Privacy Policy

We collect the following categories of information when you use Aturno:

• Account information: your name, email address, and profile data provided when you register.
• Usage data: queries you submit, chat history, research results, and documents you upload to the Drive.
• Billing information: payment details processed by Stripe. We never store card numbers on our servers.
• Technical data: IP address, browser type, device identifiers, and session data used for security and performance purposes.
• Uploaded documents: files you add to your Drive are stored in encrypted form and accessible only to you.

We use your data exclusively for the following purposes:

• We do not use your queries, documents, or chat history to train any AI models. This prohibition is contractually binding on all model providers we work with.
• To provide, operate, and improve the Aturno platform.
• To authenticate your identity and maintain your account.
• To process payments and manage your subscription.
• To send transactional communications such as account confirmations and billing receipts.
• To ensure the security and integrity of your account and our systems.

We process your personal data on the following legal grounds under Article 6 GDPR:

• Art. 6(1)(b), Contract performance: processing necessary to deliver the services you subscribed to.
• Art. 6(1)(c), Legal obligation: compliance with Czech accounting, tax, and applicable regulatory law.
• Art. 6(1)(f), Legitimate interests: security monitoring and fraud prevention, and measuring how signed-in users use the product (which features, how often, whether a request completed) so we know what to improve. Never the contents of your documents or your questions. This measurement stores nothing in your browser. You can object at any time in the application under Settings > Privacy, after which nothing further is sent.
• Art. 6(1)(a), Consent: analytics cookies and session replay, advertising measurement, and marketing communications where you expressly opt in.

We take security seriously. Here is how your data is protected:

• Files stored on Cloudflare R2 are encrypted at rest using AES-256. All data in transit is protected with TLS 1.2 minimum. Access is restricted to authenticated requests only.
• Chat history and account data is stored in a serverless database (Convex, EU region) with encrypted connections and role-based access controls.
• Document storage and our database run in EU regions. Some providers, including our AI model provider, process data in the United States under EU Standard Contractual Clauses; see the subprocessor list on our GDPR page.
• We maintain audit logs, conduct regular access reviews, and follow responsible disclosure practices for security vulnerabilities.
• In the event of a personal data breach, we will notify the Czech Office for Personal Data Protection (ÚOOÚ) within 72 hours of becoming aware. Affected users will be notified without undue delay.

Aturno relies on a small set of trusted third-party providers. Each is bound by a data processing agreement (DPA) consistent with GDPR:

• WorkOS: user authentication and identity management.
• Convex: serverless database and backend, EU region (chat history and account data).
• Cloudflare R2: encrypted file storage for your Drive documents.
• Stripe: payment processing. Stripe is PCI-DSS Level 1 certified.
• OpenAI Ireland Ltd: AI model provider under an executed Data Processing Addendum. Contractually prohibited from training on your data; US processing is covered by EU Standard Contractual Clauses. Under OpenAI's standard API policy, inputs and outputs are retained for up to 30 days solely for abuse monitoring and then deleted; EU data residency and zero data retention have been requested.
• LanceDB: vector search over the public legal corpus. Perplexity: web search, only when you enable web search mode.
• Vercel: frontend hosting, edge delivery, and optional performance analytics.
• PostHog and Google Ads: product usage measurement of signed-in users, and, according to your cookie choices, analytics cookies, session replay, campaign attribution and advertising conversion measurement. PostHog data stays in the EU.

As a data subject under GDPR, you have the following rights, exercisable free of charge:

• Right of access (Art. 15): request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): correct any inaccurate or incomplete data.
• Right to erasure (Art. 17): request deletion of your data where there is no compelling reason for continued processing.
• Right to restriction (Art. 18): ask us to restrict processing of your data in certain circumstances.
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests.
• Right to lodge a complaint (Art. 77): you may contact the Czech Office for Personal Data Protection (ÚOOÚ, www.uoou.cz) at any time.

To exercise any of these rights, email us at privacy@aturno.ai. We will respond within 30 days.

We retain your data only as long as necessary:

• Account data is permanently deleted within 30 days of account closure.
• Chat history is retained while your account is active. You can delete individual threads at any time from the interface.
• Uploaded documents are deleted from our servers within 30 days of you removing them from your Drive.
• Billing records are retained for 7 years as required by Czech accounting and tax law.