Aunory Privacy Policy

Who we are, and what this covers

Aunory is a data-analysis product for small businesses. You upload a spreadsheet or connect your gym management system, and Aunory reads it and tells you what it thinks is happening in your business.

This policy covers what we do with two different things, and the distinction matters throughout:

• Your account data — the details you give us to have an Aunory account.
• Your business data — the file you upload or the records we sync, which are about other people: your members, your customers, your leads. You are responsible for having the right to give us that data; we are responsible for what we do with it once you have.

What we collect

Account data. Your email address and password (held by our authentication provider, never by us in readable form), your business name, industry and website if you give them, your plan and subscription status, your billing customer id, and your preferences — briefing schedule, alert settings, sync frequency, and the business-model answers you confirm during setup.

Business data you upload. Whatever is in the file. In practice, for the gyms we work with, that means member names, membership plans, fees, payment status, attendance and join dates. The format is free-form CSV, XLSX or PDF, so nothing stops a file containing email addresses or phone numbers, and we treat the contents as if it does.

Business data we sync. If you connect Zen Planner, we pull people, memberships, classes, locations, attendance, membership types, groups, programs and events. For people, that includes first and last name, display name, email address, phone number, staff and household flags, attendance counts and dates. Three fields are dropped at the point of ingestion and never stored: profile photo URL, gender, and date of birth.

We do not pull payment or transaction records. There is no ingestion of invoices, charges or payment history — Zen Planner's financial endpoints are deliberately not called. The only price information we hold is what a membership type costs.

If you visit without an account. You can ask a limited number of questions without signing up. We record a session identifier you send us, a salted hash of your IP address, and timestamps — kept for 24 hours and then deleted. We store the hash rather than the address so that a copy of that table is not a list of visitors' addresses. We will not pretend the hash is strong protection: the address space is small enough that a determined party who knew our salt could reverse it.

What we do not collect. There is no third-party analytics on our site — no Google Analytics, no tracking pixel, no advertising SDK. The only telemetry is error reporting (below) and a first-party record of which product-tour steps you have completed.

Why we use it

To run the analysis you asked for; to send you the briefings and alerts you turned on; to bill you; to keep your account secure; and to answer you when you contact support.

We do not sell your data. We do not use it to advertise to you, and we do not use it to train AI models — see "What happens with AI" below.

Who else touches it

Being straight about this is the point of the section. Running Aunory means sending some of your data to other companies, and "we never share it" is not an accurate description of a product that calls an AI API.

The full list, with what each one actually receives, is in Subprocessors. The three that matter most to you:

• Anthropic (Claude) receives business data in order to analyse it — including, for some features, a sample of raw rows from your file and, for PDF uploads, the whole document. Anthropic's API terms state that inputs and outputs are not used to train their models.
• SendGrid receives your email address to deliver mail, and alert emails can contain a member's name in the subject or body.
• Zen Planner / Daxko is where synced data comes from, and where notes go back if you approve them. Writing anything back to your system requires your explicit consent first.

How long we keep it

An honesty note on retention. Our failed-login table is written with a 15-minute expiry and nothing currently deletes those rows, so in practice they persist. They contain hashed email addresses and hashed IP addresses, no names and no content. We have not fixed it yet; we will. We would rather state it than publish a retention table that is wrong.

Retention sweeps run on our application server rather than on an independent schedule, so if that server is down, deletion waits until it is back.

Deleting your account

You can delete your account and everything in it. Doing so removes your uploaded files (from both our disk and our storage provider), every row of your account and business data, and your login identity. You get back a receipt with an id and a per-table record of what was removed.

Where to do it. Settings, at the bottom of the page. It asks you to confirm, and the deletion runs straight away.

What deletion cannot reach, stated plainly because every provider has limits:

• Backups. Our database provider keeps backups; deleted rows can persist in them until the backup window rolls over. Selective deletion from a historical backup is not available to us.
• Server logs. Future logs redact contact details. Historical logs at our hosting provider expire on their schedule and would need a provider-level purge.
• AI requests already processed. There is no per-request delete operation. We stop sending immediately; Anthropic documents automatic deletion of standard API inputs and outputs within 30 days, subject to their own exceptions.
• Email delivery records at SendGrid, and payment records at Stripe, which both retain data for their own legal and accounting obligations. We delete the customer object; we cannot delete a tax record.
• One audit log of ours. If a member of our staff has ever opened your account for support, that access record survives deletion. It holds who looked and when, keyed by your account id — no name, no email, no content. We keep it because letting the subject of an access review erase the evidence of it would defeat the purpose of having one. Basis: audit, and the establishment or defence of legal claims.

Staff access to your account

Our staff can open a read-only view of an account to answer a support question. It does not let anyone act as you, and every access is logged. See the note above about that log surviving deletion.

Security

Uploaded files are encrypted before they are written anywhere, in a form where a breach of the storage bucket yields unreadable bytes. Connector credentials and drafted outreach messages are encrypted at rest in individual database columns. Access between tenants is enforced at the database level, and we test it against a live environment on every change.

If you want a candid account of what is verified and what is not — including the places our own coverage has gaps — ask us and we will tell you. We would rather do that than write a paragraph of reassurance.

Your rights

Depending on where you are, you may have rights to access, correct, export or delete your data, and to object to some processing. Deletion is described above. Export is not currently available — the endpoint exists but is switched off pending a security review of what it exposes. Until it is back on, ask us and we will do it by hand.

Changes, and how to reach us

We will update this page when what we do changes, and the date at the top is the honest one. Questions, deletion requests, or anything else: contact us at the address on aunory.com.