Legal & Privacy
Privacy Policy
AURA is an AI-powered lead management and conversation platform. This policy explains what personal data we collect, why we collect it, and how you can control it.
01 Overview
AURA helps businesses receive, qualify, and respond to inbound leads through channels including Facebook Messenger, Telegram, and website chat. When someone messages a business using AURA, their message and publicly available profile information are processed so the business can respond — often with the help of AI.
This policy applies to all individuals whose data is processed through the AURA platform, including people who message a business through Messenger and business owners who connect their Facebook Pages via AURA's Login flow.
02 Who We Are
AURA Operator ("AURA", "we", "our") operates the platform at auraoperator.com. We act as a data processor on behalf of the businesses that use AURA, and as a data controller for the platform infrastructure itself.
03 Data We Collect
We collect data from two types of people: leads (people who message a business through AURA) and operators (business owners who connect their accounts).
| Category | Data points | Source |
|---|---|---|
| Identity | Full name, display name | Messaging platform profile |
| Contact | Email address, phone number | Platform profile or form input |
| Profile | Profile picture | Messaging platform |
| Messages | Full text of inbound and outbound conversations | Messaging platform webhook |
| Lead signals | Inferred intent, urgency, lead score | AI-derived from message content |
| Channel identifiers | Platform user IDs, thread IDs | Platform webhooks |
| Platform tokens (operators) | OAuth access tokens for connected accounts | OAuth authorization flow |
| Technical | IP addresses, timestamps, session cookies | Server logs / browser session |
04 How We Use It
| Purpose | Legal basis |
|---|---|
| Receiving and routing inbound messages | Legitimate interest / contractual necessity |
| Generating AI-assisted replies on behalf of the business | Legitimate interest / operator consent |
| Qualifying and scoring leads | Legitimate interest |
| Sending follow-up messages and booking reminders | Legitimate interest / consent |
| Authenticating business operators | Contractual necessity |
| Operating and securing the platform | Legitimate interest |
05 AI Processing
AURA uses AI models to analyze inbound messages, infer lead intent, and generate reply suggestions. Message content is sent to AI service providers for processing. We do not use your messages to train AI models beyond what is permitted by their terms of service.
06 Third Parties
| Service | Purpose | Data shared |
|---|---|---|
| Meta / Facebook | Messenger delivery, profile lookup, OAuth | Message content, Facebook User ID, page tokens |
| AI processing services | Reply generation and intent classification | Message text, conversation context (no direct personal identifiers) |
| Booking services | Appointment booking links (when configured) | Link only — booking service's policy governs data entered there |
| Telegram | Message delivery (when configured) | Message content, Telegram user ID |
We do not sell personal data to third parties for advertising or marketing purposes.
07 Facebook & Meta
AURA integrates with the Meta Platform to receive and send Facebook Messenger messages on behalf of business Pages. By messaging a business Page connected to AURA, your conversation and profile information are processed through the Meta Platform and stored by AURA on behalf of that business.
Facebook Login: When a business operator connects their account, AURA requests only the permissions necessary to connect Facebook Pages and send/receive Messenger messages. No data is accessed beyond what is required for these functions.
Data deletion: If you remove the AURA app from your Facebook account or request data deletion via Facebook, Meta will notify AURA automatically and your data will be deleted. See Data Deletion below.
AURA's use of Meta API data complies with Meta's Platform Terms and Developer Policies.
08 Retention
| Data type | Retention period |
|---|---|
| Conversation messages | Until deleted by the operator or on data deletion request |
| Lead records and contact profiles | Until deleted by the operator or on data deletion request |
| Access tokens | Until revoked or on data deletion request |
| Server logs (IP addresses) | Up to 90 days |
| Session cookies | Session duration only |
09 Security
We implement appropriate technical and organisational measures to protect personal data, including encryption of data in transit, secure session management, access controls on all platform endpoints, and verification of inbound webhook authenticity.
No method of transmission over the internet is 100% secure. If you discover a security issue, contact security@auraoperator.com.
10 Your Rights
| Right | Description |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Correction | Request correction of inaccurate data |
| Deletion | Request deletion of your personal data |
| Portability | Request your data in a structured, machine-readable format |
| Objection | Object to processing based on legitimate interest |
| CCPA (California) | Right to know, delete, and opt out of sale (we do not sell data) |
Email privacy@auraoperator.com to exercise any right. We respond within 30 days.
11 Data Deletion
For all other deletion requests, email privacy@auraoperator.com with the subject "Data Deletion Request". We confirm deletion within 30 days.
12 Children
AURA is not directed at children under 13 (or 16 in the EU). We do not knowingly collect personal data from children. Contact us to have it deleted if you believe otherwise.
13 Policy Changes
We may update this policy from time to time. The effective date above reflects any changes. Business operators will be notified of material changes via email or in-product notice.
14 Contact
AURA Privacy Team
Privacy: privacy@auraoperator.com
Security: security@auraoperator.com
Website: www.auraoperator.com