Aurora
IT Log in Try it free

Privacy policy

Last updated: 6 November 2026Umanize S.r.l. · VAT IT04563040718[email protected]

This privacy policy describes how Umanize S.r.l. processes personal data when acting as data controller in relation to the website aurorasuite.ai, the application app.aurorasuite.ai, and related Aurora Suite AI services. Aurora Suite AI is a service provided by Umanize S.r.l.

Where Umanize processes personal data on behalf of its business customers in connection with the provision of the Service, Umanize acts as data processor instead, and such processing is governed by the applicable Data Processing Agreement ("DPA").

1. Data controller

Umanize S.r.l.

Registered office: Via Donato De Leonardis, 5 - 71121 Foggia (FG), Italy

VAT No.: 04563040718

Privacy email: [email protected]

2. Scope of this policy

This policy applies to processing activities carried out by Umanize as data controller, including in particular:

  • data relating to registered users and business customer contacts;
  • data of leads, demo requesters, and commercial contacts;
  • browsing data, logs, and technical data relating to use of the website and app;
  • data relating to integrations and consents directly provided to Umanize;
  • data required for security, abuse prevention, support, and administrative or legal compliance.

For personal data processed within campaigns, calls, transcripts, contact lists, CRMs, knowledge bases, and other content uploaded by business customers for their own purposes or on behalf of third parties, Umanize generally acts as data processor and the relevant DPA applies.

3. Categories of personal data processed

3.1 Data provided directly by the user or customer

  • first and last name;
  • business email address;
  • phone number;
  • company, role, and other professional information;
  • billing and administrative data;
  • identity documents, address and other data required by law for the assignment of phone numbers, forwarded to Telnyx;
  • content of support, commercial, or other requests sent to Umanize by form, email, or other channels.

3.2 Technical and usage data

  • IP address and network data;
  • application logs, security events, and access logs;
  • browser, device, and operating system information;
  • access timestamps, feature usage, and diagnostic data;
  • sign-in credentials (password stored only as a hash, passkeys, two-step verification settings);
  • sign-up source (utm_source parameter or referring site);
  • cookies and similar technologies, as described in this policy and in any applicable cookie preferences.

3.3 Data processed through specific integrations

Depending on the features enabled, Umanize may also process data from integrations, for example:

  • profile data used to sign in with Google or Microsoft (first and last name, email address and the account ID at the provider);
  • calendar and appointment data (Google Calendar, Outlook Calendar);
  • data from connected mailboxes (Gmail, Outlook or IMAP/SMTP mailboxes): address, sent messages and, if the user enables it, received messages;
  • conversations on connected messaging channels (WhatsApp, Instagram, Messenger, SMS, website chat);
  • contacts received from Meta Lead Ads and attribution data for advertising campaigns (click IDs such as gclid and fbclid);
  • contacts, deals, notes and orders read from or written to connected CRM and e-commerce systems (HubSpot, Pipedrive, Shopify, WooCommerce);
  • access tokens and integration credentials, stored encrypted;
  • information needed to send transactional emails, SMS or push notifications.

3.4 Call data and content processed on behalf of customers

Where Umanize processes audio, recordings, transcripts, call metadata, messages, emails or other content generated within the Service on behalf of a business customer, such processing is generally carried out by Umanize as data processor and is governed by the DPA.

3.5 Artificial intelligence agents

Aurora Suite AI uses artificial intelligence agents that, on behalf of the customer, make phone calls, answer messages and emails, book appointments and summarize conversations. To do so, the necessary content (voice, conversation text, contact information and the customer's knowledge base) is processed by voice and language model providers acting as subprocessors.

On behalf of the customer, Aurora Suite AI also keeps a memory of each contact (a summary and a few useful facts from the conversations, without special categories of data), fills in the contact's fields, assesses their interest and status (for example "qualified") and analyses the outcome and tone of conversations. These assessments help the customer organise its work and do not produce decisions with legal effects on people; the customer's staff can view, correct or delete them.

