Aurynge Privacy Policy

1. Scope

This Privacy Policy applies when you visit our website, create an account, connect third-party services, use AI features, upload content, communicate with us, or interact with public Aurynge-powered realtor pages.

It does not govern third-party products or services that have their own privacy policies, including identity providers, email providers, SMS providers, AI model providers, and other integrations you choose to connect.

2. Information We Collect

Information you provide directly

Account details such as your name, display name, email address, password credentials, and tenant or workspace details.
Business and branding information such as company name, public page content, contact details, access codes, settings, uploaded documents, and CRM-related content you submit or sync.
Communications and support information, including messages you send to us, lead-capture submissions, unsubscribe requests, and feedback.

Information collected when you use the service

Technical and usage data such as IP address, approximate request metadata, session identifiers, device or browser signals, logs, diagnostics, and service events.
Cookie, local storage, and session storage data used to maintain sign-in state, chat sessions, theme preferences, city preferences, abuse prevention, and service limits.
Telemetry and operational usage data, including token usage, feature activity, event timestamps, and service health information.

AI and chat data

Prompts, uploaded context, retrieved knowledge-base content, model responses, ratings, and related metadata may be processed when you use Aurynge AI features.
Homepage marketing chat is generally processed for the live session plus abuse prevention, quota tracking, and service operations.
Public realtor-page chat may be stored with conversation content, session identifiers, ratings, and related metadata so the relevant tenant can review conversations, measure usage, improve prompts, and follow up on leads.

Connected account and integration data

If you connect providers such as Microsoft or Google, we may receive profile data, email and calendar metadata, tokens, and other data necessary to provide the requested sync or workflow.
If you use optional communications features, we may process message content and delivery metadata through providers such as SendGrid and Twilio.

3. Google User Data

Aurynge accesses Google user data only when you choose to connect a Google account and authorize the requested permissions. Depending on the Google features you enable, Aurynge may access, process, and store the following categories of Google user data:

Google account identity data: name, email address, profile claims, provider account identifiers, and account-linking metadata used to identify the connected account inside Aurynge.
Gmail data: message identifiers, thread identifiers, labels, headers, sender and recipient addresses, subjects, message bodies, read or unread state, attachments when required for a user workflow, and synchronization metadata.
Google Calendar data: calendar event identifiers, titles, descriptions, attendees, dates, times, locations, recurrence information, reminders, and event synchronization metadata.
Google Contacts data: names, email addresses, phone numbers, organizations, notes or other contact fields returned by Google People API and used for CRM contact workflows.
OAuth and sync data: access tokens, refresh tokens, expiration timestamps, scopes, provider account IDs, push notification history IDs, and related operational metadata needed to maintain the integration.

How Aurynge uses Google user data

Aurynge uses Google user data only to provide or improve user-facing features that you enable in Aurynge, including account linking, email synchronization, outbound email you compose or authorize, calendar sync and scheduling, contact import or update workflows, CRM history, search, drafting, summarization, automation workflows, diagnostics, security, abuse prevention, and support you request.

Aurynge does not sell Google user data, use Google user data for advertising, use Google user data to determine credit-worthiness or for lending purposes, or use Google user data to train generalized AI or machine-learning models.

How Aurynge shares or transfers Google user data

Aurynge does not transfer or disclose Google user data to third parties except as necessary to provide or improve user-facing Aurynge features you request, comply with applicable law, protect the service, investigate abuse or security issues, complete a merger, acquisition, or sale of assets with appropriate user notice or consent where required, or support you when you explicitly ask us to help with your account or data.

When a user-facing AI, search, automation, delivery, hosting, or infrastructure feature requires a service provider to process Google user data, that processing is limited to operating the requested Aurynge feature and is subject to confidentiality and security controls. Humans do not read Google user data unless you give explicit consent for support, it is necessary for security or abuse investigation, it is required by law, or the data is aggregated or de-identified for internal operations.

