Privacy Policy

When you create an account, we collect:

• Email address
• Display name
• Firebase user identifier (UID)
• Authentication provider (Google, Microsoft, or email/password)

When you create executive profiles within the Service, the following data is collected and stored:

• Full name, email address, job title, and company name
• Phone number and timezone
• Workday start and end times
• Associated Google account email address(es)
• Naming prefix preferences

When you authorize Google Workspace integration, we access the following data through Google APIs using OAuth 2.0:

When you authorize Slack integration, we access:

• Authenticated user ID and display name
• Team/workspace name
• User presence status (online, away, do not disturb)
• Conversation and channel names
• Message history from conversations you have access to
• Replies, reactions, read state, and search results
• User display names (cached locally, up to 200 entries)

Auri may also post messages, add or remove reactions, mark conversations read, or open a direct message when you request or approve those actions.

When you authorize Notion, Auri may access workspace and user information; search and read pages, databases, blocks, properties, and comments; and create, update, append to, comment on, or archive content when you request those actions.

When you authorize Asana, Auri may access your Asana profile and authorized workspaces, projects, sections, tasks, assignees, tags, dates, completion state, notes, and task relationships. Auri can create or update tasks and synchronize task changes when you request or enable those actions.

When you authorize Microsoft 365, Auri may access basic profile information and authorized Outlook mail, calendars, contacts, OneDrive files, and Microsoft To Do tasks. Depending on the permissions you grant and the action you request, Auri may read, create, update, organize, or send content through Microsoft Graph.

With macOS permission, Auri may access contact names, email addresses, and phone numbers through Apple Contacts, and may read or update reminder titles, notes, dates, priority, recurrence, completion state, and lists through Apple Reminders.

The Service collects and computes the following email analytics locally on your device:

• Email sent, received, and reply counts
• Average response times
• Communication volume by hour and day of week
• Top senders and recipients by frequency
• Up to 1,000 email analytics events stored locally

When read receipt tracking is enabled, the Service collects:

• Tracking identifier (UUID)
• Associated email message and thread identifiers
• Recipient email address(es) and email subject line
• Sent timestamp, open count, and open timestamps
• Delivery status (pending, sent, failed, opened)

The Service analyzes your sent emails to extract writing style characteristics, including formality level, tone patterns, common phrases, sentence structure, and average sentence and paragraph length.

Auri may process and store task and project titles, notes, dates, status, priority, tags, assignees, dependencies, reminders, comments, provider bindings, and supporting action metadata. When you invite another Auri user to shared work, we also process the inviter and recipient identifiers, email address, display name, role, invitation status, resource title, and timestamps.

Cloud assistant features may process selected message snippets, summaries, draft subjects and bodies, briefing content, indexes, action previews, approval state, execution receipts, and error information needed to prepare, route, approve, or complete an action.

When you use meeting features, Auri may process microphone or system audio, meeting titles, calendar links, participant or speaker labels, timestamps, transcripts, consent or disclosure status, summaries, decisions, commitments, and follow-up items.

Processing may occur locally, through OpenAI, or through an organization-managed relay according to the mode you select. Voice input and cloud-enabled transcription may upload audio for transcription. Local meeting files remain on your Mac unless a selected mode or sharing action requires cloud processing.

When you use travel features, the Service processes flight numbers, travel dates, passport country codes, destination country codes, and airport codes (IATA). This data is sent to third-party travel APIs as anonymous queries without personally identifiable information.

The Service stores your preferences locally, including application theme, default event duration, read receipt preferences, smart send preferences, undo send delay, availability time blocks, budget categories, and split inbox rules.

When you interact with Auri's AI features, the Service may process your text prompts and selected email, calendar, task, meeting, contact, Slack, Notion, document, file, or travel context, along with extracted topics of interest and audio you submit for transcription.

Depending on your configuration, relevant context may be sent to OpenAI either directly from the app or through an Auri-managed relay endpoint in order to generate summaries, drafts, briefings, reasoning, web-search-assisted answers, and voice transcriptions.

