Privacy Policy

At Auteryn, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI agent platform.

Important: Your data is never used to train AI models. All interactions are private to your organization.

1. Information We Collect

We collect information you provide directly to us, such as when you create an account, subscribe to our waitlist, or contact us for support:

• Name and email address
• Account credentials
• Payment information (processed securely by Stripe)
• Usage data and analytics
• Communications you send to us

Agent & Platform Data

When you use Auteryn, we also process:

• Knowledge Data: Documents and files you upload for agents to reference
• Agent Interaction Logs: Task histories, conversation logs, and execution records
• Connector Credentials: OAuth tokens and API keys for integrations (stored encrypted; revoked when you disconnect the integration)
• Desktop Session Data: Screenshots and recordings from Computer Use sessions (deleted after task completion unless you save them)

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send technical notices, updates, and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze trends, usage, and activities
• Detect, prevent, and address technical issues or fraud

4. Data Sharing & Third Parties

We do not sell your personal data. We may share information with these categories of third parties:

• Cloud Infrastructure: Amazon Web Services (AWS) and Google Cloud Platform for hosting, storage, and sandbox compute
• AI Model Providers: Google (Gemini API) and AWS Bedrock (Anthropic Claude), depending on the model you select per agent
• Voice & Telephony: LiveKit carries the real-time audio for every voice session, browser and phone, and passes it to Google for speech-to-text. Where the agent uses a preset voice, Google provides the voice synthesis, or Gemini Live runs the call. Twilio carries SMS and inbound phone calls (where you enable these features)
• Voice cloning: When you clone a voice from a recording, we send Google the recording and a short spoken consent line. Google creates the voice, stores it in our Google Cloud project, and provides the voice synthesis for it. We do not store either recording. Voices created earlier with Cartesia stay with Cartesia, which provides their voice synthesis. Only agents in your organization can use the voice. Google processes the recordings under its paid Gemini API terms, which say it does not use prompts, files or responses to improve its products, and that it logs prompts and responses for a limited time only to detect abuse and meet legal disclosure requirements.
• Search: Serper.dev receives the search terms an agent derives from your request when it uses web search, and Pexels receives the search terms when an agent looks for stock photos
• Authentication: Google Firebase for sign-in
• Payment Processing: Stripe for secure payment handling
• Error Monitoring: Sentry receives error and performance telemetry, which can include your organization and user identifiers and fragments of the activity log leading up to a fault
• Analytics: Google Analytics on the marketing site. Analytics cookies are set only after you accept via the cookie banner; before that, Google Consent Mode limits us to anonymous, cookieless measurement
• Connectors: Third-party services you explicitly authorize (e.g., GitHub, Slack, Google Workspace)

Google Workspace Data — Limited Use

When you connect a Google account, Auteryn requests only the scopes needed for the features you enable, and you can revoke that access at any time from your Google Account or from the Integrations page in Auteryn. Auteryn’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the features you explicitly asked the agent to perform
• We do not transfer Google user data to third parties except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger or acquisition
• We do not use Google user data for advertising, and we do not sell it
• We do not allow humans to read Google user data unless you give explicit consent for specific messages, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymized
• Google user data is never used to train the AI models we or our model providers operate

All third-party processors are bound by data processing agreements and are required to protect your data in accordance with applicable laws.

5. Data Security

We implement robust technical and organizational measures to protect your data:

• Encryption at Rest: Connection credentials and OAuth tokens are encrypted with AES-256-GCM before they are stored
• Encryption in Transit: TLS for all data transmission
• Access Control: Role-based access control — owner, admin, member, customer, and guest roles gate what each account can do
• Audit Logging: Many changes to agents, connections and member roles are recorded in an audit log
• Temporary Tokens: Agent connector credentials are short-lived and scoped; revoking the connection stops access

6. Data Retention

We keep personal data only as long as we need it. This section covers closing an organization, deleting your own account, what we keep afterwards, and how long copies of deleted data can remain.

Closing an organization

The owner closes an organization from Settings. It stops at once. Everyone is signed out. Loops, Channels, the website chat widget and Knowledge syncs stop. API keys stop working, running computers stop, and public share links and published decks go offline. Connections are removed and their credentials are deleted. Google access is revoked at Google. For other providers, the grant stays with the provider until you remove it there.

For 30 days the owner can reopen the organization by signing in and choosing Reopen organization. On day 30 we delete its content: conversations, files, Library documents, Knowledge, memory, Agents, Skills, Loops, voices and snapshots. We also delete people’s names, emails and sign-ins. After that the organization cannot be reopened.