Umanize does not use customer data, or data received from Google, Microsoft or Meta, to train general artificial intelligence models. People who talk to an agent are informed that it is an automated system, according to the customer's settings and applicable law.

Purpose
Legal basis
Account creation, authentication, and contract management
Performance of a contract or pre-contractual measures
Billing, administration, and accounting or tax compliance
Legal obligation / performance of a contract
Technical support, customer care, and request handling
Performance of a contract / legitimate interest
Security, logging, abuse prevention, fraud prevention, and unlawful use prevention
Legitimate interest / legal obligation where applicable
Service improvement, technical analysis, and diagnostics
Legitimate interest
Demo management, commercial contacts, and pre-sales follow-up
Pre-contractual measures / legitimate interest
Service and onboarding communications (first-days emails, account notices) and segmentation of customers by plan and subscription status
Performance of a contract / legitimate interest
Optional marketing communications
Consent, where required
Management of Google, Microsoft, Meta or other provider integrations voluntarily enabled by the user
Performance of a contract / consent, where required
Statistics on visits to the aurorasuite.ai website and measurement of Aurora Suite AI's own advertising campaigns on the website
Consent
App usage statistics and measurement of Aurora Suite AI's own advertising campaigns in the app
For now the app turns these tools on without asking for consent (see section 11); a consent request in the app is being prepared

Where Umanize processes personal data on behalf of a business customer for purposes determined by that customer, the legal basis toward the relevant data subjects is determined by the customer acting as controller.

5. Role of Umanize in relation to customer data

Umanize acts as data controller for data necessary to manage its direct relationship with customers, prospects, admin users, website visitors, commercial contacts, support requests, security, billing, and compliance.

For personal data processed through Aurora Suite AI on behalf of a business customer, such as contact lists, phone numbers, transcripts, call audio, uploaded content, integration data, or information relating to the customer's interlocutors, Umanize generally acts as data processor under the relevant DPA.

6. Data recipients and vendors

Personal data may be processed by authorized Umanize personnel and by selected vendors acting as processors or subprocessors, where applicable, including by way of example:

  • DigitalOcean LLC

    Servers, database, file storage and backups, in the Frankfurt (EU) data center.

  • ElevenLabs Inc.

    Voice agents and website chat: speech synthesis and recognition, the conversations' language model (including third-party models made available by ElevenLabs), call recording and transcription, with EU data residency. Call recordings stay with ElevenLabs.

  • Microsoft Corporation (Azure OpenAI)

    Language models for agents on messages and email, conversation summaries and analysis, and contact memory.

  • Telnyx LLC

    VoIP, telecommunications, number management (including the documents required to assign numbers) and SMS delivery.

  • Twilio Inc.

    Sending and receiving WhatsApp messages.

  • Meta Platforms Ireland Ltd.

    WhatsApp Business, Instagram, Messenger, Lead Ads, advertising conversion measurement (Meta Pixel and Conversions API).

  • Google LLC / Google Ireland Ltd.

    Sign in with Google, Google Calendar, sending email from Gmail, conversion import into Google Ads, Google Analytics 4 on the aurorasuite.ai website, Google Fonts (loading the app's fonts: the browser sends the IP address to Google).

  • Microsoft Corporation

    Sign in with Microsoft, Outlook Calendar, sending and reading email from Outlook / Microsoft 365.

  • Brevo

    Transactional, service and campaign email, receipt of replies; management of Aurora Suite AI customers' contact records (account data, company, phone, plan, subscription status, relationship stage, sign-up source) for service communications and, with consent, the newsletter.

  • HubSpot Inc., Pipedrive OÜ, Shopify Inc.

    Synchronization of contacts, deals, notes and orders, only if the customer connects their own account.

  • Stripe Payments Europe Ltd.

    Payments, subscriptions, credit top-ups and invoicing. Card details are entered and stored only by Stripe.

