Who we are and what this policy covers
Aurato operates Atlas, Graph and Hub: a source-linked reference platform for payment methods, markets, schemes, systems, operators, PSPs, standards, regulations, identifiers, banks and cards. This policy explains how Aurato (“Aurato”, “we”, “us”) handles personal data when you visit aurato.io, create or use an account, contact us, or use the Aurato API or MCP service, including through a connected AI client such as ChatGPT or another supported client.
Aurato is the controller of the personal data described here unless a different role is stated. Questions and privacy requests can be sent to contact@aurato.io.
Personal data we collect
Depending on how you use Aurato, we may process:
- Account and identity data: name, email address, profile photo, authentication-provider identifier, sign-in method, account ID, plan, role, language or locale, and timezone.
- Authentication data: session and token data needed to keep you signed in. Email-password authentication is handled by Supabase; Aurato does not receive or store your password in readable form.
- Account activity: favorites, Graph key names, prefixes, hashes and scopes, connected OAuth client grants and sessions, token or service usage, and security or account-management events. A newly created Graph key secret is shown once; Aurato stores a cryptographic hash rather than the full secret.
- Contact data: the name, email address, company or topic, selected Aurato record, message and other information you submit through our support, feedback or partnerships forms or by email.
- Usage and technical data: page path, selected tab, external referrer hostname, campaign labels, country, device category, performance measurements, request metadata, and information needed to protect the service and enforce rate limits.
Google sign-in data
When you choose Sign In with Google, Aurato requests only the standard OpenID Connect scopes openid, email and profile. This may provide your Google account identifier, name, email address and profile photo, together with the session data needed to complete sign-in.
We use this Google user data only to authenticate you, create or locate your Aurato account, prevent duplicate accounts, display your name and profile photo, and secure the sign-in process. Aurato does not request access to your Gmail, Google Drive, Contacts, Calendar, payment information or other Google product content.
Where Aurato needs to retrieve a current Google profile photo, the Google provider token is used transiently by our profile-sync endpoint and is not stored by that endpoint. We do not sell Google user data, use it for advertising, or allow people to use it for credit, insurance or other eligibility decisions. We disclose it only to service providers that support authentication and hosting, when you direct us to do so, or when legally required.
Aurato’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
LinkedIn sign-in data
When you choose Sign In with LinkedIn, Aurato uses LinkedIn OpenID Connect through our authentication provider and requests openid, email and profile. LinkedIn may provide an account identifier, name, email address, profile photo and locale, together with data needed to complete sign-in. Some profile fields may be unavailable.
We use this information to authenticate you, create or locate your Aurato account, link sign-in methods where the same verified email address is available, display your name and available photo, and protect the account. We do not request your LinkedIn connections, posts, messages, employer or job history for sign-in, and do not use LinkedIn sign-in data for advertising or eligibility decisions. The authentication provider processes the sign-in tokens needed for your session; Aurato does not use them to retrieve additional LinkedIn content.
ChatGPT sign-in data
When you choose Sign In with ChatGPT on Aurato, the sign-in service provides Aurato with your ChatGPT account identifier and email address, and your name if available. We use these details to authenticate you, create or locate your Aurato account, link an existing account where the same verified email address is available, and display your name. Aurato does not receive your ChatGPT password, profile photo, chat history, files or other conversations through this sign-in.
Signing in to the Aurato website with ChatGPT is separate from authorising the Aurato Graph MCP connection inside ChatGPT. Connecting that service requires its own authorization step and can be revoked separately.
AI clients and MCP connections
If you connect Aurato Graph to ChatGPT, Claude or another compatible AI client, the client sends Aurato the specific MCP tool request it chooses to make, including the tool name and arguments such as a collection, search term or record identifier. Aurato uses those inputs to authenticate and answer the request, and returns the relevant published Graph data, measurements, relationships or source references to that client. The current Graph tools are read-only. Aurato does not request your full conversation or unrelated files from the AI client.
For connected requests, we record the Aurato account or Graph key used, the client authorization or grant where applicable, the tool or endpoint, request identifier, time and usage units for access control, billing, security and your usage history. Our Graph usage ledger does not store the tool arguments or full responses. If you put personal information in a tool argument, it is still transmitted to Aurato for that request; please share only what is needed for the lookup.
The AI client receives Aurato’s response and may include it in your conversation. OpenAI, Anthropic or another client provider handles your prompts, conversation and returned tool content under its own terms and privacy policy (see OpenAI and Anthropic). Aurato does not control that provider’s retention, model-training settings or sharing choices. Claude access is covered by this policy if and when an Aurato connection for Claude is made available.
How and why we use personal data
We use personal data to provide and secure accounts; authenticate users; deliver Atlas, Graph and Hub features; operate favorites, API and MCP keys and plan access; answer support and partnership requests; understand service usage; diagnose performance and availability; prevent abuse; comply with law; and improve the platform.
Where applicable, our legal bases are performance of our agreement with you, our legitimate interests in operating and improving a secure service, compliance with legal obligations, and consent where the law requires it. You may withdraw consent at any time, without affecting earlier lawful processing.
