Privacy Policy

1. Roles and scope

AuraLeads is responsible for account, website, billing and support data. For personal data about leads that a customer uploads to the CRM, the customer determines why and how it is used and AuraLeads acts as its service provider or processor. Customers must provide their own notices and lawful basis for that data.

Appointment-setting services are governed by a separate agreement and may include additional privacy instructions.

2. Data we process

• Account data: name, email, language, avatar, authentication identifiers and workspace membership.
• Customer content: leads, contact details, profile links, notes, tasks, reminders, pipelines, forms and team activity entered by users.
• Billing data: plan, subscription status, PayPal customer and transaction references, renewal and cancellation dates. We do not receive or store full card credentials.
• Support data: category, subject, description, attachments or diagnostics you choose to send and our correspondence.
• Technical data: device and platform details, IP and security logs held by our infrastructure providers, error reports and essential session or preference data.
• Website contact data: the details you submit through a contact form or email.

3. Why we use data

• Provide authentication, workspaces, CRM features, subscriptions, support and transactional notices.
• Secure accounts, prevent abuse, diagnose failures and maintain the service.
• Comply with accounting, tax, consumer, fraud-prevention and other legal duties.
• Improve product usability using operational feedback and aggregated information. We do not sell personal data or use customer lead data for advertising.

4. Legal grounds and choices

Depending on the context, processing is necessary to perform our contract, comply with law, protect legitimate security and operational interests, or is based on consent. You may withdraw consent where it is the basis, without affecting earlier lawful processing.

Transactional account and billing notices are part of the service. Marketing messages, if introduced, will have a separate opt-out and will not be required to use the CRM.

5. Sharing and international processing

We share only what is necessary with the providers listed on the Subprocessors page, professional advisers, authorities when legally required, or a successor in a legitimate business transaction. Providers may process data outside Costa Rica under their contractual safeguards and applicable law.

We do not sell or rent personal data.

6. Retention and deletion

Account and customer content are kept while the account is active and for the limited period needed to complete a requested deletion, resolve disputes or meet legal duties. Residual encrypted backups follow provider rotation schedules and are not used for ordinary business purposes.

Billing and tax records are retained for legally required periods. Security and support records are kept only as long as reasonably necessary for fraud prevention, troubleshooting, claims and service history. We will publish material changes if these practices change.

7. Security

We use access controls, row-level database policies, encrypted transport, managed authentication, backups and restricted administrative credentials. No system can guarantee absolute security. Please use a unique password and notify support immediately if you suspect compromise.

8. Your rights

Subject to applicable law, you may request access, correction, deletion, portability where available, restriction or objection, and information about processing. Workspace administrators should first handle requests concerning leads they control; AuraLeads will assist them as required.

Send requests to privacy@getauraleads.com. We may verify identity before acting. You may also complain to the competent Costa Rican data protection authority.

9. Children and changes

AuraLeads is not directed to people under 18. We may update this Policy and will give appropriate notice of material changes. The Spanish version controls if translations conflict.