Privacy notice

Operator and contact

Auren is the trading name used by Ron Ülo Hakman, operating personally in Estonia. Contact: team.aurenai@gmail.com. Proposed correspondence address: Endla vkt 8, Laulasmaa, Harjumaa, Estonia. No OÜ or FIE registration has been supplied. An entrepreneur-account route is being checked, not asserted as approved. VAT status, registration obligations and the correspondence address remain subject to confirmation. No unverified VAT number or postal code is published.

Roles and purposes

Ron Ülo Hakman, trading as Auren, handles enquiries, accounts, billing, activation support and service security as controller. The business customer is normally controller of mailbox correspondence; Auren acts as processor under documented instructions and an agreed DPA. Processing for account/service delivery and requested pre-contract steps relies on contract necessity where applicable. Legal recordkeeping relies on legal obligations; proportionate security and ordinary enquiry handling may rely on legitimate interests.

Information processed

Account data includes Google identity, business contact/billing details, approved business information, encrypted OAuth credentials, subscription references and activation/refund records. Service operation processes relevant incoming email text and produces prepared Gmail replies; full message bodies are not intentionally persisted in the application database. Security/session identifiers, message/prepared reply references, usage counters, review evidence and delivery status are retained as needed for the service and accountability.

Providers and international transfers

Netlify hosts the marketing website. The production backend for account and mailbox processing has not yet been deployed. Stripe handles hosted payments; Auren does not collect card details. Google provides identity and Gmail. OpenAI GPT-4.1 mini is the selected production prepared reply provider; paid activation is deferred. Resend is the prepared transactional notification provider. These are service brands, not an assertion of completed contracts or chosen storage regions. Vendor entities, subprocessors, transfer safeguards and retention terms must be finalized before production. No EU-only storage or zero provider-retention guarantee is made.

Mailbox permissions and AI

Google authorization requests identity/email and separate Gmail readonly/compose permissions. Compose technically includes sending; Auren forbids automatic sending. Necessary message text and approved business facts may reach the production AI provider only after service/data-processing approvals. A setup check uses a fictional question and can create a prepared reply with no recipient. NVIDIA testing is restricted to fictional fixtures and is never a fallback for real correspondence. No claim is made that all processing stays within Google.

Google API data-use policy

Auren requires its use and transfer of information received from Google APIs to follow the Google API Services User Data Policy, including Limited Use requirements. Gmail data is used only for the customer-authorized preparing replies service, not for advertising, sale or generalized AI model training. Human access is restricted to the exceptions permitted by that policy, such as specific user consent, security investigation or legal necessity. Provider agreements and operational controls must support these restrictions before production processing is enabled. Google verification and any required security assessment must be completed before public Gmail processing is enabled.

Google Workspace user-data policy

Enquiries and marketing

The contact form prepares an email in your mail app. Auren receives it only if you send it. We use it to answer your enquiry, not automatically subscribe you to marketing. Do not send passwords or customer emails through the form. No analytics, advertising pixels or external Google Fonts are configured in the current site.

Retention and deletion

Operational data is kept only for its stated purpose, subject to applicable accounting, security and dispute obligations. The category-specific retention and backup-expiry schedule is still awaiting approval and operational verification; no unimplemented automatic deletion deadline is promised. Before activation, this schedule must be finalized with the DPA. Disconnect stops future access and attempts Google-token revocation. Account deletion does not delete existing messages/prepared replies from Gmail or immediately erase independently retained backups and legally required billing records.

Rights, complaints and contact

Depending on the legal basis and circumstances, you can request access, correction, erasure, restriction or portability and object to legitimate-interest processing. Contact team.aurenai@gmail.com; we may verify identity proportionately. For correspondence controlled by a customer business, contact that business first; Auren assists it under the DPA. You may complain to Estonia’s Andmekaitse Inspektsioon at aki.ee. No significant decision based solely on automated profiling is part of the product.