Privacy Commitment
Airuda Labs, LLC ("we", "our", "AIRUDA") respects your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our multi-modal AI messenger platform.
Key Principles: We collect only the data needed to operate AIRUDA. We do not sell personal data or share it for cross-context behavioral advertising. You control your data through access, export, correction, and deletion rights.
1. Data We Collect
Account Information
- Email address (for account creation, verification, communications)
- Username (public identifier in chats and marketplace)
- Password (hashed with bcrypt rounds 12, never stored in plain text)
- Language preference (for UI localization and AI responses)
- Profile information (avatar, bio - optional)
Usage Data
- Messages sent and received (stored for conversation history and RAG context)
- AI prompts used and conversations (for service delivery and cost calculation)
- Photos, videos, audio recordings, documents, and other files you upload or generate in chats, including content processed by AI features
- Contact-sync data (such as phone numbers from device contacts) if you grant access, used to find friends already on AIRUDA and support invites
- Marketplace interactions (prompts viewed, bookmarked, purchased, reviewed)
- Credit transactions (purchases, usage, balances for billing accuracy)
- Workflow configurations (parameters you provide for automation execution)
Technical Data
- IP address and approximate location derived from IP (for security, login history, rate limiting, and geolocation routing)
- Device information, push tokens, and other device identifiers (for notifications, security, and platform optimization)
- Browser type and version (for compatibility and debugging)
- Usage analytics (page views, feature usage, performance metrics)
- Crash logs, diagnostics, performance data, and error logs with correlationIds (for debugging, monitoring, and incident response)
Payment Information
On mobile, Apple App Store and Google Play process native credit-pack purchases. On web, Stripe processes direct top-ups, saved cards, Auto-Recharge, creator KYC, and any creator cash-payout flows supported by AIRUDA's country policy. Some creator countries use AIRUDA paid-credit conversion only, so no cash payout request exists there. We store store-order and transaction metadata, Stripe customer/payment-method references, and transaction history, but never full credit card numbers.
2. How We Use Your Data
- Service Delivery: Operate messenger, AI chats, marketplace, workflow automation
- AI Context: RAG sliding window uses message history for perfect recall (recent 10 + semantic 10 pairs)
- Billing: Calculate credit usage, process purchases, track creator revenue
- Security: Detect fraud, prevent abuse, enforce rate limiting
- Communications: Send verification emails, notifications, service updates (in your language)
- Improvement: Analyze usage patterns to improve features, optimize performance, fix bugs
- Legal Compliance: Respond to legal requests, enforce Terms of Service
4. Your Privacy Rights (GDPR/CCPA)
- Access: Request copy of your personal data we hold
- Export: Download your data in machine-readable format (JSON)
- Correction: Update inaccurate or incomplete information
- Deletion: Request account and data deletion (some data retained per legal requirements)
- Portability: Transfer your data to another service
- Object: Object to certain data processing (analytics, marketing)
- Withdraw Consent: Revoke consent for optional data processing
To exercise these rights, contact privacy@airuda.com with your request, or use the in-app path Settings > Account > Close my account for account deletion. AIRUDA may ask you to verify your identity before acting on a privacy request. AIRUDA handles privacy requests under the timelines required by applicable law: GDPR requests are normally answered within one month, with up to two more months for complex requests if we notify you within that first month, and CCPA requests are normally answered within 45 calendar days, with one additional 45-day extension where the law allows.
5. Data Retention
Active Accounts: We retain your data while your account is active and for reasonable period after (backup, recovery, legal compliance).
Messages and uploads: Chat history is retained so you can access your conversations, and uploaded files/media remain available until you delete them. You can delete individual messages, whole chats, and uploaded content at any time.
Inactive Accounts: Accounts inactive for 2+ years with no credits or data may be deleted after email notification with 60-day grace period. After an account-deletion request, personal data such as profile information, chats, messages, files, sessions, and device tokens is removed within 30 days, and backup copies are purged within 90 days.
Backups: Data in automated backups retained up to 35 days (Aurora point-in-time recovery), then automatically purged.
Legal Holds: Data subject to legal holds, investigations, or disputes retained until resolution.
6. Data Security
We implement industry-standard security measures to protect your data:
- Encryption: HTTPS/TLS for all data in transit, encryption at rest for database (Aurora) and cache (Redis)
- Authentication: JWT with short-lived access tokens (15min), refresh tokens in httpOnly cookies (XSS protection)
- Passwords: Bcrypt hashing rounds 12, never stored in plain text, never logged
- Access Controls: Role-based permissions, principle of least privilege, database row-level security
- Monitoring: CloudWatch alerts for suspicious activity, Sentry error tracking with correlationId tracing
- Rate Limiting: Prevents brute force attacks, DDoS protection, abuse detection
Despite our efforts, no system is 100% secure. Notify us immediately of any suspected security breach at security@airuda.com.
7. Children's Privacy
The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we discover we have collected data from a child under 13, we will delete it immediately.
Users aged 13-17 may use the Service with parental consent. Parents can request access to or deletion of their child's data by contacting privacy@airuda.com.
8. International Data Transfers
AIRUDA is operated from the United States and is built for users across regions including Korea, Europe, and Japan. Depending on the service path you use and the processors involved, your data may be transferred to or processed in the United States and other regions used by AIRUDA or its subprocessors.
EU-US Transfers: For European users, we rely on Standard Contractual Clauses approved by EU Commission for lawful data transfer to United States.
Regional Infrastructure: We may use regional infrastructure and service providers to keep AIRUDA responsive and globally available, while keeping access controls and privacy obligations in place across those processing paths.
9. Changes to This Policy
We may update this Privacy Policy occasionally. We will notify you of material changes via: (1) Email to your registered address, (2) In-app notification, (3) Notice on this page.
Continued use of Service after changes constitutes acceptance of updated Privacy Policy. We encourage reviewing this page periodically.
10. Contact for Privacy Matters
For privacy-related questions, data requests, or concerns, contact:
Privacy Officer
Airuda Labs, LLC
Email: privacy@airuda.com
Data Requests: Include your registered email, the specific request (access, export, correction, account deletion, or specific data deletion), and enough detail for us to identify the relevant messages, chats, images, videos, audio files, or documents. AIRUDA may ask for extra identity verification before acting. Response timelines follow applicable law, including normally one month under GDPR and 45 days under CCPA, with extensions where the law allows.