Privacy Policy

Account Information

When you create an account, we collect your name and email address. Authentication is handled via magic link or Google SSO. We do not store passwords.

Payment Information

When you subscribe to a paid plan, we collect billing information including your name, billing address, and payment card details. Payment processing is handled by Stripe. We do not store full card numbers on our servers.

Connector Credentials

To connect third-party tools (such as HubSpot, Google Workspace, ClickUp, Shopify, Slack, and others), we store OAuth tokens on your behalf. These tokens are encrypted at rest using AES-256 encryption with managed encryption keys and used only to perform actions you authorize through the Service. Tokens are deleted immediately when you disconnect a connector.

Connector Context

When you connect a tool, Arora stores two kinds of connector context, scoped to your account and used only to make your AI interactions accurate. Your settings for that tool, such as defaults and preferences you choose, are kept if you disconnect, so the tool works as before when you reconnect, and are deleted when you delete your account. Details about the connected account, such as its email address, username, workspace IDs, and portal IDs (including ones you type in when connecting), are deleted when you disconnect the tool or the connection ends, and are refreshed when you reconnect. Execution logs can hold a copy of this context and are purged within 90 days.

Document Content (Transient Processing)

When you, or your AI assistant at your direction, ask Arora to read a document (for example, a PDF attached to an email in your connected mailbox, stored in your connected drive, hosted at a link you provide, or uploaded by you directly), Arora fetches that document using your own connected-account credentials and extracts its text in memory to answer your request.

Extracted document text is held only in a private, per-customer working area for the duration of active use and is automatically discarded after 30 minutes of inactivity. It is never written to our database, never used for any purpose other than answering your request, and never used to train any model. Document content never appears in our operational logs: logs record only metadata such as page counts, byte counts, and website hostnames, never document text, full file links, or your credentials.

Reading a document does not send its content to any additional service provider: content flows from the source you connected into Arora's existing infrastructure and back to you, and text extraction runs inside Arora itself. Arora does not run a server-side OCR engine. If you ask to view pages as images, Arora renders the selected pages to image files so your assistant can read them visually. Rendered page images are held in private, access-controlled temporary storage for approximately one day: access expires within 24 hours, and the files themselves are automatically deleted by a daily storage lifecycle (within roughly 24 to 48 hours of creation). Rendered images are never made public, and the source document is never modified.

Usage and Compute Data

We collect data about your use of the Service for billing purposes, including the number and type of tool calls made through Arora connectors and token usage associated with AI model interactions.

Memory and Context Data

Arora stores memories, preferences, and context generated during your use of the Service. Memory content is encrypted at rest with keys managed in a cloud key-management service, and the service decrypts it only to serve it back into your own sessions. It is used to improve the continuity and accuracy of your experience across sessions and is never used for any other purpose. When you delete a memory, it can be restored for 90 days, then it is permanently deleted.

Execution Logs

We maintain logs of which tools were called, whether they succeeded or failed, and which governance rules fired. Before persistence, all logs go through two layers of redaction: credential redaction (API keys, tokens, and secrets are replaced with [REDACTED]) and content field stripping (email bodies, message text, task descriptions, document content, and CRM record details are stripped before database write). Logs are kept for 90 days for debugging and history, then deleted automatically.

Migration and Audit Content (Envelope-Encrypted)

Paid plans with team access include full sensitive-action audit logging: an audit record of governed actions, including the request and response content, so your team can review exactly what was done on your behalf. On free accounts, request and response content is simply not stored.

This content is protected with per-organization envelope encryption. Each record is sealed with a one-time key that is itself locked by an encryption key dedicated to your organization in a cloud key-management service. Arora's own servers cannot read this content at rest: the service holds permission to seal records, and it is structurally denied permission to unseal them. Captured content can only be decrypted inside a live, signed-in session of a member of your organization, and one organization can never decrypt another organization's records.

Deleting this data is cryptographic. When your organization's key is destroyed, every record sealed under it becomes permanently unreadable, after a 90-day recovery window that protects against accidental deletion.