Privacy Policy

1.1 Account and billing information — name, email, organization, role, IP address, payment metadata, and identifiers required to invoice and provide service.

1.2 Customer-uploaded content — call audio, transcripts, agent interactions, voicebot session data, and any uploaded files needed to perform conversation analysis or biometric verification (when those modules are active). This data is processed under our Master SaaS Services Agreement; the Customer is the data controller for it.

1.3 Platform usage data — analytics events, error logs, audit logs, and metrics on how the platform is used.

1.4 Website navigation data — pages visited, referrer, browser type, cookies, and similar telemetry from auralytik.com.

2.1 Service delivery, account management, billing, and customer support.

2.2 Platform security, abuse detection, fraud prevention, and legal compliance.

2.3 Improvement and personalization of the platform, including improving our AI models — but only on anonymized or aggregated data. We do not train third-party foundation models on Customer Data, and we do not use Customer-uploaded conversation content to train models that are made available to other customers.

2.4 Communications with you about your account, service status, and (with consent or where permitted) marketing.

3.1 For Customer-uploaded content, the Customer acts as Data Controller under GDPR, CCPA/CPRA, and applicable equivalents. Pintor Project acts as Data Processor.

3.2 For account, billing, and website navigation data, Pintor Project acts as Data Controller.

4.1 We engage sub-processors to provide infrastructure and supporting services. The current list is maintained at auralytik.com/subprocessors and includes Microsoft Azure (hosting, Azure AI Speech, Azure AI Language, Azure OpenAI Service, Communication Services Email, Application Insights, Blob Storage, SQL, Power BI), Stripe (self-serve billing), ElevenLabs (AI voice synthesis when voicebot features are active), and Twilio / Meta (WhatsApp Business messaging when WhatsApp integration is active).

4.2 We provide at least 30 days' advance notice for new sub-processors to customers with contractual notification requirements.

5.1 Customer Data is processed primarily in US and Chilean Azure regions. Cross-border transfers are covered by Standard Contractual Clauses, adequacy decisions, or equivalent safeguards required by applicable law.

6.1 We implement reasonable technical and organizational measures including encryption in transit and at rest, least-privilege access, multi-factor authentication, access and event logging, periodic security audits, and incident-management procedures.

7.1 Depending on your jurisdiction, you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to opt out of certain processing.

7.2 Requests received directly by Pintor Project that concern Customer-uploaded content will be forwarded to the relevant Customer, unless applicable law imposes direct obligations on us.

7.3 To exercise rights regarding account, billing, or website data, contact privacy@auralytik.com.

8.1 Customer Data is retained while the contract is active. Upon written request from the Customer, Pintor Project deletes or returns Customer Data within a reasonable period, except where retention is legally required. Inactive accounts may be deleted after 24 months of inactivity.

9.1 Strictly necessary cookies: required for the website to function, such as session management, locale preference, and CSRF protection. These are not subject to opt-in.

9.2 Analytics cookies: used to understand how visitors interact with our website (pages visited, referrer, navigation patterns). These help us improve content and usability.

9.3 Marketing attribution: we capture UTM parameters from inbound links and may store attribution identifiers to measure the effectiveness of marketing campaigns. These identifiers are not used for cross-site advertising or third-party tracking.

9.4 Within the Auralytik platform itself (auralytik.com authenticated areas), additional cookies are used for authentication, session management, and platform preferences. These are documented in the platform's in-app privacy notice.

9.5 Cookie control: you can manage cookie behavior through your browser settings, including deleting cookies and blocking future ones. Note that disabling strictly necessary cookies may impair site functionality.

10.1 Data we receive through Meta — when an administrator connects a WABA through Meta Embedded Signup, we receive and store the Facebook user ID of the administrator who authorised the connection, the WABA ID, the phone number ID, the verified business name, the display phone number, and an access token that lets Auralytik act on that account's behalf. A WABA connected with a System User access token provides the same identifiers and token, without a Facebook user ID. We also receive the content and metadata of the WhatsApp messages sent to and from the connected business number.

10.2 How we use it — solely to provide the service the business client has subscribed to: sending and receiving WhatsApp messages on its behalf, managing its message templates, reading its phone numbers and verified business name, and producing conversation analytics and quality evaluation for that client. We do not use this data for advertising, we do not sell it, and we do not use it to build profiles of the individuals who message the business.

10.3 Security and retention — access tokens are encrypted at rest using keys held in a managed key vault, and are retained until the integration is disconnected, at which point they are erased. The Facebook user ID of the authorising administrator is retained only while the integration remains connected. Conversation records are retained according to the subscription and contract of the business client that operates the WhatsApp number.

10.4 Business records — conversation history is collected and held on behalf of the business client that operates the WhatsApp number. It is that business's record (see Section 3.1), not the personal data of the Facebook administrator who connected the integration.

10.5 Deleting your Meta integration data — you can request deletion at any time from Facebook (Settings & Privacy → Settings → Apps and Websites → Auralytik → Remove) or by writing to privacy@auralytik.com with the WABA ID or business phone number. We then revoke our access, disconnect the integration, and erase the stored access token and the record linking your Facebook account to it. You receive a confirmation code and a status link that reports when the request has completed. Because deletion disconnects the integration, WhatsApp messaging on that account stops until an administrator reconnects it.

10.6 What deletion does not erase — the business client's conversation records, which are retained under that business's own contract and legal obligations. To have conversations erased, contact the business you messaged, which controls those records; we act only as its processor.

11.1 We may update this policy. Material changes are communicated with reasonable advance notice through the platform or by email.