Privacy Policy

Aury is a business tool for merchants. This policy covers merchants who create an Aury account. Shoppers who buy from a store built on Aury are covered by that merchant's own privacy policy; we process their data on the merchant's behalf.

Account data. Email address and authentication details, so you can sign in and we can reach you about your account.

Store data. Everything you create or import: products, descriptions, images, prices, inventory, collections, pages, orders and customer records belonging to your store.

Connected service credentials. API keys and access tokens you give us for payment processors, analytics, advertising and commerce platforms. These are encrypted at rest and used only to perform the actions you ask for.

Usage data. Standard server logs - IP address, timestamps, pages requested - retained for security and debugging.

When you connect Google Analytics, Google asks you to approve specific permissions. We request:

• https://www.googleapis.com/auth/analytics.readonly
  to read your Google Analytics traffic and conversion figures and display them in your Aury dashboard.
• openid / userinfo.email
  to identify the Google account you connected so the right Analytics property stays linked to your store.

Note for maintainers: this list must match MERCHANT_SCOPES in agentos/analytics_ga.py exactly.

We use Google user data only to:

1. List the Google Analytics properties your account can access, so you can choose which one this store reports on.
2. Read metrics from the property you chose and show them in your Aury console.

We do not use Google user data for advertising, sell or rent it, transfer it to third parties except as described below, or use it to train generalized artificial intelligence or machine learning models.

How it is stored. We store the refresh token Google issues, encrypted at rest. Analytics figures are fetched on demand and cached only briefly to keep the dashboard responsive.

How to revoke. Disconnect Google Analytics in your Aury console at any time, which deletes the stored token. You may also revoke access directly at myaccount.google.com/permissions.

Aury's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

If you migrate a store from Shopify, you approve a read-only connection. We read your products, content and inventory once in order to rebuild your catalogue on Aury. We never write to, modify, unpublish or delete anything in your Shopify store. The access token is discarded and revoked as soon as the import finishes, whether it succeeded or failed. We do not request access to your Shopify orders or customers.

We use these processors, each limited to its stated function:

We do not sell personal data. We disclose data otherwise only where legally compelled, and will tell you unless prohibited.

Account and store data is kept while your account is active. On deletion we remove it within 30 days, except where law requires us to keep records longer. Connected-service tokens are deleted as soon as you disconnect.

Depending on where you live you may request access to, correction of, export of, or deletion of your personal data, and may object to or restrict processing. Write to dhruvkumar9115@gmail.com and we will respond within 30 days.

Data is encrypted in transit and credentials are encrypted at rest. Access to production systems is restricted. No system is perfectly secure; we will notify you and any required regulator of a breach affecting your data without undue delay.

Aury is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.

We will post any change here and update the date above. Material changes will be emailed to account holders before taking effect.