Aurynge's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy , including the Limited Use requirements.

4. How We Use Information

To provide, operate, secure, maintain, and improve Aurynge.
To create and manage accounts, authenticate users, and administer workspaces and tenants.
To power AI features, retrieval, drafting, search, chat, automations, and public realtor assistants.
To process uploads, leads, campaigns, messages, notifications, and requested integrations.
To monitor usage, enforce rate limits, prevent fraud or abuse, troubleshoot incidents, and protect the platform.
To send service communications, transactional notices, security alerts, onboarding messages, and, where permitted, product updates.
To comply with legal obligations, resolve disputes, and enforce our agreements.

Legal bases for processing

Where data protection law, including the EU and UK General Data Protection Regulation (GDPR), requires a legal basis, Aurynge relies on the following:

Performance of a contract: to create and operate your account, provide the features you subscribe to, and run the integrations and workflows you request.
Consent: to connect Microsoft, Google, or other third-party accounts, to send optional product updates, and for other processing where we ask for your permission. You can withdraw consent at any time; withdrawal does not affect processing that already took place.
Legitimate interests: to secure the service, prevent fraud and abuse, troubleshoot incidents, and maintain and improve features, where those interests are not overridden by your rights.
Legal obligation: to keep required business records, respond to lawful requests, and meet regulatory duties.

5. Microsoft Graph and Outlook Data

Aurynge accesses Microsoft user data only when you choose to connect a Microsoft account and authorize the requested Microsoft Graph permissions. Depending on the Microsoft features you enable, Aurynge may access, process, and store the following categories of Microsoft user data:

Microsoft account identity data: name, email address, profile claims, provider account identifiers, and account-linking metadata used to identify the connected account inside Aurynge.
Outlook mail data: message identifiers, folder identifiers, headers, sender and recipient addresses, subjects, message bodies, read or unread state, attachments when required for a user workflow, and synchronization metadata.
Outlook send data: user-composed or user-authorized outbound messages sent through Microsoft Graph.
Microsoft calendar data: calendar event identifiers, titles, descriptions, attendees, dates, times, locations, recurrence information, reminders, and event synchronization metadata.
Microsoft contact data: names, email addresses, phone numbers, organizations, notes, addresses, and other contact fields returned by Microsoft Graph and used for CRM contact workflows.
OAuth and sync data: access tokens, refresh tokens, expiration timestamps, scopes, provider account IDs, webhook subscription metadata, and related operational metadata needed to maintain the integration.

Microsoft account removal and consent

Removing a connected Microsoft account removes its stored credential and repository-managed account copies. It does not withdraw Microsoft's consent grant or completely erase merged CRM records, separately stored files, Graph registrations, queued work or backups. Contact support for a complete deletion review. Remove Aurynge access in your Microsoft account, or ask your organization's administrator to withdraw consent. Browser sign-out is separate from consent withdrawal.

How Aurynge uses Microsoft user data

Aurynge uses Microsoft user data only to provide or improve user-facing features that you enable in Aurynge, including account linking, Outlook mail synchronization, outbound email you compose or authorize, calendar sync and scheduling, contact import or update workflows, CRM history, search, drafting, summarization, automation workflows, diagnostics, security, abuse prevention, and support you request.

Aurynge does not sell Microsoft user data, use Microsoft user data for advertising, use Microsoft user data to determine credit-worthiness or for lending purposes, or use Microsoft user data to train generalized AI or machine-learning models.

How Aurynge shares or transfers Microsoft user data

Aurynge does not transfer or disclose Microsoft user data to third parties except as necessary to provide or improve user-facing Aurynge features you request, comply with applicable law, protect the service, investigate abuse or security issues, complete a merger, acquisition, or sale of assets with appropriate user notice or consent where required, or support you when you explicitly ask us to help with your account or data.

