Privacy Policy

Information you give us

When you create an account we store your name, email address and a hashed password. If you are invited to an organisation, we store which organisation you belong to and your role in it.

We store the content you create in Aura Social: draft and published posts, captions, scheduled times, uploaded media, and saved replies.

Information from connected social accounts

When you connect a Facebook Page or Instagram professional account, Meta gives us an access token for that account. We store it so we can act on your behalf, and we use it only for the features described here.

When you connect a TikTok account, TikTok gives us an access token and a refresh token, which we store for the same purpose. From TikTok we receive your account's display name, username and profile picture, so you can tell which account you are posting to. We do not receive your TikTok password.

Publishing: we send the posts and comments you create in Aura Social to the accounts you connected. For TikTok this means we upload the video you selected and the caption, audience and interaction settings you chose in Aura Social.

Removing posts: when you delete a post in Aura Social that has already been published, we also remove it from the Facebook Page or Instagram account it was posted to.

Moderating comments: when you hide, unhide or delete a comment in the Aura Social inbox, we make the same change on the Facebook Page or Instagram account where it was posted.

Your TikTok posts: we retrieve the videos already published on your connected TikTok account — their descriptions, cover images, links and view, like, comment and share counts — so your published work appears alongside what you have scheduled.

Inbox: we retrieve Messenger and Instagram conversations, message content, comments on your posts, and the names and profile pictures of the people who wrote them, so you can read and answer them in one place.

Analytics: we retrieve performance insights for your accounts and for the posts published through them, such as reach, views and engagement.

Competitors: if you choose to follow other businesses' Instagram accounts, we use your connected Instagram account to read their public profile and recent posts through Instagram's official Business Discovery feature: name, username, profile picture, follower count, and each post's caption, link, date and like and comment counts. Instagram offers this only for business and creator accounts, never for personal ones. We store it for your organisation alone, so you can compare your account with theirs. We do not download their photos or videos unless you choose Create a post, choose to use them and confirm you have the owner's permission, which copies that post's photos and videos into your Media library and records who in your organisation confirmed it, and when. Choosing to use a post's caption puts it into your new post and records the same confirmation.

We request only the permissions these features need. We do not read your personal Facebook profile, your friends, your private messages as a consumer, or anything belonging to accounts you have not connected, other than the public business information described under Competitors. On TikTok we do not read your For You feed, the accounts you follow, or your direct messages.

How we use it

To provide the features above, to keep your account secure, and to diagnose faults.

Competitors' assistant features — finding competitors, What's working and the caption Create a post writes — send your business description and the public Instagram information of the accounts involved to the AI model provider that powers Aura's assistant. Finding competitors also has that provider search the public web for businesses like yours.

We do not sell your data. We do not share platform data with third parties for their own purposes. We do not use your content or your customers' messages to train machine-learning models.

Who can see it

Members of your organisation in Aura Social can see that organisation's content, connected accounts and conversations, according to their role.

We use service providers to run the product — hosting, storage and email delivery. They process data on our instructions and may not use it for their own purposes.

We may disclose data if the law requires it.

Your public link-in-bio page

If you create a link-in-bio page and publish it, that page is public: anyone who knows its address can open it, without signing in and without being a member of your organisation. It shows the heading, description, picture and links you put on it. Unpublish it at any time from Settings, and the address stops serving it immediately.

We count how many times each link on that page is tapped. The count is a daily total per link and nothing else. We do not store anything that identifies a visitor: no IP address, no cookie, no device or browser identifier, no per-visitor row, and no record of the order one person tapped things in. A tap adds one to a number, and that number is all that is kept.

How long we keep it

We keep your account and content while your account is open.

Disconnecting a social account stops all further collection from it immediately and deletes the stored access token for that account.

When data is deleted it is removed from our live systems promptly and from backups as those backups age out.

Deleting your data

You can disconnect any social account at any time from the Accounts screen, and you can ask us to delete your Aura Social account entirely.

Disconnecting an account permanently deletes the inbox it brought with it: the conversations and messages retrieved from that account, along with any drafts, follow-ups and automatic replies belonging to them. This cannot be undone, and reconnecting the account does not bring them back. Your posts, campaigns, analytics, product catalogue and saved replies are not affected.

A sale you record from a conversation keeps the customer's name or number only while that conversation is stored. When disconnecting an account deletes the conversation, the sale forgets the customer and the link to the conversation, and keeps what was sold, for how much and on which day, because those are your own records.

Removing an account from Competitors permanently deletes the follower history and posts we stored for it. Photos and videos you copied with Create a post stay in your Media library until you delete them there, and the record of who confirmed permission is kept.

You can also request deletion through Facebook or Instagram. When you remove Aura Social from your Facebook settings, Meta notifies us and we delete the data associated with that account; we give you a confirmation code and a status page where you can check the request. For TikTok, revoke Aura Social's access in the TikTok app under Settings and privacy, then Security and permissions, then Manage app permissions — and disconnect the account in Aura Social to delete the data we hold for it. To ask us directly, email aomarab@outlook.com.

Your rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Write to aomarab@outlook.com and we will respond.

Security

Traffic is encrypted in transit. Access tokens and passwords are stored so that they cannot be read back from our database. Access to production systems is limited to people who need it.

Changes

If we change this policy materially we will update the date at the top of this page and, where the change affects you, tell you in the product.

Contact

Zaina Omar for Online Selling, a Sole Establishment licensed in Dubai, United Arab Emirates under commercial licence no. 1596159.

For any privacy question or request: aomarab@outlook.com.