook, Zoom, Meta, LinkedIn, Slack, etc.) — cached data + tokens deleted within 30 days of disconnecting the integration.
• Server logs & usage metrics (API call records, error logs, rate-limit counters) — retained for 12 months, then rolling-deleted.
• Erasure audit trail — when we delete data at your request, we retain a minimal non-PII record (hashed email, timestamp, row-count) indefinitely. This is regulatory proof that the erasure happened and is itself required by Article 5(2) of the GDPR (accountability principle). It contains no personal data — only a one-way hash.

Retention is enforced by an automated daily sweep. Once a period expires, data is permanently deleted; it cannot be recovered.

5. Your Rights

Under GDPR you have the right to access, rectify, erase, restrict, or port your data. Contact [email protected] to exercise these rights.

6. Data Location

All data is stored on servers within the European Union (Hetzner, Germany/Finland).

7. AI Disclosure

In compliance with EU AI Act 2024/1689, we disclose that some of our services use AI systems. AI assistants deployed by Auro AI will identify themselves as AI to end users.

8. Third-Party Integrations You Connect

Our clients can optionally connect third-party accounts (such as their Google Calendar) to Auro AI so that our AI assistant can perform tasks on their behalf. When you authorise such an integration, we store an encrypted access token and use it only to deliver the specific feature you connected it for. Below are the integrations we currently support and exactly what data we access:

8.1 Google Calendar

When a client of ours connects their Google Calendar to Auro AI, we request the following OAuth scopes:

• View events on all your calendars (https://www.googleapis.com/auth/calendar.readonly) — so our AI can read your availability at the moment a customer is attempting to book with you, and only offer slots that are actually free.
• View and edit events on all your calendars (https://www.googleapis.com/auth/calendar.events) — so when a customer completes a booking, the resulting appointment is created as a real event in your Google Calendar, with the customer added as an attendee so they receive a native Google invite. We also delete the event if the customer later cancels.
• Your email and basic profile (userinfo.email, userinfo.profile) — used only once at connect time to label the connection in your dashboard.

How we use Google user data — Google API Services User Data Policy, Limited Use compliance:

• Google user data obtained via our use of Google APIs is used only to provide the user-facing features described above (showing real availability to your customers, creating and deleting bookings in your calendar).
• We do not transfer Google user data to third parties, except as necessary to provide these features, to comply with applicable law, or as part of a merger/acquisition with prior user notice.
• We do not use Google user data for advertising purposes of any kind.
• We do not allow humans to read your Google user data, unless we have your explicit consent for a specific instance, it is necessary for security purposes (such as investigating abuse), or we are legally required to do so.
• We do not use Google user data to develop, improve, or train generalised AI or machine learning models. The AI reasoning operates per-conversation on live retrieval and never ingests calendar contents into any training pipeline.
• Calendar contents are accessed only during active customer booking conversations and are not stored or indexed in our database. Only the resulting booking records (start time, end time, customer name and contact) are retained, in order to present your upcoming bookings to you in our dashboard.
• OAuth access tokens and refresh tokens are stored encrypted at rest (AES-256-GCM) on our EU-based infrastructure. On disconnect, all tokens and cached data are deleted within 30 days.
• You can revoke Auro AI's access at any time — either by disconnecting inside your Auro AI dashboard, or directly from your Google account at myaccount.google.com/permissions.

Auro AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9. Sub-Processors

Auro AI uses the following sub-processors to deliver the service. We have a Data Processing Agreement (DPA) with each, and for transfers outside the EU we rely on the EU-US Data Privacy Framework (DPF) certification where applicable, or Standard Contractual Clauses (SCCs).

We will update this list when we add or remove sub-processors. Material changes are communicated via email to active clients with at least 30 days notice. If you have specific residency requirements (e.g. healthcare or legal sector), contact [email protected] — we can discuss an EU-only deployment.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email to active clients. The "Last updated" date at the top of this page always reflects the latest revision.