When you use our website or cloud endpoints, we and our hosting providers may process page URLs, referrers, approximate location, browser, operating system, device type, timestamps, IP address, request metadata, and error or security logs. Our public website uses Vercel Web Analytics for aggregated traffic measurement.

When you connect with another Auri user, relevant executive names, availability, calendar data, connection status, and collaboration messages may be shared with that connection. When you invite a user to a task or project, the invited and accepted collaborators can access the shared resource and may update it according to their viewer or editor role.

Not shared automatically: connecting or collaborating does not by itself grant access to your entire mailbox, Slack workspace, contact list, or unrelated tasks and projects.

When read receipt tracking is enabled, a tracking pixel is embedded in outgoing emails. The tracking pixel URL contains only a UUID-based tracking identifier and does not expose your personal information to the recipient.

We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Auri, our users, or others.

We do not share mobile phone numbers, SMS opt-in data, or SMS consent status with third parties or affiliates for marketing or promotional purposes.

We retain your data for as long as your account is active and as necessary to provide the Service.

Locally stored data persists until you delete it, clear it in Auri, or uninstall the application. Specific limits include: email analytics (rolling window of up to 1,000 events), contact/presence cache (in-memory only, cleared on restart), travel advisory cache (1-hour TTL), news article cache (30-minute TTL), and calendar/email cache (refreshed each session).

Cloud data is retained while your account, connection, shared work, message conversation, or workflow remains active and for as long as reasonably needed to provide, secure, troubleshoot, and document the Service. Some records may be deleted sooner by feature-specific lifecycle rules.

Email tracking records are retained indefinitely unless you request deletion.

Auri generally configures supported OpenAI requests with storage disabled. This does not eliminate provider abuse-monitoring logs, legal or security exceptions, or retention associated with a different feature or configuration. OpenAI states that API data is not used to train its models by default unless the customer opts in and that abuse-monitoring logs may be retained for up to 30 days by default. See OpenAI's current API data controls.

For meetings, transcript-only mode deletes raw audio after successful finalization; short-replay mode keeps local raw audio for up to seven days; and organization-managed mode follows the applicable organization policy. SMS transcript and delivery records may remain while SMS or the account is active and as needed for workflow continuity, support, security, or legal obligations.

When you request account deletion, we delete or deidentify personal information associated with the account that is no longer needed and revoke or delete stored integration credentials where supported. Some information may remain temporarily in backups or where retention is required for security, fraud prevention, dispute resolution, legal compliance, or technical integrity. Local data must be deleted in Auri or by uninstalling the application.

If you are a California resident, you have additional rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell personal information. No opt-out is required.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at privacy@auriassist.com.

If you are located in the EEA, you have additional rights under the GDPR:

• Legal Basis: We process data based on consent (OAuth), contractual necessity, and legitimate interests.
• Data Protection Rights: Access, rectification, erasure, restriction, portability, and objection to processing.
• DPO Contact: privacy@auriassist.com
• Supervisory Authority: You have the right to lodge a complaint with your local data protection authority.

Residents of the United Kingdom have equivalent rights under the UK GDPR. The provisions of Section 15.2 apply.

Auri uses OpenAI-backed services for optional AI features such as chat assistance, summaries, drafting, briefings, reasoning, web-search-assisted answers, and voice transcription. Depending on deployment configuration, these requests may be sent directly to OpenAI or first routed through an Auri-managed relay endpoint.

When external AI is enabled and you invoke an AI feature, the request may include your prompt together with relevant context needed to complete that task, such as selected email or thread content, calendar, task, meeting, contact, Notion, document, file, Slack, or travel context, or audio submitted for transcription.

We do not use your content to train Auri's own models, and we do not sell your data. OpenAI states that data sent to the OpenAI API is not used to train or improve OpenAI models by default unless the customer explicitly opts in.

Auri generally sets supported API requests not to store application state. OpenAI states that abuse-monitoring logs may still be retained for up to 30 days by default, subject to exceptions. Provider terms and technical controls may change, so review the linked API data controls for current details.

You can disable OpenAI-backed features globally or by feature area in the app. Auri also includes a separate control for sensitive email context. Auri does not send email on your behalf without your approval, and calendar write behavior remains subject to the approval controls you configure.