  • PostHog Inc. (EU servers)

    Application usage statistics.

  • Functional Software Inc. (Sentry)

    Detection and diagnosis of technical errors, with the signed-in user's ID and email.

  • Cloudflare Inc.

    Protection against bots and abuse (Turnstile).

  • Browser push notification services

    Delivery of the push notifications the user chose to receive (for example Google, Apple, Mozilla).

  • Tools connected by the customer

    For example Zapier, Make, n8n, webhooks to the customer's systems, AI assistants connected via MCP: they receive the data the customer chooses to send; the customer is the controller or has its own contract with the provider.

  • European Commission (VIES)

    Check of the VAT number entered in the profile.

  • Cloud and infrastructure providers

    Hosting, databases, file storage, backups, monitoring and security.

  • Administrative service providers

    Accounting, electronic invoicing and administrative compliance.

The updated list of relevant processors or subprocessors may be requested by writing to [email protected].

7. Processing of Google, Microsoft, Meta and other integration data

Integrations are enabled only by the user or customer, who chooses which accounts to connect and which permissions to grant. For each one, Umanize processes only the data strictly necessary to provide the requested functionality. Access tokens and mailbox passwords are stored encrypted.

7.1 Google

  • Sign in with Google: first name, last name, email address and Google account ID, used only to create the account and sign the user in.
  • Google Calendar: Aurora Suite AI reads the list of calendars and, for the chosen calendar, the events from the last 90 days onward (title, description, times, attendees' email addresses), which it keeps as appointments in the app to show availability and the calendar; it creates, updates or deletes the events of appointments booked through Aurora Suite AI, for example by agents during a call or conversation.
  • Gmail: permission to send email on the user's behalf. Aurora Suite AI sends from the connected mailbox only the emails the user has written, approved or configured (replies, appointment confirmations, follow-ups, campaign emails). With this permission Aurora Suite AI does not read the messages in the mailbox; it keeps the text and outcome of the emails it sent so they can be shown in the app. Connecting Gmail mailboxes is not yet available in the app; once it is, it will work as described.

Data received from Google APIs is used only to provide and improve the user-facing features described above. It is not sold, not used for advertising, profiling or creditworthiness assessments, not transferred to third parties except to provide these features, for security purposes or to comply with the law, and not used to train general artificial intelligence models. Umanize staff may read it only with the user's explicit consent, for security purposes or to comply with the law.

Aurora Suite AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7.2 Microsoft

  • Sign in with Microsoft: first name, last name, email address and Microsoft account ID, used only to create the account and sign the user in.
  • Outlook Calendar: as for Google Calendar, Aurora Suite AI reads the events of the chosen calendar (from the last 90 days to 12 months ahead: subject, text preview, times, attendees), keeps them as appointments in the app and creates, updates or deletes the events of appointments booked through Aurora Suite AI.
  • Outlook / Microsoft 365: sending email on the user's behalf, as for Gmail. Only if the user enables reading, Aurora Suite AI also receives new messages that arrive after the connection, to show them in the Inbox and, if the customer chooses, have the agent answer them, automatically or after approval. Connecting Outlook mailboxes is not yet available in the app; once it is, it will work as described.

The same limits described for Google apply to data received from Microsoft.

7.3 Mailboxes connected with IMAP/SMTP

If the customer connects a mailbox with address, password and servers, Aurora Suite AI stores the credentials encrypted, reads the messages that arrive after the connection and sends email from the mailbox, for the same purposes and with the same limits described above. When the mailbox is disconnected, the credentials are deleted and reading stops.

7.4 Meta (WhatsApp, Instagram, Messenger, Lead Ads)

If the customer connects their WhatsApp Business account, a Facebook Page or an Instagram account, Aurora Suite AI receives and sends the messages of conversations with the customer's contacts, to show them in the Inbox and have agents handle them according to the customer's settings. These data are processed on behalf of the customer, who is the controller. To connect Instagram and Messenger, the Facebook user token is kept encrypted for no more than 15 minutes; after that only the Page token remains, encrypted.

