Privacy Policy

This policy explains what MB Tilfortis, a small partnership registered in Kaunas, Lithuania (“Oaura”, “we”, “us”) does with personal data. It covers this website, oaura.ai, the Oaura dashboard at oaura.app, our API, and the embeddable chat widget our customers install on their own sites.

Four groups of people show up in this policy, and the rules differ for each:

• —Visitors — anyone browsing oaura.ai.
• —Prospects — people who contact us, book a demo or email sales.
• —Customers — people with an Oaura account, and the colleagues they invite into a workspace.
• —End Users — people who talk to an agent one of our customers built. We handle their data on that customer’s instructions, not our own; section 2 explains why that matters.

Our terms of service govern the commercial relationship, the security page describes our technical measures and current compliance status, and our data processing addendum covers clause 2.2 processing in contractual form. Ask for the addendum at legal@oaura.ai.

For our website, our marketing, our sales conversations, our billing and our customers’ account administration, we decide why and how personal data is used. We are the controller, this policy is the notice we owe you, and sections 3, 4, 7 and 12 apply directly.

For the content a customer ingests into a knowledge base, the conversations their agents hold with End Users, and the records in their agent databases, the customer decides. They are the controller; we process on their documented instructions under our data processing addendum. Section 5 covers this.

If you spoke to an agent on somebody else’s website and want your data corrected or deleted, ask that organization — they control it and they can act on it directly in their dashboard. If you cannot reach them, write to privacy@oaura.ai and we will pass the request on; we are not permitted to act on their data without their instruction.

Pages viewed, referring site, approximate location derived from IP, browser and device type. Section 7 names the specific tools and is honest about which of them set cookies.

Our contact form asks for your name, work email, company, which plan interests you, and your message. Booking a demo sends you to Calendly, which collects what it needs to put the meeting in a calendar. Emailing hello@oaura.ai gives us whatever is in the email.

• —Account and identity: name, email address, company, workspace role, and authentication records handled by Clerk.
• —Billing: plan, billing period, invoice history, VAT identification number, and the country we charge tax in. Card details go to Stripe and we never see or store them.
• —Operational telemetry: API request metadata, conversation counts, error and latency records, feature usage, and audit events on plans that include them.
• —Support: the correspondence you send us and the notes we take on it.

Do not send us special category data under Article 9 of the GDPR — health, biometrics, political or religious views, trade union membership, sexual orientation — or data subject to HIPAA, unless we have agreed to it in writing. We do not yet offer a HIPAA business associate agreement. Clause 5.3 of our terms says the same.

Almost all of it comes from you — a form you filled in, an account you created, an email you sent. The rest the Service produces as you use it: request logs, usage counters, error and latency records. Two things reach us second-hand: Clerk passes on what your identity provider asserts when you sign in through SSO, and Stripe tells us the billing country and tax status it worked out for your payment. We do not buy contact lists, we do not pay an enrichment or data-broker service to fill in your job title, headcount or revenue, and we do not scrape social profiles. If we hold a prospect record about you, it is because you or a colleague contacted us.

Creating your account, authenticating you, operating your agents, applying your plan limits and providing support. Without this data there is no service to give you.

Taking payment, issuing invoices, and keeping the accounting and tax records Lithuanian law requires us to keep.

Monitoring availability, investigating errors, preventing abuse and fraud, enforcing clause 5 of our terms, and improving the product from aggregate usage patterns. Our interest is running a reliable platform; we have weighed it against your interests and use the least data that achieves it.

Replying when you contact us, and sending product and service announcements to customers. Marketing email to people who are not customers goes out only with consent, and every message carries an unsubscribe link that works.

Establishing, exercising or defending legal claims, and responding to lawful requests from authorities.

We do not sell personal data. We do not share it for cross-context behavioral advertising. We do not use Customer Data to train, fine-tune or evaluate any model, ours or anyone else’s — see section 6.

Documents and content ingested into knowledge bases, conversation history between your agents and your End Users, records your agents read or write in connected systems, and the configuration of the agents themselves.

As your data, processed on your instructions, for as long as you keep it. We do not mine it, sell it, or look at it except where you ask us to for support, where we must to investigate abuse or a security incident, or where the law compels us.

We do not review ingested content before an agent uses it. Having a lawful basis for the personal data you ingest, and giving your own End Users the notices they are owed, is your responsibility as the controller.

