Privacy Policy

Plain-English Summary (The Short Version)

Privacy is paramount for AuraFill. We leverage advanced AI to simplify form filling, while prioritizing your control and data security.

• Your Knowledge Base is Local-First: The personal data you save in your "knowledge base" is stored only on your device. It is not persistently stored on our servers. When you initiate a form fill, a copy of relevant knowledge base data is securely transmitted for real-time processing to our backend and then to Google Gemini, only to generate suggestions.
• What we transmit for AI processing: Your knowledge base, web form fields (structure, labels, values), the text you select when you use the "AuraFill Reply" feature, and optionally, a temporary screenshot of the visible page (if "Visual context" is enabled).
• No Sensitive Data Transmission: AuraFill automatically skips and NEVER transmits sensitive data like passwords, payment card numbers, CVV, SSN, bank account numbers, or one-time passcodes.
• What we store on servers: Your account info (Google OAuth profile), Flash Coin balance and expiry, and anonymous usage metadata (e.g., AI model used, token counts, timestamps, success flags—never content or screenshots). Basic billing references from Stripe.
• How we use it: Primarily to provide the form-filling service, using your knowledge base and web form data to generate AI suggestions. We may use anonymized or aggregated data to improve AuraFill.
• Who we share it with: Your form data and relevant knowledge base content are securely sent to Google Gemini (our AI provider) for processing to generate suggestions. Payment details are handled directly by Stripe. We do not sell your personal data.
• Your control: You can access, update, or delete your knowledge base data directly from the extension. You can uninstall the extension at any time. You can request deletion of your account and associated server-stored data.
• Review AI output: AuraFill uses AI; its suggestions are not guaranteed to be perfect. Always review fields before submitting.
• Security: We employ robust technical and organizational measures to protect your data. All communications are encrypted (HTTPS).
• Governing Law: This policy is governed by Indian law (specifically the Digital Personal Data Protection Act, 2023).

1. Introduction & Scope

This Privacy Policy applies to the AuraFill Chrome extension and its associated backend services. It outlines how AuraFill collects, processes, stores, and protects personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India, and other applicable global privacy regulations. This policy reflects our unwavering commitment to data privacy and security in the evolving digital landscape of 2026.

2. Data Fiduciary & Data Principal

For the personal data you provide directly to AuraFill (e.g., account details, knowledge base information transmitted for processing, usage data), AuraFill AI Technologies Private Limited is the Data Fiduciary (Controller) as defined under the DPDP Act.

When you use the Service, you (the Data Principal) are providing us with instructions to process your personal data and web form data to perform the requested form-filling service.

3. Information We Collect

We collect various types of information to provide, maintain, and improve AuraFill. We adhere strictly to data minimization principles, collecting only what is necessary for these purposes.

3.1. Information You Provide Directly

• Account Data: When you sign up via Google OAuth (scopes: openid, email, profile), we receive your basic Google profile — your name, email address, and avatar — for authentication and account creation. We never receive or store your Google password. We also store your account preferences and Flash Coin balance on our servers.
• Knowledge Base Data: This includes the personal information you voluntarily save within your AuraFill knowledge base (e.g., full name, address, phone number, email, company, job title, industry, academic history, common responses). This data is crucial for the Service's core functionality. Crucially, your Knowledge Base Data is stored locally on your device within the Chrome extension's local storage and is not persistently stored on AuraFill's servers. However, for the purpose of generating form-filling suggestions, relevant portions of this data are securely transmitted to our backend and then to our AI Provider during an active form-fill session.
• Communications Data: When you contact us for support, we collect the content of your communications, your email address, and any other information you voluntarily provide.

3.2. Information Collected Through Service Usage

• Form Field Data: When you initiate a form fill, AuraFill reads and securely transmits the visible structure, labels, input types, and current values of the web form fields to our backend and Google Gemini. This is done solely to understand the form's context and generate accurate filling suggestions. We are engineered to automatically skip and DO NOT transmit sensitive fields such as passwords, payment card numbers, CVV, SSN, bank account numbers, or one-time passcodes.
• Selected Text Data ("AuraFill Reply"): When you highlight text on a web page and choose "AuraFill Reply" from the right-click menu, AuraFill securely transmits the text you selected (and your saved reply voice/tone preference) to our backend and Google Gemini, solely to generate a suggested reply that you can review, edit, copy, or insert. This is triggered only by your explicit action. The selected text is processed in real-time to produce the reply and is not persistently stored by AuraFill or the AI Provider after the request completes.
• Visual Context Data (Optional): If you choose to enable the "Visual context" feature, AuraFill may transmit a temporary screenshot of the currently visible web page to our backend and Google Gemini during an active form-fill session. This data is used solely to help the AI identify unlabeled fields or understand complex visual layouts for more accurate suggestions. This screenshot data is processed in real-time and not persistently stored by AuraFill or the AI Provider.
• Usage Metadata: We collect non-identifying metadata about how you interact with AuraFill, including features used, extension settings, number of form fills, Flash Coin consumption, successful vs. failed AI requests, AI model name, token counts, cost, and timestamps. This helps us improve the Service and manage your coin balance. This usage metadata contains no knowledge base content, no form values, and no screenshots.
• Billing Data: For Flash Coin purchases, transactions are processed securely by Stripe. We receive confirmation of your purchase and basic billing information (e.g., billing name, address, transaction ID, plan, invoices) from Stripe, but we do not receive, process, or store your full payment card details. Your use of Stripe is subject to their privacy policy.
• Device & Technical Data: We collect limited technical information such as browser type, operating system, IP address (derived from your region but not precise location), and extension version for troubleshooting and service improvement.