A formal erasure request skips the 30 days. We delete the organization’s data without waiting, and it cannot be reopened. To make a request, email privacy@auteryn.ai.

Deleting your own account

Any person can delete their own account from Account settings. A member or admin is deleted at once: their sign-in, name and email. The work they did in the organization stays with the organization. An owner who is the only person in the organization closes it by deleting their account, with the same 30 days. An owner with other people in the organization must first make someone else the owner.

What we keep

We keep invoices and the billing ledger, as tax law requires, and audit records. Stripe, our payment processor, holds the invoices. The billing ledger and the audit records have no name, email or IP address attached.

How long copies of deleted data can remain

Deleted data does not leave every system on the same day:

• A deleted record can remain in a database backup for up to 7 days.
• A deleted file can remain in cloud storage for up to 7 days.
• Service logs are kept for up to 90 days.
• Error reports are kept for as long as our error-tracking provider, Sentry, retains them.

Other data

• Agent Logs: Retained for a limited, plan-based period for audit purposes, then deleted
• Knowledge: Deleted upon your request or when the organization’s content is deleted
• Desktop Sessions: Deleted after task completion unless you explicitly save them

7. Your Rights

Depending on your location, you have the following rights regarding your personal data:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data ("right to be forgotten"). Any person can delete their own account from Account settings. An owner can close the organization from Settings, and its content is deleted after 30 days (section 6). A formal erasure request by email skips the 30 days.
• Portability: Receive your data in a portable format. An owner can export the organization’s data from Settings, as a zip file built in the background. We keep the file for 7 days.
• Opt-out: Unsubscribe from marketing communications
• Restriction: Request limitation of processing in certain circumstances

To exercise these rights, contact us at privacy@auteryn.ai. We respond to verified requests within 30 days, or sooner where local law requires.

8. International Users

Company Location

Auteryn Inc. is a Delaware C Corporation. Your personal data is primarily stored and processed in the United States on AWS and Google Cloud infrastructure. Enterprise plans can be deployed to a dedicated cloud account, which supports regional data-residency requirements.

United States (state privacy laws)

Residents of California (CCPA/CPRA) and other US states with comprehensive privacy laws have the rights to know, access, correct, delete, and opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined in those laws, so there is nothing to opt out of; we honor Global Privacy Control signals consistent with that position. We will not discriminate against you for exercising your rights.

Canada (PIPEDA)

For users in Canada, we handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA): we collect it with consent, use it only for the purposes described in this policy, and provide access and correction on request. Our commercial electronic messages comply with CASL — marketing email is sent only with consent and always includes a working unsubscribe.

India (DPDP Act)

For users in India, we process digital personal data in accordance with the Digital Personal Data Protection Act, 2023. You have the rights to access, correction, and erasure of your personal data, and to grievance redressal. Our grievance channel is privacy@auteryn.ai — we acknowledge grievances promptly and resolve them within the timelines the Act prescribes. If you are not satisfied with our response, you may approach the Data Protection Board of India.

Singapore (PDPA)

For users in Singapore, we handle personal data in accordance with the Personal Data Protection Act 2012: we collect, use, and disclose personal data with consent and for reasonable purposes, and we provide access and correction on request. Questions for our designated Data Protection Officer can be sent to privacy@auteryn.ai.

European Union & United Kingdom (GDPR / UK GDPR)

If you are in the European Economic Area or the United Kingdom, we process your data under the GDPR and UK GDPR respectively. Auteryn Inc. acts as the data controller for account data and as a processor for the content your organization brings to the platform. Our legal bases include contract performance, legitimate interests, and your consent where required. You may lodge a complaint with your local supervisory authority.

Data Transfers

Auteryn Inc. is based in the United States. If you access our services from outside the United States, your data will be transferred to and processed in the United States, where data protection laws may differ from those in your country. We ensure appropriate safeguards are in place for international transfers, including Standard Contractual Clauses where applicable.

9. Cookies & Tracking

We use essential cookies to operate our service and optional analytics cookies to understand how you use our platform. For detailed information, see our Cookie Policy.

10. Children's Privacy

Auteryn is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through a prominent notice on our website. Your continued use of Auteryn after changes indicates acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: privacy@auteryn.ai
• General Inquiries: contact@auteryn.ai
• Mailing Address:
  Auteryn Inc.
  c/o Legalinc Corporate Services Inc.
  131 Continental Dr, Suite 305
  Newark, DE 19713, USA