We compile de-identified, aggregated figures — request volumes, error rates, feature adoption — to operate and improve the Service. They never identify you, your End Users or any individual, and we do not publish anything that could.

When an agent answers, it sends its instructions, the retrieved knowledge and the conversation so far to a language model provider. That provider receives whatever is in that payload, including any personal data it contains.

The widget accepts voice input, so audio an End User speaks is sent to a speech-to-text model and comes back as text. The transcript then joins the conversation history and is Customer Data under section 5, with the same treatment as anything else typed into a conversation. Recorded speech is personal data in its own right and some markets attach their own notice requirements to it, so if you switch voice input on, say so in the notice you give your End Users.

On every plan you can bring your own provider key. Calls made with your key run under your agreement with that provider, and their privacy terms govern what they do with the prompt — including whether they retain it and for how long. We are not a party to that agreement. Read it before routing personal data through a provider, and choose one whose retention and region match your obligations.

We do not use Customer Data, prompts or model output to train, fine-tune or evaluate any model. We do not supply your data to a provider for that purpose either. We cannot promise what a provider does under your own agreement with them — only what we do.

Keys you supply are encrypted at rest with envelope encryption, scoped to a single agent, and kept out of logs. See the security page.

We do not make decisions about you with legal or similarly significant effects by automated means. If you build an agent that does, Article 22 of the GDPR applies to you as the controller, and clause 5.3 of our terms tells you not to.

• —Google Tag Manager — container GTM-NR4PVLZM, which loads on every page and can load further tags. Depending on the tags configured in it, this may set cookies and may send your IP address and page views to Google.
• —Plausible Analytics — page views and referrers, measured without cookies and without tracking you across sites. Data is held in the EU.
• —The Oaura widget — the real product, embedded on our own site. If you open it and type, your messages are processed by our platform exactly as described in section 5, with Oaura as the controller for that conversation.
• —Strictly necessary storage — local storage for your theme choice and similar interface preferences. It stays in your browser.

We do not currently show a cookie consent banner, which means tags loaded through Google Tag Manager run before you have had a chance to refuse them. That is a gap we are closing, and we would rather write it down here than describe a consent flow that does not exist yet. In the meantime you can block these scripts with any content blocker, or with your browser’s own controls, and the site will work normally. If you want your analytics records removed, write to privacy@oaura.ai.

Browsers send a Do Not Track signal inconsistently and there is no agreed standard for honoring it, so we do not claim to. Plausible does not track you across sites regardless.

Professional advisers under confidentiality; authorities where the law requires it, and then only what is required; and a buyer or successor if the business is sold, in which case we will tell you before your data moves and this policy continues to apply until it is replaced.

Customers can ask to be notified before we add or replace a sub-processor, and to object, under our data processing addendum.

On Business and Enterprise you choose a hosting region, US or EU. On Enterprise, agent data can be isolated to a dedicated database in the region you pick, or to your own infrastructure.

Some of our sub-processors are established outside the European Economic Area, and a model provider you choose may be too. Where we transfer personal data out of the EEA we rely on the European Commission’s standard contractual clauses, or on an adequacy decision where one covers the recipient, together with the additional measures the transfer requires. Ask at privacy@oaura.ai for the mechanism applying to a specific recipient.

For as long as you keep it. Conversation history is held for the window your plan provides and then ages out. After your account closes, clause 11.5 of our terms applies: 30 days to export, then deletion from live systems, after which it ages out of encrypted backups on our normal backup cycle.

Billing and accounting records are kept for the period Lithuanian tax and accounting law requires, which outlasts your account. Account identity data is deleted with the account, except what those records need.

Support correspondence is kept while it is useful for support history and then deleted. Security and audit logs are kept for as long as they are useful for investigating incidents. Prospect data where nothing came of it is deleted when it is clearly stale. Aggregate statistics under clause 5.4 are not personal data and are kept indefinitely.

Encryption in transit and at rest, row-level scoping between tenants, envelope-encrypted credential storage, least-privilege access for our own staff, and per-agent budget caps, rate limits and prompt-injection guards. The current detail lives on the security page, including which certifications we hold and which we are still working toward — we do not claim ones we have not earned.

