Privacy Policy

This Privacy Policy explains what information Aurea LLC, an Oregon limited liability company based in Portland, Oregon ("Aurea," "we," "us"), collects through the Aurea platform at app.withaurea.com and our website (together, the "Platform"), how we use it, and the choices you have. Capitalized terms not defined here (such as "Customer Data") have the meanings given in the Aurea Terms of Service.

1. WHO THIS POLICY COVERS

1.1 Aurea is a business-to-business service. Our customers are real-estate firms (each a "Customer"), and the people who use Aurea are their employees and contractors ("Users").

1.2 Customer Data. When a Customer uploads or connects data to the Platform, such as deal documents, financial statements, rent rolls, underwriting inputs, and investor or contact records, we process that data on the Customer's behalf and under the Customer's instructions as set out in the Terms of Service. The Customer controls that data. If your information appears in a Customer's data (for example, as an investor or broker contact) and you want to access, correct, or delete it, please contact that Customer. We will help them respond.

2. INFORMATION WE COLLECT

2.1 Account information. Name, work email address, firm, role, and workspace settings. If you sign in with Google, we receive your name, email address, and Google account identifier from Google.

2.2 Customer Data. Files, documents, and information you upload to or create in the Platform, and the outputs the Platform generates from them.

2.3 Connected services, but only if you choose to connect them: - Gmail (read-only). If a User connects Gmail, we read only the messages that match the labels or contacts that User selects, so that deal and contact information can be brought into Aurea. We do not send email from your account or change your mailbox. - Google Drive and Google Workspace directory. If a Customer administrator authorizes them during setup, we access the Drive files the firm directs us to import and a read-only list of the firm's users, to bring in deal files and set up accounts. - Granola. If a User provides a Granola API key, we read that User's meeting notes so they can be linked to deals and contacts. You can disconnect any of these at any time from your settings.

2.4 Billing information. Payments are processed by Stripe. Stripe collects your card details. We do not receive or store full card numbers. We receive and keep billing contact details, billing address, plan, and payment status.

2.5 Usage and technical information. IP address, browser type, device information, pages and features used, timestamps, and error logs. When a Customer accepts the Terms of Service, we record who accepted, the version, the time, and the IP address.

2.6 Website forms. If you request access through our website, we collect the details you enter (such as name, email, firm, and any note you include).

2.7 Cookies. We use only cookies that are necessary to run the Platform, such as keeping you signed in and protecting forms against forgery. We do not use advertising cookies or third-party advertising trackers.

3. HOW WE USE INFORMATION

We use information to: - provide, operate, and maintain the Platform, including its AI-assisted features; - authenticate Users and keep accounts secure; - process payments and manage subscriptions; - send service messages, such as sign-in links, deal notifications, receipts, and billing notices; - provide support and respond to requests; - monitor, debug, and improve the Platform, as limited by Section 4; and - comply with law and enforce our Terms of Service.

4. AI PROCESSING AND MODEL TRAINING

4.1 The Platform uses a third-party AI provider (currently Anthropic, PBC) to analyze documents and generate outputs. Customer Data sent to the AI provider is processed to return results to you. Under the AI provider's commercial terms, that data is not used to train its models and is kept only for a limited period.

4.2 Aurea does not use Customer Data to train or fine-tune any foundation AI model. We may improve Aurea's own templates and methods using only aggregated or de-identified data, as described in the Terms of Service.

5. HOW WE SHARE INFORMATION

5.1 We do not sell personal information, and we do not share it for cross-context behavioral advertising.

5.2 Service providers. We share information with providers that help us run the Platform, and only so they can provide their services to us: Anthropic (AI processing), Railway (application hosting and database), Google Cloud (file storage), Stripe (payments), and Postmark (email delivery). Google and Granola also process data when you choose to connect those services.

5.3 Within your workspace. Information you add to a workspace is visible to other authorized Users in that workspace, according to the roles and permissions your firm sets.

5.4 Legal and safety. We may disclose information if required by law or legal process, or to protect the rights, property, or safety of Aurea, our Customers, or others.

5.5 Business transfers. If Aurea is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction. It will remain subject to this Policy.

6. GOOGLE USER DATA

Aurea's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide and improve the user-facing features you enabled. We do not use it for advertising, we do not sell it, we do not use it to train generalized AI or machine-learning models, and no person reads it except with your consent, for security purposes, to comply with law, or as part of aggregated and anonymized internal operations. You can revoke Aurea's access at any time from your Aurea settings or your Google Account permissions page.

7. DATA RETENTION

We keep account information and Customer Data for as long as the Customer's subscription is active. When a subscription ends, we make Customer Data available for export for 30 days on request and then delete it in the ordinary course, including from backups as they expire. When you disconnect Gmail or Granola, we delete the stored access credentials for that service. We keep billing records, Terms acceptance records, and limited logs as long as needed for legal, tax, security, and accounting purposes.

8. SECURITY

We use administrative, technical, and physical safeguards designed to protect information. These include encryption in transit, encryption of stored access credentials for connected services, isolation between Customer workspaces, and access controls. No system is completely secure, and we cannot guarantee absolute security.

9. YOUR CHOICES AND RIGHTS

9.1 You can view and update your account information in your settings, and disconnect any connected service at any time.

9.2 Depending on where you live, you may have the right to request access to, correction of, deletion of, or a copy of your personal information, and to object to or restrict certain processing. To make a request, email us at the address in Section 13. We will verify your request and respond as required by law. We will not discriminate against you for exercising these rights. Requests about data a Customer controls (Section 1.2) are handled with that Customer.

9.3 Email. Service and billing messages are part of the Platform and cannot be turned off while you have an account.

10. CHILDREN

The Platform is intended for business use by adults. We do not knowingly collect information from anyone under 18.

11. WHERE DATA IS PROCESSED

Aurea and its service providers process and store information in the United States. If you use the Platform from outside the United States, your information will be transferred to and processed in the United States.

12. CHANGES TO THIS POLICY

We may update this Policy from time to time. We will post the updated version here with a new version date. If a change is material, we will notify Customer administrators by email or in the Platform before it takes effect.

13. CONTACT US

Questions or requests about this Policy or your information: support@withaurea.com Aurea LLC, Portland, Oregon