If the customer connects a Facebook Page to receive Meta Lead Ads contacts, Umanize receives from Meta the Page ID and name, a Page access token stored encrypted and, for each submitted form, the answers given by the person, the submission date, the consents ticked on the form, the IDs and names of the campaign, ad set, ad and form, and the platform (Facebook or Instagram). To do so Aurora Suite AI asks Meta for the leads_retrieval, pages_show_list, pages_read_engagement, pages_manage_metadata, pages_manage_ads and ads_management permissions. The Facebook user token is used only to list the Pages while connecting and is not kept for more than 15 minutes. These data are processed on behalf of the customer, who is the controller, only to create or update the contact and start the automations the customer has enabled; they are not used for advertising, Umanize's own profiling or AI model training, and they are not sold or transferred to third parties.

When the Page is disconnected, Umanize stops receiving contacts, removes Aurora Suite AI's Lead Ads subscription from the Page (only the messaging one stays, if the customer uses the same Page for Instagram or Messenger) and deletes the token. Instructions to request deletion of data received from Meta are on the Data deletion page.

7.5 Measuring the customer's advertising conversions

If the customer enables it, Aurora Suite AI tells the customer's advertising platforms when a contact who came from an ad becomes qualified, books an appointment or completes a purchase. Meta (Conversions API) receives email, phone number, first and last name transformed with SHA-256 hashing (pseudonymised), a pseudonymous contact ID, the Lead Ads lead ID and the click ID (fbclid) and, if set, the conversion value; by default only contacts with a recorded consent are included. For Google Ads, the customer downloads, or has Google Ads download, a private list of conversions with the click ID (gclid). This processing is carried out on behalf of the customer, who is the controller.

7.6 CRM and e-commerce

If the customer connects HubSpot or Pipedrive, Aurora Suite AI looks up, creates and updates contacts, adds a note for each conversation with channel, outcome and summary and, if the customer enables it, creates deals when a goal is reached. If they connect Shopify or WooCommerce, it receives orders, carts and contact details of the store's customers (name, email, phone) for the automations the customer has enabled, for example abandoned cart recovery or messages after a purchase, and can show the agent's chat in the store.

The user may revoke permissions at any time by disconnecting the integration in Aurora Suite AI or through the settings of the relevant third-party account, provided that such revocation may prevent the relevant integration from functioning correctly. After disconnection Aurora Suite AI no longer uses the access granted; deletion of the data already received can be requested as described in section 12.

8. International data transfers

The main data of the service (database, files and backups) is stored in Frankfurt, in the European Union; ElevenLabs and PostHog process data on EU servers. Some vendors may involve transfers of personal data to countries outside the European Economic Area, in particular Telnyx, Twilio, Cloudflare, Google and Meta and, for support or security, the other US-based vendors.

Where this occurs, Umanize adopts appropriate safeguards under Articles 44 et seq. GDPR: an adequacy decision of the European Commission or Standard Contractual Clauses (SCCs), depending on the vendor, with appropriate supplementary technical and organizational measures.

Any data residency or EU hosting options primarily refer to the main location of the data and do not exclude access or processing from other jurisdictions for support, security, incident response, or vendor intervention, to the extent permitted by applicable law.