If a personal data breach occurs we will notify the Lithuanian supervisory authority within 72 hours where the GDPR requires it, notify affected customers without undue delay so that they can meet their own obligations, and tell affected individuals directly where the risk to them is high.

Send it to security@oaura.ai. We will not pursue researchers who report in good faith and give us reasonable time to fix the issue.

• —Access — a copy of the personal data we hold about you.
• —Rectification — correction of anything inaccurate or incomplete.
• —Erasure — deletion, where we have no overriding reason to keep it.
• —Restriction — a pause on processing while a dispute is resolved.
• —Portability — the data you gave us, in a machine-readable format.
• —Objection — to processing based on legitimate interests, including profiling, and to direct marketing at any time with no reason needed.
• —Withdrawal of consent — at any time, without affecting what was lawful before you withdrew it.

Account holders can export, correct and delete most data directly from the dashboard — that is the fastest route. For anything else, email privacy@oaura.ai. We respond within one business week and complete within one month, extendable by two further months for a complex request, in which case we will tell you why. Exercising these rights is free unless a request is manifestly unfounded or excessive. We may need to verify your identity before acting.

The personal information we handle as a business — the data in section 3, collected for the purposes in section 4, where we are the one deciding. It does not cover what a customer puts into Oaura. There we act as a service provider on that customer’s instructions, we are contractually barred from using the information for our own purposes, and requests about it go to the customer under clause 2.3. Information the CCPA exempts, such as records governed by other federal privacy statutes, is out of scope too.

• —Know — what we collected about you over the past 12 months, where it came from, why we collected it, and which categories of third party received it.
• —Access — a copy of that information.
• —Correct — a fix for anything inaccurate.
• —Delete — removal, except where the statute lets us keep something, for instance the tax and accounting records in clause 10.2.
• —Limit the use of sensitive personal information — see clause 13.5. We collect none, so there is nothing to limit.
• —Opt out of sale or sharing — see clause 13.4. We do neither, so there is nothing to opt out of.
• —Non-discrimination — no worse price, plan, or level of service because you exercised any of these.

Sorted into the statute’s categories, for the preceding 12 months. All of it comes from the sources in clause 3.5, is used for the purposes in section 4, and is disclosed for a business purpose to the service providers named in section 8 and to the advisers and authorities in clause 8.1.

• —Identifiers — name, work email address, company name, account and workspace identifiers, IP address.
• —Commercial information — your plan, billing period, and invoice and payment history. Card numbers go to Stripe and never reach us.
• —Internet or other electronic network activity — pages viewed on oaura.ai, referring site, API request metadata, feature usage, error and latency records.
• —Geolocation data — the approximate city or country we derive from your IP address. Nothing precise.
• —Professional or employment information — your company, your role in a workspace, and whatever you chose to tell us about your team when you got in touch.
• —Inferences — none worth the name. We do not build a profile of you; the aggregate figures in clause 5.4 are not about an identified person.

We collect nothing from the remaining statutory categories: no biometric information, no education records, and no audio or visual recordings for our own purposes — the voice input in clause 6.2 is Customer Data, which clause 13.1 puts outside this section.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as the CCPA defines those terms. We have not done so in the preceding 12 months. There is therefore nothing for a “Do Not Sell or Share My Personal Information” link to turn off, and a Global Privacy Control signal from your browser has nothing to switch off here either.

We do not collect it, ask for it, or want it — clause 3.4 asks you not to send it. We do not use or disclose personal information to infer characteristics about you, and we do not use it for any purpose beyond the ones section 4 lists.

Email privacy@oaura.ai. We confirm receipt within 10 business days and answer within 45 calendar days, extendable once by a further 45 where the request is genuinely complex, in which case we tell you before the first 45 are up. To verify who you are we match what you send us against the account and may ask you to confirm from the account email address, or to supply a detail only the account holder would know; we will not ask you for a government identity document. An authorized agent may act for you with your written, signed permission, and we may still ask you to confirm the authorization directly. Requests are free, and we only decline where the statute permits it.

Oaura is a business product and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, write to privacy@oaura.ai and we will delete it. If you deploy an agent that children will use, that is your responsibility as controller, and the law in your market may require more of you than it requires of us.

We update this policy as the product changes. The effective date at the top always reflects the current version. For changes that materially affect how we use personal data, we will email account administrators at least 30 days before they take effect. Minor corrections take effect when posted.