Analytics, browser storage and cookies
Aurato uses a small first-party analytics system. It does not use analytics cookies, third-party analytics scripts or advertising trackers. For a page view, we may record the page path, tab, external referrer hostname, campaign labels, country and device category. We may associate an account event with a signed-in account.
To estimate daily visitors, an IP address and user-agent string are used transiently to create a pseudonymous key that rotates each day; the source IP address and full user-agent string are not stored with the analytics event. Optional performance monitoring may collect sampled web-vital timings, page paths, device category, release identifier and data-quality status. Aurato does not send these events when your browser signals Do Not Track or Global Privacy Control.
We use browser storage where needed to remember your light or dark theme, preserve selected catalog filters, and maintain an authenticated Supabase session. Authentication providers and infrastructure providers may use their own cookies or storage under their policies when you interact with their services.
International transfers
Aurato and its service providers may process data in countries other than the one where you live. Where required, we use recognised safeguards for international transfers, such as adequacy decisions, standard contractual clauses or another lawful transfer mechanism. You may contact us for more information about the safeguards relevant to your data.
How long we keep data
We keep personal data only for as long as needed for the purposes described in this policy. Account and feature data is generally retained while your account is active and for a limited period afterwards to complete deletion, resolve disputes, prevent fraud and meet legal obligations. Contact messages are kept for as long as needed to handle the request and maintain appropriate business records.
For the API and MCP service, the following retention rules apply:
- Tool inputs and results: processed to answer the request; the Graph usage ledger does not store prompts, tool arguments or response bodies.
- Detailed Graph usage events: 30 days from the request, followed by automatic hourly cleanup. These events contain the account or key reference, endpoint or tool name, request identifier, time and usage units.
- Account usage totals: API and MCP unit counters remain for the lifetime of the account. After detailed events expire, the counters contain no request identifiers, paths, tool names, arguments or results. They are account-linked data, not anonymous data, and are removed when the account profile is deleted.
- Active keys and OAuth grants: kept while needed to provide authorised access. Revoked or expired keys, revoked grants and definitely expired MCP OAuth sessions are automatically removed after 90 days. Revocation blocks future access immediately. You can delete a connected app's grant from the Sessions tab sooner.
- Account access-change audit events: 90 days, followed by automatic cleanup.
Revoking a connection does not erase earlier usage or responses held by your AI client. OpenAI, Anthropic or another client provider retains its own conversation data under its own policy; Aurato's retention rules do not change that copy.
Analytics and performance data is retained only as long as useful for aggregate reporting, security and service improvement, then deleted or de-identified. Infrastructure providers process separate technical logs: Cloudflare Workers Logs have a maximum seven-day window; Supabase Pro platform logs normally have a seven-day window. Database backups expire on the configured Supabase recovery schedule: Pro daily backups have a seven-day window, while an enabled Point-in-Time Recovery service has its own configured window. Deleted records may remain in isolated backups until those backups expire. A restore must reapply deletion and retention actions before restored account data is used.
A specific legal obligation or dispute may require limited records to be retained longer. Such records must be restricted to that purpose. You can request account deletion using the contact details below; deletion includes identity links, favorites, keys, Graph usage events and account usage counters in the live database, together with revocation and removal of the linked authentication accounts.
Security
We use technical and organisational safeguards designed to protect personal data, including encrypted connections, access controls, row-level database security, token hashing, scoped credentials and server-side verification for sensitive account actions. No online service can guarantee absolute security. Please keep your credentials confidential, revoke any exposed API or MCP key, and contact us if you suspect unauthorised access.
Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, obtain a portable copy of data, withdraw consent, and complain to a data-protection authority. Aurato does not sell personal data or share it for cross-context behavioural advertising.
To make a request, email contact@aurato.io from the address connected to your account. Use the subject Privacy request or Delete my account. We may need to verify your identity and may retain limited information where required by law or needed to protect the service.
You can also revoke Aurato’s Google access from your Google Account connections. Revoking Google access stops future Google sign-in but does not by itself delete your Aurato account; contact us if you want the account deleted as well.
You can remove Aurato from LinkedIn’s permitted services; LinkedIn explains how to disconnect an app. You can sign out of Aurato after using ChatGPT sign-in. Neither action alone deletes an Aurato account linked to the same email address.
You can revoke a connected AI client from the Sessions tab in your Aurato account, disconnect it in that client, or revoke a Graph key from the Keys tab. Revoking a connection or key prevents future authenticated access through it; it does not remove earlier responses from conversations held by the client provider. Contact us to request deletion of your Aurato account data.
Children
Aurato is a professional reference service and is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided personal data, contact us and we will take appropriate steps.
Changes and contact
We may update this policy when Aurato’s services, providers or legal obligations change. We will publish the revised policy here, change the effective date, and provide additional notice where a change materially affects how we use personal data.
For questions or requests, email contact@aurato.io or use the Aurato contact page.