Privacy Policy

Auvra Labs Privacy Policy

Version 2026-10-20

1. Who we are. This policy is published by 1001537887 Ontario Inc., operating as Auvra Labs ("Auvra," "we"). It covers auvralabs.com, the Auvra console, and our support and billing operations. Privacy contact: hello@auvralabs.com.

2. Our roles. Auvra is responsible for data it uses for its own purposes: our website, accounts, authentication, security, billing, support, our own sales work, and the company and business contact records we compile from public sources. For data that clients import or connect to their workspace ("client data"), Auvra processes it on the client's documented instructions under a signed Data Processing Agreement; the client is responsible for that data, and requests about it are routed to the client (section 10).

3. What we collect. Account basics (name, business email, role). Workspace data clients import or connect, such as companies, contacts, LinkedIn profile links, CRM records, notes, meetings, and emails. Files users upload, such as contact lists, their own LinkedIn connections export, or business card photos. Documents sent for signature, with signer name, email, and hashed network and browser details. Product activity (screens used, actions, tasks, outcomes). Support requests. Error diagnostics, scrubbed before they leave the app (no request bodies, cookies, or secrets). Security events (sign-ins, permission denials, privileged actions). Billing records. Website enquiries and, with consent, website visit analytics (section 11).

4. Where data comes from. Directly from you and your workspace. From first-party product activity. From public business sources such as registries, company websites, news, job postings, and public records. From business contact details that companies or people publish for business purposes, such as names, roles, work emails, phone numbers, and profile links. From files a user chooses to upload, such as their own LinkedIn connections export. From external suppliers of company-level facts. Company-level evidence is never treated as a person's consent, relationship, or intent. Auvra does not automate or scrape LinkedIn.

5. How we use data. To provide, secure, support, evaluate, and bill for the service: building research and review queues, scoring and ranking companies, showing usage and results, keeping tenants isolated, preventing abuse, and keeping accounts secure. We do not sell personal information. We do not use one client's private data to serve another client. We do not use identifiable client data to train general-purpose AI models without express written agreement.

6. AI and automated processing. Auvra uses AI for research, classification, ranking, summarization, and drafting. Current features include organizing CRM notes into fields, reading business cards from a photo, interpreting search requests, suggesting lead-quality reasons, and answering support questions. Each feature sends only the text or image needed for the task to our AI provider, currently OpenAI, and runs only when provider controls allow it. People review outputs before consequential external use. We do not make automated decisions that produce legal or similarly significant effects about individuals without human involvement.

7. Who receives data. Authentication, database, and storage: Supabase, United States. Hosting and delivery: Vercel, with server functions in the United States. Scrubbed error telemetry: Sentry, United States. AI features: OpenAI, when enabled. Account, signing, and system email: Resend, when enabled. Auvra's own calendar and outgoing email: Google Workspace. Website company identification, only with consent: public internet address registries receive the network address looked up. Payment records go to our payment processor when one is used. Providers receive only what their job needs. The current list, purposes, and locations are on our subprocessors page at /legal/subprocessors. Clients' own systems, such as their CRM, mailbox, or cloud tenant, are controlled by the client, not by Auvra.

8. International processing. We are a Canadian company. Our main providers process data in the United States. Some providers and public internet registries operate in other countries. We use contractual safeguards with our providers. Contact us with questions about cross-border processing.

9. Retention and deletion. We keep data while an account or contract is active and as needed for security, billing, tax, legal, and dispute obligations. Support chat questions and answers are cleared after 30 days. We do not yet delete website visit records or enquiries automatically; we delete them on request. After a verified deletion request or the end of a contract, we delete client personal data from live systems within 60 days. Deletion is a manual, approved, and recorded process, subject to identity verification, legal holds, records we are required to keep, and operational safety. Backup copies age out on our providers' backup cycles.

10. Your rights. You can ask to access, correct, or delete personal data about you, or raise a question or complaint, at hello@auvralabs.com. We verify identity before acting on a request. If your data lives in a client's workspace, we notify that client and assist them in responding. We aim to answer ordinary access requests within 30 days and will confirm the timeline that applies to your request. You may also complain to the privacy regulator that applies to you, including the Office of the Privacy Commissioner of Canada.

11. Cookies, browser storage, and website analytics. The console uses first-party cookies and browser storage needed to run it: sign-in session, selected workspace (up to one year), theme (up to one year), short-lived security cookies when connecting a calendar or mailbox (10 minutes), and display preferences such as column order and saved filters. The public website, auvralabs.com, stores your privacy choice in your browser for 180 days. Optional analytics and company identification stay off until you accept them. Use Reject optional, Accept all, or Preferences, and reopen Cookie settings in the website footer to change or withdraw your choice. Global Privacy Control and Do Not Track turn optional collection off. We do not use advertising cookies or third-party analytics scripts.

With analytics permission, we collect page paths, permitted campaign tags, referrer, device type, country, region, and city estimated from your network address, and a daily identifier derived from your network address and browser using a server-held secret. The visitor analytics database does not store your raw network address. Hosting providers process network requests for delivery and security under their own retention controls.

Company identification is a separate optional choice that requires analytics. It uses network information, reverse DNS, and public internet address registries (RDAP) to suggest a business. Those registries receive the lookup needed to identify the network owner. A network match is an estimate: shared connections, home working, and VPNs can prevent or misidentify it. It does not establish a person's identity or buying intent.

Enquiries and booking links work without optional consent. We store information you submit so we can respond. Only with company-identification permission do we connect an enquiry's supplied company to that day's browsing activity. Calendar attendee details do not prove who booked or who visited the website. Withdrawing consent stops future optional collection; it does not automatically erase earlier records, which you can ask us to delete (section 10).

12. Security. Data is encrypted in transit and at rest through our infrastructure providers. Connected calendar, mailbox, and signing tokens are also encrypted by the application. Access is limited by workspace, role, and server-side authorization. Multi-factor sign-in is available and enforced for users who enroll. Security-relevant actions are recorded. Secrets are kept out of logs and telemetry. We operate an incident-response process. If a personal-data incident affects a client's data, we notify that client without undue delay in line with our agreements and applicable law.

13. Children. The service is for business use and is not directed to children; we do not knowingly collect children's personal information.

14. Changes. Material changes to this policy are posted here with a new version date; account holders are notified in the console or by email.

15. Contact. hello@auvralabs.com. 1001537887 Ontario Inc., operating as Auvra Labs.