Translation. The Hungarian version (Adatkezelési tájékoztató) is the binding text; this English version is a courtesy translation.
In short. Auro AI is built for businesses. For data collected on our website, at sign-up and for billing, we are the controller; the data of our customers’ own customers and staff held in Auro AI we process on our customer’s behalf, as processor (Data Processing Agreement). We store data in the EU, and AI functions use an EU provider by default.
1. The controller
- Controller
- Evosolve Korlátolt Felelősségű Társaság (Evosolve Kft.), trading as Auro AI
- Seat
- 6722 Szeged, Kálvária sugárút 19., Hungary
- Company reg. no.
- 06-09-024422 (Szegedi Törvényszék Cégbírósága)
- Tax number
- 26344465-2-06 (EU VAT: HU26344465)
- Representative
- Van Der Walt Johannes Lodewicus, managing director
- Privacy contact
- [email protected]
We have not appointed a data protection officer because the law does not require it; privacy matters are handled at the address above. You can also submit a request through the auroai.eu/privacy/request form.
2. When we are controller or processor
- We are the controller for data of our own customers and prospects (sign-up, enquiries, billing, payment), website visitors and the security logs of the service. This notice applies to them.
- We are the processor for all personal data our customer uploads to or creates in Auro AI (for example its customers, suppliers, employees, the mail in its inbox). Our customer is the controller of that data and you exercise your rights with it. If you contact us we forward your request to the customer concerned.
3. Purposes, data, legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Registration, account, performance of the contract, support | Name, e-mail, company name, phone, company and billing details, user settings | Performance of a contract or steps before it (GDPR Art. 6(1)(b)); for individual contacts, legitimate interest (f) |
| Payment of fees (card collection on Revolut’s payment page) | Billing details, payment transaction ID and status (we do not handle card data; Revolut does) | Performance of a contract (Art. 6(1)(b)) |
| Invoicing, accounting and tax duties | Billing details, invoices, vouchers | Legal obligation (Art. 6(1)(c)); Accounting Act, VAT Act, Tax Procedure Act |
| Proof of acceptance of the terms, DPA and consents | Time and IP address of acceptance, version of the document accepted | Legitimate interest: establishing and defending legal claims (Art. 6(1)(f)) |
| Security, abuse prevention, troubleshooting | Server and error logs, IP address, browser data, action logs | Legitimate interest (Art. 6(1)(f)): protecting the service and customers |
| Service notices (invoice, password reset, changes) | E-mail address, name | Performance of a contract (Art. 6(1)(b)) |
| Newsletter, marketing e-mail | E-mail address, name, fact of subscription | Consent (Art. 6(1)(a); Act XLVIII of 2008 s. 6); withdrawable any time through the unsubscribe link in the mails |
| Aggregate website visits | Anonymous, aggregated data (page, language, referring domain, device type) | Legitimate interest (Art. 6(1)(f)); the data does not identify a person |
| Detailed on-site usage analysis | Clicks, scrolling, a random browser identifier (not tied to your name) | Consent (Art. 6(1)(a); Electronic Communications Act s. 155) - only after you accept in the cookie banner |
| Legal disputes, official requests | The necessary part of the above | Legal obligation or legitimate interest (Art. 6(1)(c), (f)) |
We collect data mainly from you; log data produced when you use the service is generated by us. Providing the data is a condition of the contract; without it we cannot provide the service. We do not take decisions based solely on automated processing that have legal effects on you.
4. Retention
| Data | Retention |
|---|---|
| Account and contract data | For the term of the contract; deleted within 30 days after it ends (except accounting documents). |
| Invoices, accounting vouchers, payment evidence | 8 years (Accounting Act s. 169), as a legal obligation. |
| Acceptance records (time, IP, version) | For the term of the contract, then until legal claims lapse (generally 5 years, Civil Code 6:22). |
| Server and error logs, action logs | 12 months, then rolling deletion. |
| Website analytics data | 12 months; aggregate statistics contain no identifier. |
| Prospect data (enquiries, contact) | Up to 3 years from the last contact, or until you object. |
| Newsletter subscription | Until you withdraw consent. |
| Data our customer uploads (as processor) | For the term of the contract; after it ends a 30-day export period under section 10 of the DPA, then deletion (from backups within 90 days at most). |
| Database backups | 14 daily and 8 weekly copies on the hosting; the daily copy on a different server (Hetzner Cloud, Nuremberg) for 14 days. Backups are not encrypted at rest. Deleted data disappears from backups within 90 days at most. |
| Tokens and cache of connected services | Deleted within 30 days of disconnecting. |
| Deletion audit trail (fact of deletion, without personal data: one-way hash, timestamp) | Indefinitely, to show accountability under GDPR Art. 5(2). It contains no personal data. |
Automated routines delete data when the retention period ends; deletion cannot be undone.
