Privacy policy
What we do with the data about you and your team. The data about your own customers is covered by the data processing agreement, where we act on your instructions.
1. Two very different roles
Auralata handles two kinds of personal data, and the law treats them differently.
- Your account data — your name, work email, phone, company, VAT number, billing details, the people you invite and what they do in the product. For this we are the controller.
- Your customers' data — the profiles, orders, carts, consent records and message history that come from your WooCommerce shop. For this you are the controller and we are your processor. What we may do with it is set by the data processing agreement, not by this policy.
2. What we collect, and why
Account and billing
Name, email, phone, company, address, VAT number, plan, and the invoices we issue. Legal basis: performance of the contract, and our legal obligation to keep accounting records. We never see your full card number — payments run through our payment providers.
Product usage
Which screens are opened, which actions are taken, error traces, and the volume of emails, messages and AI credits used. Legal basis: legitimate interest in running and improving a product you pay for, and in billing correctly.
Shop data
Products, prices, stock, orders, customers, carts and consent, read from your WooCommerce through the connector. We write back only coupons you approve. Legal basis: your instruction, as processor.
Content you create
Briefs, generated images and copy, campaigns and flows. Legal basis: performance of the contract. Generated assets belong to you, as set out in terms of service.
3. AI generation
When you generate an image, a clip or a line of copy, the brief you write and the relevant brand kit and product details are sent to the model provider that produces it. We do not send your customer lists to model providers, and we do not use your content to train models. Every generated item is labelled as AI inside the product and in the campaign log.
The help chat. The assistant in the app bar sends what you type, the recent messages of that conversation and a short briefing about the store on screen — its name, domain, currency and connector state — to the model provider that answers. It does not send your customer list. The conversations are kept against your account and our staff can read them: it is how we find out where the product confuses people, where the assistant answers badly and what it is being asked to do, so that we can fix it and make it work as intended. We do not use them to train models, and we do not sell or share them. Please do not type anything into the chat that you would not want us to read — a password, a card number, or a customer's personal details. Legal basis: legitimate interest in running and improving a product you pay for.
4. Who else touches the data
We use a small number of sub-processors, each for one job. The full list, with company names, what each one sees and where, is in section 4 of the data processing agreement.
| Purpose | Where |
|---|---|
| Hosting, database, media and backups — Hetzner | Germany (EU) |
| Email delivery — Amazon SES | Germany (EU) |
| AI text and image generation — OpenAI, Google, Anthropic | United States, under standard contractual clauses |
| Reading your bank account, only if you connect one — Enable Banking | Finland (EU) |
| Payments for your plan, once switched on — Stripe and PayPal | EU and US |
We update that list at least thirty days before a new sub-processor starts, so you have time to object.
5. Transfers outside the EU
Where a provider processes data outside the EEA — today that is the AI providers and the payment providers — the transfer is covered by the European Commission's standard contractual clauses and, where applicable, by the EU–US Data Privacy Framework. You can ask us for a copy of the clauses.
6. How long we keep things
- Account data: while the account exists, then 30 days, then deleted.
- Invoices and accounting records: seven years, which is what the Estonian Accounting Act requires.
- Shop and customer data: deleted or returned within 30 days of the account closing, unless you ask for it sooner.
- Generated assets: kept for 12 months after creation so you can reuse them, then removed from active storage.
- Assistant conversations: 12 months after the last message, then deleted.
- Logs: 90 days for technical logs, 24 months for the campaign and approval log, because it is what proves who approved what.
7. Your rights
You can ask for access, correction, deletion, restriction, a copy of your data in a portable format, and you can object to processing based on legitimate interest. Write to info@auralata.com and we answer within 30 days. If you are unhappy with the answer you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to the supervisory authority in your own country.
If you are a customer of a shop that uses Auralata, we are only the processor — ask the shop. If you write to us anyway, we will pass the request on and tell you we did.
8. Cookies
The marketing site uses no tracking cookies and no advertising pixels. The product uses one cookie to keep you signed in and one local setting for your theme and language. No consent banner is shown because there is nothing to consent to; see cookie settings for the full list, and if that ever changes the banner will come with the change.
9. Security
Encryption in transit and at rest, access on a need-to-know basis with two-factor authentication for our own team, separate environments for development and production, backups with tested restores, and an audit log inside the product that you can read yourself. The full list of technical and organisational measures is an annex to the data processing agreement.
10. Contact
Fokus Labs OÜ, Estonia · info@auralata.com. We have not appointed a formal data protection officer because we are below the threshold that requires one; the address above reaches the person responsible.