Privacy Policy

1Controller and processor

Which of us is responsible for a piece of data depends on what it is, and the distinction matters if you are using auramind at work.

For your account — your email address, your name, your billing details and the record of how you used the service — we are the controller. We decide why we hold it and what we do with it, and this policy is how we tell you.

For the content you put in, you are the controller and we are the processor. A document you upload may contain personal data about your own employees, customers or suppliers. We did not choose to collect it, we do not decide what it is for, and we act on your instructions in handling it. Where you use auramind through an organisation, that organisation is the controller.

The law requires that second relationship to be set out in a written agreement between us. We do not yet have one drawn up. If you need a data processing agreement, write to us and we will put one in place.

2What we collect

We collect three kinds of information.

• Account information — your email address, display name, time zone and avatar, plus which organisation you belong to and your role in it. Your password is held by our authentication provider and never stored by us.
• Content you put into the service — documents you upload, the messages you send, the agents you configure and the connectors you enable.
• Operational records — when you signed in, which requests were made, how many tokens and how much sandbox time a run used, and what a run did at each step. These make the service work, let you see what your agents did, and let us bill accurately.

3Why we process it, and on what basis

To provide the service you asked for, which is our performance of the contract between us. That covers running agents, storing your documents, retrieving passages to answer a question and showing you your own history.

To take payment and meet our tax and accounting obligations, which is a legal obligation and our legitimate interest in being paid.

To keep the service secure and working — rate limiting, abuse prevention, debugging a failure — which is our legitimate interest in a service that stays up and is not misused.

To send you service messages such as invitations, billing notices and notifications you have configured. Marketing email, if we ever send it, will be on consent and you will be able to stop it.

We do not use your content to train models, and our model routing is configured to permit only providers operating under zero data retention.

4Where your content lives

Content is not confined to a single place, and being specific about that is more useful than a reassurance. The table below is written from the code.

5Who we share it with

We do not sell personal information, and we have never sold it. We do not share it for cross-context behavioural advertising.

We use the processors below to run the service. Each receives only what its job requires. A current list is also available from hello@auramind.tech.

We will also disclose information where the law requires it — a valid court order, for example — and, where we are permitted to, we will tell you first.

If the business is ever sold or merged, your information may transfer as part of it. You would be told before that took effect.

6How long we keep it

In general we keep your content until you delete it. We would rather you were able to find something you wrote a year ago than have it disappear on a schedule you did not choose.

7Your rights

Wherever you live, you can ask us for a copy of your personal data, ask us to correct it, ask us to delete it, or ask us to stop a particular use. Write to hello@auramind.tech and we will respond within the time the law allows — one month under the GDPR, forty-five days under the CCPA.

If you are in the EU, the UK or Switzerland, you also have the right to restrict or object to processing, the right to data portability, the right to withdraw consent where we relied on it, and the right to complain to your local supervisory authority.

If you are in California, you have the right to know what we collect and why, the right to delete it, the right to correct it, and the right not to be treated differently for exercising any of them. We do not sell or share your personal information, so there is nothing to opt out of.

We do not yet offer these as buttons in the application. Requests are handled by hand, by a person, when you write to us — we would rather say so than describe a self-service flow that does not exist.

Much of this you can also do yourself: you can delete a conversation, delete a document, and close your account.

8International transfers

Arc10 is a Canadian company, and the service runs on servers in Detroit, Michigan, the United States, operated on our behalf by our hosting provider. Your content is stored there. The processors listed above operate on their own infrastructure, which may be elsewhere again.

So your data will in most cases be held outside the country you are in, and outside Canada. We say this plainly because it is the kind of thing a policy can leave a reader to infer.

Where personal data moves from the European Economic Area, the United Kingdom or Switzerland, we rely on standard contractual clauses or another transfer mechanism the law recognises for the destination. Ask us and we will tell you which applies to your data.

9Security

Servers are operated on our behalf by our hosting provider in Detroit, Michigan. Physical and network security of the machines is theirs; everything above that is ours.

Data is scoped to your organisation at the data layer, and a request that cannot prove which organisation it belongs to is rejected rather than allowed through. Access to documents within an organisation is controlled by tags you configure.

Code an agent writes runs in an isolated sandbox with no network of its own, behind a proxy that decides each outbound connection and logs the outcome.

Traffic is encrypted in transit. Message content is not yet encrypted at rest beyond the encryption the storage layer provides — provider keys and connector secrets are separately encrypted. Our security page states which controls are in place and which are planned.

No system is perfectly secure. If we suffer a breach affecting your personal data we will notify you and the relevant regulator as the law requires.

10Cookies

We use one cookie: the session that keeps you signed in. It is set when you log in, it is httpOnly so scripts cannot read it, and it is cleared when you sign out.

There is no analytics on this site or in the application. No Google Analytics, no tracking pixels, no advertising cookies, no session recording, and no third-party scripts watching what you do. There is no consent banner because there is nothing to consent to.

11Children

The service is not intended for children, and we do not knowingly collect their personal data. If you believe a child has given us information, write to us and we will remove it.

12Changes to this policy

We update this policy when the software changes. The date at the top is the last time it changed, and where a change materially affects how we handle your data we will tell you before it takes effect.

13Contact

Privacy questions and requests: hello@auramind.tech.

Arc10 — registered as Arc10 Technologies Inc., 200 Consumers Rd Ste 210, North York, ON M2J 4R4, Canada.