Aulay AIPrivacy Policy
This policy describes what personal data Aulay holds, why we hold it, who else sees it, and what you can do about it. It is written against what the software actually does.
1. Who is responsible
The controller of the personal data described here is the operator of Aulay, based in Canada. Privacy enquiries and requests go to privacy@aulay.io; a postal address is available on request.
Aulay is operated from Canada and is subject to Canadian federal privacy law (PIPEDA). If you are in the United Kingdom or the European Economic Area, the UK GDPR or EU GDPR also applies to our processing of your data, and the rights in section 6 are available to you on that basis.
2. The short version
- We hold your email address, your sessions, your agent transcripts, and security logs.
- All of it is in a database. Aulay stores no per-user files in object storage, and no repositories — your code stays on your own machines.
- The only analytics is our own, and no advertising. There is no Google Analytics, no Sentry, and no third-party telemetry vendor. We measure page views on this website with a cookieless analytics server we host ourselves, and we record which product features you use inside Aulay — none of it is shared with, or served by, any third party.
- Your prompts and code go to the AI provider you signed in with, not to us — but transcripts of that work are stored by us.
- We do not sell personal data, and we never have.
3. What we collect, and why
Account data
Your email address, display name, and a hash of your password (never the password itself). If you sign in with GitHub, Google, Microsoft or Discord, we also store the identifier and email that provider asserts, together with the basic profile it returns. We need this to give you an account. Legal basis: performance of our contract with you.
Session and device data
For each active sign-in we record the device label you give it, the client type (web, desktop, mobile or CLI), the IP address and the browser user-agent, and when it was last seen. This is what lets you see and revoke your own sessions. Legal basis: contract, and our legitimate interest in account security.
Security and audit logs
We log authentication events — registration, successful and failed sign-ins, sign-outs, password changes, token issue and revocation — with the IP address and user-agent they came from. These logs are what let us detect credential stuffing and respond to a compromised account. Legal basis: legitimate interest in the security of the service and its users.
Separately, the application records a log of actions that change data — which account performed which operation, and when. That log deliberately does not record IP addresses, user-agents, or the contents of any request.
Your work: projects, sessions and transcripts
We store the workspaces, projects and sessions you create, their configuration, and the transcripts of your agent sessions — the prompts you write and the output the agent returns. This is the substance of the product: it is what lets a session survive a closed laptop and be picked up on another device. We also store the invocation records that carry the same content as it passes between your runtime and the control plane. Legal basis: performance of our contract with you.
Credentials you store
You can store secrets — API keys, tokens, git credentials — for agents to use. Named secrets are encrypted at rest. Sign-in state captured from AI command-line tools is handled differently and less well; see Security, which sets out the current limitation plainly. Legal basis: performance of our contract with you.
Billing data
Subscription status, the Stripe customer and subscription identifiers, and usage counters (session minutes, storage). We never receive your card number. Stripe collects and holds your payment details and billing address directly. Legal basis: contract, and legal obligation for financial records.
Support and feedback
If you send feedback in-product we store what you wrote, your account identifier and email, any diagnostic information you chose to attach, and any screenshot you uploaded. Legal basis: legitimate interest in supporting our users.
Waitlist
If you ask for early access we store your email address, where you came from, and the status of your invitation, until you are invited or you ask us to remove it. Legal basis: your consent, and steps taken at your request before a contract.
Abuse-control counters
To rate-limit sign-in attempts and password resets we keep short-lived counters keyed on email address and IP address. They expire within an hour and are swept every fifteen minutes. Legal basis: legitimate interest in preventing abuse.
Website analytics
This website and the sign-in page load a script from stats.aulay.io — an analytics server (Umami) that we run on our own infrastructure. It records the page you viewed, the page you came from, your browser, operating system, device class, and country. It sets no cookie and stores nothing in your browser. Your IP address is used transiently, together with a salt that rotates daily, to distinguish visitors within a day — the IP address itself is never stored, and visitors cannot be re-identified across days. Nothing is shared with any third party. Legal basis: legitimate interest in understanding how the site is used.
