Privacy Policy
Effective date: [to confirm]
This policy explains what information Botella Aura (“Aura”, “we”) collects when you use it, how it is used, who it is shared with, how long it is kept and how you can have it deleted. Aura is operated by Botella AI Labs [to confirm: operator’s legal name and registration].
1. Who is responsible
Botella AI Labs, [to confirm: registered address], is responsible for the information described here. For privacy questions or requests, contact [to confirm: privacy contact email].
When a business uses Aura, the business decides what its workspace contains and who may use it. Whether Aura acts as the business’s processor or as a controller for each kind of information is [to confirm with legal advisers].
2. What we collect
Account information
- Your name and email address, and your password (stored only as a one-way hash, never in readable form).
- If you sign in with Google: the name, email address and profile picture Google provides.
- The workspaces you belong to and your role in each (owner, admin, member or viewer).
Business workspace information
- What your business tells Aura: its description, offerings, audience, goals, brand voice and competitors.
- Content created in Aura: drafts, their versions and approvals, campaigns, outreach messages and schedules.
- Images you upload or that Aura generates for your content.
- Leads and market information gathered from public sources and from tools you connect.
- Results of published posts (for example likes, comments and shares) and the recommendations Aura derives from them.
- A record of actions taken in the workspace (who did what, and when), including the IP address and browser of the request, for security.
Facebook and Instagram
When an owner or admin connects Facebook & Instagram, Aura receives and stores:
- An access token for the connecting person’s Facebook account, stored encrypted (AES-256-GCM). Page access tokens are not stored; Aura obtains one when it publishes.
- The Facebook user ID, the Facebook Pages that person manages (ID and name) and the Instagram professional account linked to each Page (ID and username).
- Which permissions were granted.
- For posts Aura publishes: the post’s ID and link, and its engagement (reactions, comments, shares). Impressions and reach only if the insights permissions were granted.
Aura uses this only to publish content your business approved, to show whether it was published, and to report its results. It does not read or send direct messages, run ads, or monitor other accounts.
- An access token, stored encrypted, and the permissions granted.
- Your LinkedIn member ID, name, profile picture and email address (from LinkedIn’s sign-in).
- The posts Aura publishes for you and their links.
If you use Aura’s WhatsApp assistant:
- Your phone number, stored encrypted (only its last four digits are kept readable, to show you which number is linked), and your WhatsApp profile name.
- The text of messages between you and Aura’s WhatsApp number, and their delivery status.
- Which Aura account and workspace your number is linked to, and whether you have opted out (by sending STOP).
Other tools you connect
If your business connects Google Analytics, Google Search Console, HubSpot, Mailchimp, Slack or other supported tools, Aura stores the credentials (encrypted) and reads data from them to inform its recommendations.
Payments
Payments are handled by Stripe. Aura stores your plan and subscription status, not your card number.
Technical information
Cookies needed to keep you signed in and to protect sign-ins (for example a short-lived cookie that ties an account connection to the browser that started it), and error reports used to fix problems. Aura does not use advertising cookies [to confirm: no analytics or advertising cookies are added].
3. How we use information
- To provide Aura: build your business context, write and review content, plan campaigns, and publish what you approve.
- To publish to Facebook, Instagram and LinkedIn — only content a person in your business approved, to the accounts your business connected.
- To answer you on WhatsApp, inside the workspace you chose.
- To keep Aura secure: authentication, preventing abuse and keeping a record of actions.
- To send service emails (for example invitations and password resets).
The legal bases for each use (for example contract, legitimate interests or consent) are [to confirm with legal advisers].
4. AI-generated content
Aura uses AI models to write and review content and to create images. To do so it sends the relevant parts of your workspace — for example your business description, brand voice, the brief and earlier drafts — to the AI provider configured for Aura. The text provider is Google (Gemini); depending on configuration, Anthropic, OpenAI, Replicate, Stability AI or Agnes AI may be used for text or images [to confirm: which providers are enabled in production].
AI output can be wrong. Aura checks drafts (a review, compliance and fact checks), but nothing is published until a person in your business approves it. Whether providers may use submitted data to train their models depends on each provider’s terms [to confirm per provider and plan].
6. How long we keep information
- Account and workspace information: while the account is active, and for [to confirm: period after an account is closed] after it is closed.
- WhatsApp message text: deleted automatically after 90 days (the operator may set a different period).
- Access tokens: deleted when you disconnect the account, or when Facebook tells Aura you removed it.
- Sign-in links and codes for WhatsApp: valid for 10 minutes; a linked WhatsApp number stays signed in for 30 days unless you unlink it.
- Records of actions (audit log) and backups: [to confirm: retention periods].
7. Deleting your information
- Disconnect an account in Aura (Facebook & Instagram and other tools under Your tools; LinkedIn under Settings → Connections): its stored tokens are deleted, and Aura asks the platform to withdraw its access.
- Facebook: remove Botella Aura in your Facebook settings (Settings & privacy → Settings → Apps and websites). Aura is notified, deletes the stored token and marks the connection removed. You can also send a data deletion request from there; Aura deletes the Facebook and Instagram connection data and gives you a confirmation code you can check.
- WhatsApp: send STOP to stop messages, or “Log out” to unlink your number.
- Your Aura account or a whole workspace: email [to confirm: privacy contact email]. Self-service account deletion is not yet available in Aura.
See Data deletion for step-by-step instructions. The time within which requests are completed is [to confirm].
8. Security
Access tokens, API keys and WhatsApp numbers are encrypted at rest (AES-256-GCM); passwords are stored as one-way hashes; each workspace’s data is separated from every other’s and access depends on your role; sign-ins to connected platforms are protected against forgery. No system is perfectly secure.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your information, to object to or restrict some uses, and to complain to a data protection authority. To use these rights, contact [to confirm: privacy contact email]. Which laws apply (for example GDPR, UK GDPR or US state laws) is [to confirm with legal advisers].
10. Children
Aura is a business tool and is not intended for anyone under [to confirm: minimum age].
11. Changes and contact
If this policy changes, the new version will be posted here with its effective date [to confirm: how users are notified]. Questions: [to confirm: privacy contact email].