9. Data retention

Category
Indicative period
Account and customer identity data
For the duration of the contractual relationship and as needed for follow-up obligations
Administrative and tax data
As required by applicable law
Technical logs of webhook deliveries, CRM syncs and e-commerce events
30 days
Security and audit logs (administration actions, support access, API key use, with IP address and browser)
For as long as needed for the security of the service
Database backups
7 days
Lead and demo request data
For the time necessary to manage the contact and any related commercial follow-up, unless the data subject objects or withdraws consent where required
Data processed on behalf of business customers
As provided in the contract, the DPA and the customer's instructions. Defaults, which the customer can change from 1 to 120 months: call recordings 6 months; transcripts, summaries, message text (WhatsApp, email, Instagram, Messenger, website chat) and contact memory 24 months. After these periods only the outcome and topic of the conversation remain. SMS text, contacts and lead records are not covered by this automatic deletion and are kept for the duration of the relationship, unless deletion is requested
Access tokens and integration credentials
While the integration stays connected. On disconnection, Meta, HubSpot and Pipedrive tokens and IMAP/SMTP mailbox credentials are deleted; Google Calendar, Outlook Calendar, Gmail and Outlook mailbox tokens stay encrypted and unused until the account is closed or deletion is requested

10. Security

Umanize implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, disclosure, alteration, or destruction, including encryption, access controls, logging, logical segregation, monitoring, and incident response procedures.

However, no IT system or electronic transmission can be considered fully secure. Umanize therefore adopts reasonable and proportionate safeguards, without being able to guarantee absolute security.

11. Cookies and similar technologies

Umanize websites and services use cookies, local storage or similar technologies for technical, security, analytics and marketing purposes. In particular:

  • Technical and security (necessary): keep the user signed in, remember language and theme preferences and the website cookie choice, and protect against bots and abuse through Cloudflare Turnstile, which in the app is loaded on every page and used at sign-up, and on the website only on the Contact page.
  • aurorasuite.ai website, statistics (with consent): Google Analytics 4, provided by Google Ireland Limited, measures visits to the website in aggregate form.
  • aurorasuite.ai website, marketing (with consent): the Meta Pixel measures the effectiveness of Aurora Suite AI's own advertising campaigns, for example visits and sign-ups that came from an ad.
  • app.aurorasuite.ai app: PostHog, with servers in the European Union, measures how the application is used in order to improve it; the Meta Pixel measures the effectiveness of Aurora Suite AI's own advertising campaigns, for example sign-ups, free trials and purchases that came from an ad; fonts are loaded from Google Fonts, which receives the IP address. For now the app turns these tools on when it opens, without asking for consent; a consent request in the app is being prepared.

The website chat that customers install with the Aurora Suite AI widget is run on behalf of the customer, who informs the visitors of their own website.

On the aurorasuite.ai website, consent is managed with the banner shown on your first visit and can be changed at any time from the "Cookie preferences" link at the bottom of every page: until you choose, Google Analytics and the Meta Pixel aren't loaded. Details are in the cookie policy. You can also block or delete cookies and local storage in your browser settings.

12. Data subject rights

Data subjects may exercise, within the limits provided by applicable law, their rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where processing is based on consent.

Requests may be sent to [email protected].

Deleting a contact in the app hides it and keeps it recoverable, but does not remove it from the database: for permanent deletion the customer or the data subject can write to [email protected]. After permanent deletion, copies in backups are deleted within 7 days.

Where Umanize processes data as processor on behalf of a business customer, the data subject may need to address their request directly to the relevant controller, without prejudice to Umanize's obligation to assist the customer as provided in the DPA.

Data subjects also have the right to lodge a complaint with the competent supervisory authority, including the Italian data protection authority, if they believe the processing infringes applicable law.

13. Mandatory nature of data provision

Provision of certain personal data is necessary to create an account, receive a demo, use the requested features, obtain support, or comply with administrative and legal obligations. Failure to provide such data may prevent Umanize from delivering the service or responding to the relevant request.

14. Children

Aurora Suite AI and related services are not intended for children. Umanize does not knowingly seek to collect personal data of children in relation to the processing covered by this policy. If you believe that data relating to a child have been submitted in breach of this principle, you may contact us at [email protected].

15. Changes to this policy

Umanize may periodically update this policy for legal, technical, organizational, or service evolution reasons. The updated version will be published through Aurora Suite AI official channels and, where required by law, appropriate notice will be provided.