3.3. Cookies and Tracking Technologies

AuraFill uses necessary cookies and local storage within the Chrome extension to maintain your session, store your locally-kept Knowledge Base, preferences, and Flash Coin balance. We do not use third-party tracking cookies or similar technologies for advertising purposes within the extension. For our website (if applicable), standard analytics cookies may be used, and a separate Cookie Policy will provide details.

4. How We Use Your Information

We use the collected information exclusively for the following purposes, consistent with your consent and the legal basis provided by the DPDP Act:

• To Provide and Maintain the Service: This is the primary purpose. We use a copy of your knowledge base data, web form field data, and optionally visual context data to power the AI-driven form filling, generating suggestions and automating input in real-time.
• To Manage Your Account: This includes authenticating your access, managing your Flash Coin balance, tracking coin expiry, and processing your payments.
• To Improve and Develop the Service: We analyze aggregated and de-identified (anonymized) usage metadata to understand how AuraFill is used, identify areas for improvement, and develop new features. We do not use your individual knowledge base content, form field data, or visual context data for general service improvement unless it's first de-identified and used in aggregate.
• For Security and Fraud Prevention: We use data to monitor for and prevent fraudulent activity, unauthorized access, and other security incidents, safeguarding the integrity of our Service.
• To Communicate with You: We use your email address to send you important service updates, security alerts, and respond to your support inquiries.
• For Legal Compliance: We may use and disclose your information as required by applicable Indian laws, regulations, or legal processes (e.g., court orders, regulatory directives).

5. How We Share Your Information

We share your information only in limited circumstances, for specific purposes, and with robust contractual safeguards in place. We do not sell, rent, or trade your personal data for marketing purposes.

• Third-Party AI Service Providers (Google Gemini): To provide the core form-filling functionality, the visible structure, labels, input types, and current values of web form fields, along with relevant portions of your knowledge base data and optionally visual context data, are securely transmitted to Google Gemini via API. Google Gemini processes this data in real-time to generate the suggested values.
  • Data Minimization: We only send the minimum data necessary for the AI to understand the form and provide suggestions.
  • No Training: Google's policy for enterprise API users generally prohibits using customer data to train their models unless explicitly opted-in by the customer. We ensure our configuration aligns with this commitment, meaning your data is not used by Google Gemini to train its models.
• Payment Processors (Stripe): When you purchase Flash Coins, your payment details are collected and processed directly by Stripe. AuraFill does not store or have direct access to your full credit card information.
• Other Service Providers (Subprocessors): We engage other trusted third-party service providers (subprocessors) for essential functions like cloud hosting, aggregated analytics, customer support platforms, and email delivery. These providers are contractually bound to protect your data, process it only on our instructions, and only use it for the specific purposes we specify. A detailed list of current subprocessors can be provided upon legitimate request.
• Legal Obligations: We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency), provided such requests are compliant with applicable legal frameworks.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred to the acquiring entity. We will notify you of any such change in ownership or control of your personal data.
• With Your Consent: We may share your information for any other purpose with your explicit consent.

6. AI Disclosure & Transparency

AuraFill's core functionality relies on advanced Artificial Intelligence. While our AI (Google Gemini) is highly sophisticated, it is crucial to understand its inherent limitations.