Product usage data
Inside Aulay we record which features you use — for example that you opened a terminal tab or used the command palette — as an event with your account, the app, the feature name, and a timestamp. We use this to understand which parts of the product matter and which need work. It stays on our servers, is never shared, and is deleted after 180 days (immediately if you delete your account). Legal basis: legitimate interest in improving the product.
4. What we do not do
- No third-party analytics or advertising. No third-party analytics, advertising, session-replay, or crash-reporting service receives any data about you. The only measurement is first-party and self-hosted (section 3), and this website still sets no cookies at all.
- No model training. We do not train models, and we do not make your content available to anyone to train on.
- No sale or sharing for advertising. We do not sell personal data or share it for cross-context behavioural advertising.
- No automated decisions. Nothing about your account is decided solely by an automated process in a way that produces legal or similarly significant effects.
5. Who else processes your data
We use a small number of service providers. The full list — what each receives, and where they are located — is at Subprocessors. In summary: Stripe for payments, Zoho ZeptoMail for transactional email, Cloudflare at the network edge, Backblaze B2 for encrypted off-site backups and audit archives, and Hostinger for hosting.
Two disclosures we want to make prominently rather than bury:
- Our nightly database backups contain all of the data described above and are stored, encrypted, with Backblaze B2 in the United States.
- When you use the remote display feature, your browser contacts a Google STUN server (
stun.l.google.com) as part of establishing the connection, which discloses your IP address to Google. This happens in your browser, not on our servers. We intend to replace it with our own server.
We will also disclose data where we are legally required to, or where it is necessary to protect our rights or someone’s safety.
6. International transfers
Data is processed in Canada, in United States (Boston, Massachusetts), and — for backups, audit archives, payments and email — in the United States and Canada. Where personal data of UK or EEA residents is transferred to the United States we rely on the UK and EU Standard Contractual Clauses, or on the provider’s certification under the EU-US and UK-US Data Privacy Framework where they hold one.
7. How long we keep it
Retention is set out in full, per category, at Data Retention. Broadly: live account and session data is kept until you delete it; operational logs are pruned on a schedule measured in days or months; encrypted backups age out on a fixed rotation.
8. Your rights
You can ask us to:
- give you a copy of the personal data we hold about you, in a portable format;
- correct anything that is wrong, including changing the email address on your account;
- delete your account and the data associated with it;
- restrict or object to processing we carry out on the basis of legitimate interests;
- withdraw consent where consent is the basis, such as the waitlist.
How to exercise them today: all three are self-service on your account page: “Your data” exports a copy of the personal data we hold as a single JSON document, “Sign-in email” changes the address on your account (the new address must confirm before anything changes), and the danger zone deletes your account, with a seven-day grace period before your data is permanently erased. If you prefer, or if you can no longer sign in, email privacy@aulay.io from the address on your account: we will verify that the request comes from you and respond within 30 days. There is no charge either way.
What deletion actually means. When you ask us to delete your account we suspend it immediately and permanently erase your data from our live systems. Some things survive, and we would rather say so:
- Security log entries are anonymised, not deleted — we keep the event and its timestamp, and remove the IP address, user-agent and any other detail. We rely on this to investigate abuse.
- Stripe retains your invoice and payment records under its own obligations and ours to keep financial records.
- Encrypted backups age out on their normal rotation rather than being edited. We do not open, search, or restore from backups to reach individual records. If we ever do restore a backup, every deletion made since that backup was taken is replayed before the system is returned to service.
If you are unhappy with how we have handled your data you can complain to the Office of the Privacy Commissioner of Canada, or — if you are in the UK or the EEA — to your local supervisory authority. We would appreciate the chance to fix it first.
9. Security
Traffic is encrypted in transit. Passwords are hashed. Secrets you store are encrypted at rest. Access between accounts is denied by default at the API boundary. Our current security posture, including a limitation we have not yet fixed, is described at Security and Responsible Disclosure. No system is perfectly secure, and we do not claim otherwise.
10. Children
Aulay is not for anyone under 16. We do not knowingly collect data from children. If you believe a child has an account, tell us and we will remove it.
11. Changes
If we change this policy materially we will email the address on your account at least 30 days beforehand, and the version and effective date at the top of this page will change.
12. Contact
Aulay
Canada — postal address available on request
privacy@aulay.io
Previous versions of this document are available on request.