When a user-facing AI, search, automation, delivery, hosting, or infrastructure feature requires a service provider to process Microsoft user data, that processing is limited to operating the requested Aurynge feature and is subject to confidentiality and security controls. Humans do not read Microsoft user data unless you give explicit consent for support, it is necessary for security or abuse investigation, it is required by law, or the data is aggregated or de-identified for internal operations.

6. When We Share Information

We do not sell personal information in the ordinary sense of selling customer data lists. We may share information in the following circumstances:

With service providers and subprocessors that help us operate the platform, including hosting, telemetry, email delivery, SMS delivery, authentication, AI inference, vector search, and infrastructure providers.
With the tenant or realtor whose public page, chatbot, or lead form you interacted with, including the content of your submission or conversation where the product is designed to surface that information to the tenant.
With connected third-party services when you authorize an integration or sync.
With professional advisers, auditors, insurers, law enforcement, regulators, or courts where reasonably necessary.
As part of a financing, acquisition, sale of assets, merger, or similar corporate transaction, subject to appropriate confidentiality protections.

7. AI Processing

Aurynge uses hosted AI and retrieval systems to power features such as chat, drafting, summarization, knowledge retrieval, and automation. Depending on the feature, we may send prompts, message content, document excerpts, CRM context, and related metadata to model or vector-search providers to generate results.

When Google user data or Microsoft user data is included in an AI workflow, Aurynge processes that data only for the user-facing feature you selected or authorized and not for advertising, resale, or training generalized AI models.

AI output can be inaccurate, incomplete, or inappropriate. You remain responsible for reviewing outputs before acting on them, especially for communications, compliance workflows, contracts, or business decisions.

8. Cookies, Local Storage, and Similar Technologies

We use cookies, session cookies, browser storage, and similar technologies to keep users signed in, remember preferences, support chat sessions, store public-page access context, enforce rate limits, and operate the service.

If you block or clear these technologies, some features may stop working properly.

9. Data Retention and Deletion

We retain personal information for as long as needed to provide the service, maintain security, support legitimate business operations, meet contractual obligations, and comply with applicable law.

Retention periods vary depending on the data type, the tenant configuration, the feature used, the sensitivity of the information, and our legal or operational needs. We may retain logs, backups, security records, billing records, and dispute-related records for longer periods where appropriate.

Google user data is retained while the Google account remains connected, while the user-facing workflow requires the data, or while retention is required for security, legal, billing, backup, or dispute-resolution purposes. When you disconnect a Google account or request deletion of Google provider data, Aurynge deletes locally stored Google OAuth tokens, account records, synchronized email, calendar data, contact data, attachments, and related search or vector records according to the product deletion workflow, subject to limited backup, legal, and security retention needs.

Microsoft user data is retained while the Microsoft account remains connected, while the user-facing workflow requires the data, or while retention is required for security, legal, billing, backup, or dispute-resolution purposes. When you disconnect a Microsoft account or request deletion of Microsoft provider data, Aurynge deletes locally stored Microsoft OAuth tokens, account records, synchronized Outlook mail, calendar data, contact data, attachments, webhook subscription metadata, and related search or vector records according to the product deletion workflow, subject to limited backup, legal, and security retention needs.

You can request deletion at aurynge.com/data-deletion. Authenticated users can also delete provider-linked data from account management controls where available.

10. Security

We use administrative, technical, and organizational safeguards that are intended to be appropriate to the sensitivity of the information we process. These measures may include authentication controls, encryption in transit, encryption of OAuth tokens at rest, access controls, secrets management, rate limiting, audit trails, logging controls, monitoring, and least-privilege operational access.

No system is perfectly secure, and we cannot guarantee absolute security.

11. International Processing

Aurynge and its providers may process or store information in Canada, the United States, or other jurisdictions where we or our subprocessors operate. Information transferred to another jurisdiction may be accessible to courts, law enforcement, or regulators under that jurisdiction's laws.

