Aura

Privacy policy

Last updated: 13 November 2026

Aura brings contacts, campaigns, call-backs, appointments and clients together in one app, and gives the people who use it an assistant that writes on WhatsApp. This page explains what data we process, why, who we share it with and how you can ask for its deletion. The Italian version is the reference text.

At a glance

  • We use data only to run Aura for your business. We do not sell it and we do not use it for advertising.
  • Messages with the assistant on WhatsApp are kept for 12 months, then deleted.
  • When something costs money or writes to someone else, the assistant proposes it and does it only after you confirm.
  • You can ask to see or delete your data at any time: here is how.

Who the controller is

AURA AI L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates, Meydan Free Zone trade licence no. 2644909.01. For any question or request about your data, write to info@aurabeauty.app.

The controller is established outside the European Union. Since we offer Aura to businesses and people in the Union, we apply the EU General Data Protection Regulation (GDPR).

Who this policy is for

  • People who use Aura: owners and staff of our client businesses, in the app and in conversations with the assistant on WhatsApp. For this data the controller is AURA AI L.L.C-FZ.
  • The businesses' clients and contacts: the data a business manages in Aura (appointments, client cards, requests from campaigns) belongs to the business, which is its controller. AURA AI L.L.C-FZ processes it on the business's behalf, as a processor (Article 28 GDPR), only to run Aura. To exercise your rights you can contact the business or us: we forward the request to the business and help it answer you.

What data we process

  • Account: first and last name, email, phone number, role in the business, app login data.
  • Conversations with the assistant on WhatsApp: WhatsApp number and profile name, texts, voice notes and their transcription, images, reactions, date, time and delivery status of messages.
  • Business data: appointments, client cards, requests from campaigns, call outcomes, campaign data and results.
  • Technical data: security and error logs, which contain no message text and show phone numbers only in part.

Aura is not meant for health data or other special categories of data: please do not enter them in the app or send them to the assistant.

Where it comes from

  • From you, when you use the app or write to the assistant.
  • From your business, which enters the data of its clients and activities.
  • From Meta: WhatsApp messages, through the WhatsApp Business Platform, and requests from the business's Facebook and Instagram lead forms, when the business connects them to Aura.
  • From Aura's own services, for example the calendar and the calls made from the app.

We use the data received from Meta only for the purposes described here: we do not sell it or use it for other advertising.

Why we use it, and on what basis

  • To provide Aura to your business: the app, the assistant, the replies and the notices you switched on. Legal basis: the contract with the business and the steps that follow from it (Article 6(1)(b) GDPR).
  • For the security of the service, to prevent abuse and to fix errors. Legal basis: our legitimate interest in offering a safe, working service (Article 6(1)(f)).
  • To meet legal obligations, for example on invoicing (Article 6(1)(c)).
  • To process the data of the businesses' clients, only on the business's instructions and on its behalf (Article 28).

The assistant and artificial intelligence

  • The assistant's replies are written by an artificial intelligence model, Claude by Anthropic. Voice notes are transcribed with an OpenAI service. We send these providers only what is needed to reply.
  • Under their commercial terms, Anthropic and OpenAI do not use the data they receive through their services to train their models.
  • The assistant takes no decision with legal effects on you. When an action costs money or writes to someone else, the assistant proposes it and the system carries it out only after you confirm.
  • If you ask for public information, for example about a holiday or a topic in your sector, the assistant may search the web through Anthropic's service.
  • The assistant answers only about Aura and your business: it is not a general-purpose assistant.

Who we share it with

  • With your business: its people see the data their role allows.
  • With the providers that help us run Aura, appointed as processors:
    • servers and databases hosted in the European Union;
    • Meta Platforms, to send and receive WhatsApp messages through the WhatsApp Business Platform;
    • Anthropic, for the model that writes the assistant's replies;
    • OpenAI, to transcribe voice notes;
    • error-monitoring services, which never receive message text;
    • email and customer-management services.
  • With authorities, only when the law requires it.

We do not sell your data and we do not pass it to third parties for marketing.

Transfers outside the European Union

The controller is established in the United Arab Emirates and some providers (Meta, Anthropic, OpenAI) are established in the United States. Every transfer of data outside the Union is covered by the safeguards of Articles 44–49 GDPR: an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework for certified companies, or the standard contractual clauses approved by the Commission.

How long we keep it

  • Messages with the assistant on WhatsApp: 12 months, then deleted.
  • Account and business data: for as long as the service lasts. When the business stops using Aura, we delete the data or return it to the business, except what the law requires us to keep, such as invoicing data.
  • Technical logs: for as long as the security of the service requires, at most 12 months.

How we protect it

Data travels encrypted. Credentials for external services are stored encrypted. Each business's data is kept apart from every other business's, down to the database. Technical logs contain no message text. The assistant's important actions (proposals, confirmations and outcomes) are kept in a log that cannot be altered.

Your rights

You can ask at any time to access, correct or delete your data, restrict its use, object to its processing or receive it in a readable format (Articles 15–22 GDPR). You can also lodge a complaint with the supervisory authority of the country where you live or work; in Italy it is the Garante per la protezione dei dati personali (garanteprivacy.it).

How to ask for your data to be deleted

  1. Write to info@aurabeauty.app stating the phone number or email you use with Aura, or the WhatsApp number you use to write to the assistant.
  2. If you are a client of a business that uses Aura, you can write to the business or to us: in that case we forward the request to the business, which is the controller of your data.
  3. We delete the data within 30 days of the request and confirm it to you by email or on WhatsApp.

Deletion covers the data we keep. Messages stay on your phone until you delete them from WhatsApp yourself.

Cookies

These pages use no cookies or analytics tools and load nothing from other sites. If you pick the light or dark theme, the choice is stored only in your browser and never sent to us.

Changes to this policy

If we change the way we process data, we update this page and the date at the top. If the change is significant, we tell our client businesses before it takes effect.