Privacy Policy

1. What data we collect

From your account: name, email, password (stored hashed, never in plain text), contact phone, address, and company tax ID (when provided).

From the agent's configuration: information about your business that you register (type, description, hours, products, payment methods, FAQs, exchange policy, escalation contact).

From conversations: messages exchanged between the agent (or you) and the end customers on your WhatsApp/Instagram/Telegram channels — including audio transcripts when a customer sends a voice note.

Channel credentials: your WhatsApp/Instagram/Telegram access token is encrypted (AES-256) — it's never stored or shown in plain text on any screen.

Instagram: when you connect a professional Instagram account, we receive the account's ID and username and the direct messages its customers send, only so the agent can reply. Login happens on Instagram's official page — we never see or store your password. We don't publish content or read messages from accounts you haven't connected.

From your Google Calendar (optional): if you connect this integration, we access your availability (via the calendar.readonly permission) and create meeting events on your behalf (via the calendar.events permission) — only when the agent confirms a booking with an end customer. We don't read or change any other data in your Google Account beyond that.

2. How we use this data

To operate the service: generate the agent's replies, keep the conversation history, calculate your dashboard metrics, check availability and create events on your Google Calendar when you connect that integration, and let you and your team follow and take over conversations when needed.

3. Who we share data with

We share data only with the providers needed to make the service work:

• Anthropic (Claude) — receives the conversation text (and images/documents, when sent) to generate the agent's reply.
• OpenAI — receives voice-note audio solely to transcribe it to text (Claude doesn't process audio directly yet).
• Meta (WhatsApp Business Platform / Instagram Messaging) — the platform used to deliver and receive the messages themselves.
• Google (Google Calendar API) — used only if you connect the calendar integration, to check availability and create meeting events.
• Asaas — the payment institution responsible for processing your subscription billing.
• Render and Vercel — hosting providers where the application and database run.
• Resend — used to send transactional emails (password recovery, team invites, account notices).

We don't sell customer data to third parties.

4. Use of Google data

AuraLink's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from your Google Calendar is never used for advertising, is never sold, and is only accessed by AuraLink's own automated systems — no person reads this data manually, except when strictly necessary for technical support with your explicit authorization. You can revoke access at any time at myaccount.google.com/permissions or by disconnecting the integration in your dashboard.

5. Use of Meta data (WhatsApp and Instagram)

AuraLink is a Meta Tech Provider — we use the WhatsApp Business Platform and the Instagram Messaging API to send and receive messages on behalf of the businesses that connect their own numbers/accounts to our platform. Our use and transfer of this information follows the Meta Platform Terms. Message content is processed by automated systems (AuraLink's own AI and the AI providers listed in section 3) to generate the agent's replies — it's never used for advertising, never sold, and a person only reads these messages when a human agent from the business itself takes over the conversation, or during technical support with explicit authorization. The business that connected the channel can disconnect it at any time from the dashboard, immediately revoking that access.

6. Security

Channel credentials are encrypted at rest. WhatsApp is validated automatically as soon as the channel connects; Instagram goes through a check by our team before any real customer is served.

7. Retention

We keep your account and conversation data for as long as your account is active. When you close your account, you can request deletion of your data through the contact below — data is removed within 30 days of the request being confirmed, except what we're legally required to keep (e.g., tax records).

To delete data linked to Instagram or WhatsApp, see the data deletion instructions.

8. Your rights

As a data subject, you can request access, correction, deletion, portability, or withdraw consent regarding the data we process, by contacting the email below. This applies both to your account data and, to the extent technically possible, to data from end customers who talked to your agent — in that second case, you, as the business responsible for that service, are the one who first collects the end customer's consent.

9. Data protection contact

AuraLink's data protection contact: suporte@auralinkapp.com.

10. Contact

Questions about this Policy or requests related to your data: suporte@auralinkapp.com.

11. Changes to this Policy

We may update this Policy. Material changes will be communicated by email or within the dashboard itself.