This Privacy Policy explains how Auroxa (“we”, “us”, or “our”) collects, uses, and protects information about you when you use our platform (the “Service”). By creating an account or using the Service, you agree to the practices described below.
When you register, we collect your name, email address, and password (stored as a secure hash — we never store your plaintext password). If you sign up via Google OAuth, we receive your name and email from Google.
We automatically log how you interact with the Service: pages visited, features used, AI generation requests, keyword queries, content created, and event timestamps.
We collect IP addresses, browser type, operating system, device identifiers, and error logs to maintain platform reliability and security.
Payments are processed by Stripe, Inc. We do not store your full card number. We retain your Stripe customer ID and subscription status to manage your plan.
If you connect external services (Google Search Console, Google Analytics 4, WordPress, Shopify, Ghost, HubSpot, Webflow, Google Business Profile), we store the access tokens and data retrieved from those services solely to provide the features you requested. Integration credentials and access tokens are stored encrypted. If you connect Google Business Profile, this includes your business listing details and the public reviews on your profile, used to display them to you and to draft reply suggestions you can approve. You may disconnect any integration at any time from your account settings; on disconnect, the stored access tokens are deleted from our systems. For Google services we do not call Google's token-revocation endpoint, because our Google integrations share a single OAuth client and revoking would also disconnect your other Google integrations; you can withdraw Auroxa's access at any time at myaccount.google.com/permissions.
To run audits and generate insights, we crawl and analyze the website you register and publicly available data about your business and market — for example search-engine results, public business listings and reviews, and competitor pages. Documents you upload to the knowledge vault and images you add to the image vault are stored to power the features you use them with.
When you publish through your hosted Auroxa blog or connect your own domain, we store your published articles and serve them publicly from our infrastructure, and we store the domain configuration you provide (DNS verification status and routing settings) to keep your domain connected. Published content is public by design.
When you connect Google Search Console, Auroxa uses the https://www.googleapis.com/auth/webmasters.readonly OAuth scope to read search performance data (impressions, clicks, queries, and indexing status) for your own verified properties. This data is used solely to display search-performance insights inside Auroxa to you, the account owner. We do not share GSC data with third parties, do not use it to train AI models, and do not sell it. Auroxa's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
When you connect Google Analytics 4, Auroxa uses the https://www.googleapis.com/auth/analytics.readonly OAuth scope to read aggregated session counts, conversion counts, and revenue figures for the pages on your site that Auroxa has published. This data is used solely to display the “Revenue Attribution” and “Traffic Growth” dashboards inside Auroxa to you, the account owner. Auroxa does not permanently store your Analytics report data: metrics are fetched from the Google Analytics Data API when you view your dashboards and are not retained after display. On disconnect, your stored access tokens are deleted, removing all Google Analytics data Auroxa holds; you can also withdraw Auroxa's access at myaccount.google.com/permissions. We do not share GA4 data with third parties, do not use it to train AI models, and do not sell it. Auroxa's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We do not sell your personal data to third parties. We do not use your data to train AI models without your explicit, separate consent.
We share data only with the third-party providers listed below, strictly as necessary to operate the Service. Each provider is contractually obligated to protect your data.
| Provider | Purpose |
|---|---|
| Supabase | Database hosting and authentication |
| Stripe | Payment processing and subscription management |
| Vercel | Application hosting and edge delivery |
| Anthropic (Claude) | AI content generation |
| Google (Gemini) | AI strategy analysis |
| Google Analytics 4 (your integration) | Reading aggregated traffic and revenue data from your connected GA4 property (only when you connect it) — report data is displayed live and not retained |
| Google Analytics 4 & Meta Pixel (our site) | Traffic and advertising measurement on Auroxa's own marketing pages only — never on customer blogs |
| Resend | Transactional email delivery |
| DataForSEO | SEO data (SERP, keywords, backlinks) |
| Sentry | Error monitoring and crash reporting |
| PostHog | Product analytics and session replay (input fields masked; Auroxa pages only) |
If you enroll a project in the optional Auroxa Link Network, limited information about that project is shared with other participating customers as part of arranging link placements: your project's public domain, the titles and public URLs of your published articles, and the proposed anchor text. A customer hosting a link to your site sees your domain and the target article; you see the partner article carrying your link. No account details, contact information, analytics, or private data are ever shared between customers, and leaving the Network stops all future sharing.
We retain your personal data for as long as your account is active. If you close your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law (e.g., billing records are retained for 7 years per financial regulations). Aggregated, anonymized usage statistics may be retained indefinitely.
Depending on your jurisdiction (including GDPR and CCPA), you may have the right to:
To exercise any right, email us at privacy@auroxa.app. We will respond within 30 days.
We use cookies to maintain your session and remember your preferences. We also use analytics tools to understand how the Service is used and to improve it: Vercel Analytics (anonymized, aggregate traffic analysis), Google Analytics 4 and Meta Pixel (traffic measurement and advertising performance for our own marketing pages), and PostHog (product analytics and session replay). Session replay records how the Service interface is used — clicks, pages visited, and navigation — to help us find and fix usability problems; anything you type into input fields (passwords, keys, billing details) is masked on your device and never recorded. These tools run only on Auroxa's own pages and are never embedded in the blogs or websites we host or publish for customers. You may disable cookies in your browser settings; this may limit Service functionality.
We apply industry-standard security measures: TLS encryption in transit, hashed passwords, row-level security on our database, SHA-256 hashed API keys, and periodic security reviews. No transmission over the Internet is 100% secure; we cannot guarantee absolute security and are not liable for unauthorized access beyond our reasonable control.
The Service is not directed at individuals under 16. We do not knowingly collect data from children. If you believe a child has provided us personal data, contact us and we will delete it immediately.
Your data may be processed in countries other than your own (including the United States) by our service providers. By using the Service you consent to such transfers. We require all processors to maintain appropriate safeguards.
If you are located in the European Union or European Economic Area, the following applies to you under the General Data Protection Regulation (GDPR):
We process your personal data on the following legal bases: (a) Contract performance — processing necessary to provide the Service you subscribed to; (b) Legitimate interests — fraud prevention, platform security, and service improvement; (c) Legal obligation — where required by applicable law (e.g., financial record keeping); (d) Consent — for optional marketing communications, which you may withdraw at any time.
In addition to the rights listed in Section 5, EU/EEA residents have the right to: (a) restrict processing of your data while a dispute is resolved; (b) not be subject to solely automated decision-making that produces significant legal effects. To exercise any right, email privacy@auroxa.app. We will respond within 30 days.
You have the right to lodge a complaint with your local data protection supervisory authority. In the EU, you may contact the supervisory authority in your country of residence. A full list is available at edpb.europa.eu. We would, however, appreciate the opportunity to address your concerns directly before you contact a regulator.
Your data may be transferred to and processed in countries outside the EU/EEA (including Canada and the United States) by our service providers. Canada is recognized by the European Commission as providing adequate data protection. For transfers to the United States, we rely on Standard Contractual Clauses (SCCs) or the service provider's participation in an approved transfer mechanism.
Auroxa is operated from Manitoba, Canada, and complies with the Personal Information Protection and Electronic Documents Act (PIPEDA). We collect, use, and disclose personal information only for the purposes described in this policy, with your consent or as permitted by law. You may access or correct your personal information, or withdraw consent, by emailing privacy@auroxa.app. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.
We may update this policy periodically. Material changes will be communicated via email or in-app notification at least 14 days before taking effect. Continued use after that date constitutes acceptance.
Questions or requests: privacy@auroxa.app