5. Recipients, processors
We have the following processors handle data as far as needed to provide the service, under data processing agreements. The complete current list: auroai.eu/subprocessors.php.
- Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany): web hosting, database, own mail server, and the backup copy (Hetzner Cloud, Nuremberg) - EU.
- Mistral AI SAS (France): AI-based processing by default - EU.
- Revolut Bank UAB (Lithuania): card collection of the subscription fee - EU.
- Cloudflare, Inc.: DNS, CDN, DDoS protection - EU network nodes, US parent company (standard contractual clauses).
- Services you connect (for example Google Workspace/Gmail/Calendar, Microsoft 365, Meta/WhatsApp, Twilio, LinkedIn) - only if you switch on that integration.
Independent-controller recipients: the NAV (Hungarian tax authority) and other authorities where the law obliges us to report; our customer’s invoice reporting to NAV is carried out on the customer’s instruction and in its name (the customer is the controller there). Our accountants and legal representative, and authorities, may receive the data needed for their tasks.
6. Artificial intelligence
Part of Auro AI uses artificial intelligence. By default the AI processes your or our customer’s data with Mistral AI SAS, which operates in the EU. We do not use our own or our customers’ data to train AI models. AI assistants identify themselves as AI to end users (EU AI Act, Regulation (EU) 2024/1689). The user reviews and approves AI output before it has effect.
7. Transfers outside the EU
By default we do not transfer personal data outside the EEA. Exceptions: (a) our customer adds its own AI key whose provider processes data outside the EU and the customer has expressly accepted this - without acceptance the key is not used and data stays on the EU route; (b) connected services with a non-EU parent company (for example Google) that you choose to connect; (c) the US parent company of infrastructure providers (Cloudflare). The safeguard is the provider’s certification under the EU-US Data Privacy Framework and/or the Commission’s standard contractual clauses (SCC); the mechanism for each provider is on the list, and we give a copy on request.
8. Your rights
You may request access to your data (GDPR Art. 15), its rectification (16), erasure (17), restriction of processing (18) and portability (20). You may object to processing based on legitimate interest (21) and withdraw consent at any time (without affecting processing before withdrawal). Send your request to [email protected] or use the form; we answer without undue delay and within one month at the latest (extendable by two months for complex cases, and we will tell you). Fulfilling your request is free of charge. We may need to verify your identity.
9. Complaints, NAIH
If you believe our processing of your personal data infringes the law you can complain to the supervisory authority:
- Authority
- Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, Hungarian National Authority for Data Protection and Freedom of Information)
- Address
- 1055 Budapest, Falk Miksa utca 9-11., Hungary; postal: 1363 Budapest, Pf. 9.
- Phone
- +36 1 391 1400
- [email protected]
- Website
- www.naih.hu
You may also go to court (Infotv. s. 22; GDPR Art. 79); at your choice the action can be brought before the tribunal for your place of residence. We suggest you contact us first so we can resolve the matter quickly.
10. Cookies
Our Cookie Notice describes the cookies and similar technologies used on our website.
11. Google integrations
If our customer connects a Google account to Auro AI, the service may request the following Google OAuth scopes, each only for the function concerned and with the customer’s approval:
- Google Calendar (
calendar.readonly,calendar.events): reading free time slots and creating, changing and deleting bookings as calendar events. - Gmail (
gmail.readonly,gmail.modify, and if the customer switches it on:gmail.send): showing incoming mail in the Auro inbox, marking it (for example as read), and sending mail the customer has approved. - Google Drive (
drive.readonly): read-only import of documents the customer selects into the knowledge base. - Basic profile (
userinfo.email,profile,openid): identifying the connected account.
Auro AI’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Accordingly:
- we use Google user data only to provide the user-facing functions described above;
- we do not transfer it to third parties, except as needed to provide the function, as the law requires, or as part of a merger or acquisition with prior notice;
- we do not use it for advertising and do not use it to develop or train general AI or machine-learning models;
- our staff cannot read it unless you expressly agreed, it is necessary for security (for example investigating abuse) or the law requires it;
- OAuth tokens are stored encrypted (AES-256-GCM); on disconnect we delete tokens and cache within 30 days;
- you can revoke access at any time in Auro AI or at myaccount.google.com/permissions.
Mail synchronised from Gmail is stored in our customer’s Auro account, is that customer’s data, and we handle it as processor.
12. Security
We apply technical and organisational measures under GDPR Art. 32 (encrypted transmission, encrypted storage of selected sensitive fields, role-based access, logging, backups); they are described in Annex II of the DPA.
13. Changes
We may amend this notice when the service or the law changes. We tell our customers of material changes by e-mail; the "Effective" date at the top always refers to the current version.