• AI-Generated Suggestions: The values AuraFill suggests for form fields are generated by AI. They may be incorrect, incomplete, or inappropriate in certain contexts.
• User Responsibility: You are solely and fully responsible for reviewing all suggested fields and verifying their accuracy and appropriateness before submitting any form. AuraFill is not liable for any consequences arising from inaccurate submissions.
• Data Processing for AI: By using AuraFill, you acknowledge and consent to the real-time transmission of your form field data, relevant knowledge base data, and optionally visual context data to Google Gemini for processing to generate form-filling suggestions.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

• Account Data: Retained for the duration of your active account and a limited period thereafter for reconciliation, audit, and legal compliance (typically up to 90 days after account deletion for administrative purposes, unless longer retention is legally mandated).
• Knowledge Base Data: Stored locally on your device for the duration of your active use of the extension. It can be deleted by you at any time. A copy transmitted for AI processing is not retained by our backend or the AI Provider after the request completes.
• Form Field Data & Visual Context Data (sent to AI): This data is processed in real-time to generate suggestions. We do not persistently store the full content of every form you interact with, raw API requests, or screenshot data for extended periods after the transaction is complete, beyond what is necessary for immediate processing, error resolution, and aggregated, anonymized usage metrics.
• Usage Metadata (Anonymized): Aggregated and anonymized usage metadata (without any content) may be retained indefinitely for service improvement and statistical analysis.
• Flash Coin Records & Billing Data: Retained for billing, audit, and tax purposes as required by Indian law (e.g., 7-8 years as per tax regulations).

Upon termination of your account or at your request, we will delete or anonymize your personal data from our servers, subject to our data retention policy and legal obligations.

8. Data Security

We implement robust technical, administrative, and physical safeguards to protect your personal data from unauthorized access, use, disclosure, alteration, or destruction. These measures include:

• Encryption: Data is encrypted both in transit (using industry-standard TLS/SSL protocols) and at rest (using advanced encryption algorithms) on our secure cloud infrastructure.
• Access Controls: Strict access controls are in place to limit access to personal data only to authorized personnel who require it for their legitimate job functions.
• Regular Audits: Our security practices, systems, and controls are regularly reviewed, tested, and audited (both internally and by third parties).
• Secure Infrastructure: Our backend services are hosted on secure cloud infrastructure that adheres to international security standards and certifications.
• Data Minimization: We collect and process only the data strictly necessary for the Service to function as described.
• Authentication: User authentication uses Google OAuth with industry-standard signed tokens (JWT) with expiry.

Despite these comprehensive measures, no system is 100% secure. If you believe your data has been compromised, please contact us immediately.

9. Your Privacy Rights

As a Data Principal, you have the following rights concerning your personal data under the DPDP Act, 2023, and other applicable laws:

• Right to Access and Information: You have the right to know what personal data we hold about you and to request a copy of it.
• Right to Correction/Rectification: You have the right to request that we correct any inaccurate or incomplete personal data. You can usually update your locally stored knowledge base data directly within the extension.
• Right to Erasure (Deletion): You have the right to request the deletion of your personal data, subject to certain legal exceptions (e.g., if we are required to retain it for legal obligations). You can delete your locally stored knowledge base data at any time from the extension's settings.
• Right to Grievance Redressal: You have the right to raise a grievance with us or, subsequently, with the Data Protection Board of India regarding the processing of your personal data.
• Right to Nominate: You have the right to nominate another individual who shall exercise your rights under the DPDP Act in the event of your death or incapacity.

To exercise any of these rights, please contact us at aurafill.in@gmail.com. We may ask for specific information to confirm your identity before processing your request.

10. Children's Privacy

AuraFill is not intended for use by individuals under the age of 13 (or the minimum age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without verifiable parental consent, we will take immediate steps to delete that information promptly from our servers.

11. International Data Transfers

As our service relies on global cloud infrastructure and third-party AI providers like Google Gemini, your personal data may be stored and processed in countries outside of India, where data protection laws may differ. When we transfer your data internationally, we implement appropriate safeguards (e.g., standard contractual clauses, adequacy decisions, adherence to Google's data processing terms for enterprise APIs) to ensure your data receives an equivalent level of protection as required by the DPDP Act.

12. Third-Party Services & Subprocessors

AuraFill integrates with and relies on several trusted third-party services and subprocessors to deliver its functionality. While we vet these partners for security and privacy, we are not responsible for their independent privacy practices or content. We encourage you to review their respective privacy policies.

• Google (Gemini API, Google OAuth): For AI processing and user authentication.
• Stripe: For secure payment processing for Flash Coins.
• Websites you fill forms on: Your interaction with these websites is subject to their own terms and privacy policies.

In addition to the direct integrations listed, we also engage other trusted third-party service providers (subprocessors) for essential functions like cloud hosting, aggregated analytics, customer support platforms, and email delivery. These subprocessors are contractually bound to process data only on our instructions and to maintain appropriate security and confidentiality measures. A detailed list of current subprocessors can be provided upon legitimate request.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or new features. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy.
• Provide notice through the Service (e.g., an in-extension notification or prominent notice on our website) or via email where appropriate.

Your continued use of AuraFill after the updated Privacy Policy is posted will constitute your acceptance of the changes.

14. Contact Us

If you have any questions about this Privacy Policy, your privacy rights, or our data practices, please contact us:

Email: aurafill.in@gmail.com