When personal information is processed outside the jurisdiction where it was collected, we require our service providers to protect it through contractual confidentiality, security, and data protection commitments appropriate to applicable law. Contact privacy@aurynge.com for more information about the safeguards we use.

12. Your Choices and Rights

Depending on the circumstances and applicable law, including Canadian privacy law and the GDPR where it applies, you may be able to:

access the personal information we hold about you and receive a copy of it;
correct (rectify) inaccurate or incomplete information;
request erasure (deletion) of your information;
restrict our processing of your information;
receive information you provided in a structured, commonly used, machine-readable format, and ask us to transmit it to another controller where technically feasible (portability);
object to processing based on legitimate interests;
withdraw consent to certain uses of personal information, subject to legal or contractual limits;
disconnect integrations or stop using AI or public-page features;
unsubscribe from non-essential emails using the unsubscribe mechanism included in those messages.

Aurynge does not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects. AI features produce suggestions and drafts that you review before acting on them.

To exercise these rights, contact privacy@aurynge.com. We will respond within 30 days, may need to verify your identity, and will explain any legal limits on a request.

You also have the right to complain to a privacy regulator. In Canada you can contact the Office of the Privacy Commissioner of Canada or, in British Columbia, the Office of the Information and Privacy Commissioner for British Columbia. If you live elsewhere, you can contact the data protection authority where you live or work.

If you interact with a public realtor page, the relevant tenant may also control some of the information collected through that page.

Data deletion requests can be submitted using the instructions at aurynge.com/data-deletion.

13. Children

Aurynge is intended for business and professional use and is not directed to children under 13. If you believe a child has provided personal information to us inappropriately, contact us and we will review the request.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, including changes to how Aurynge accesses, uses, stores, shares, retains, or deletes Google user data or Microsoft user data, we may provide notice through the service, by email, by in-product notification, or by updating the effective date or last updated date above. Where required, we will ask users to review and consent to updated data practices before using Google user data or Microsoft user data in a new way.

Aurynge Signing

The organization sending your documents and Aurynge process your name, contact details, document content and responses, typed or drawn signatures and initials, consent wording and version, verification results, delivery status and signing events. We use these records to deliver the request, verify access, record your signing decisions, produce completed documents and preserve evidence. Email or SMS verification demonstrates access to that channel; it does not independently prove your legal identity.

Authorized users of the sending organization and appointed record custodians may access the documents and evidence. SendGrid processes signing emails and delivery information. When SMS is used, Twilio processes your phone number, message and delivery information. Sectigo receives a cryptographic digest and technical request information to timestamp the PDF seal; the timestamp request does not contain the PDF itself. These providers may process information outside Canada, including in the United States and other countries, where local laws may permit government access.

Aurynge-controlled signing documents, evidence and their managed backups are stored in Canada. A separately downloaded copy is controlled by its holder. Retention depends on the document, applicable obligations and the sender's approved rules. Disputes, investigations or other legal holds can delay deletion. Backup expiry and deletion receipts are checked separately from deletion of active records. Contact the sender for the retention period applicable to your documents.

You can stop before submitting and ask the sender about another signing method. After signing, contact the sender to request access, correction or withdrawal, subject to applicable legal and contractual limits. Withdrawal does not automatically erase an executed agreement or evidence that must be retained. Signing consent does not authorize marketing messages. Keep your invitation and verification codes private. For privacy requests or concerns, contact privacy@aurynge.com.

15. Contact Us

Aurynge Inc. is the controller responsible for personal information processed through Aurynge, except where a tenant or realtor controls information collected through its own public page. Our privacy contact handles data protection questions and requests. For privacy questions, requests, or complaints, contact:

Aurynge Inc.
Privacy email: privacy@aurynge.com
Support email: support@aurynge.com
Website: www.aurynge.com

If you are a realtor-page visitor and your request relates to a specific realtor or tenant page, please include the page URL and any relevant session or contact details so we can route your request correctly.