Privacy Policy

Last updated 5 November 2026 · Extended enterprise edition · Operated by AuR AI (“AunuCore”, “we”, “us”), Indonesia. Privacy contact: dwia20353@gmail.com · Telegram @AunuHostv.

Definitions

• “Service” — the AunuCore website, dashboards and APIs at ai.aunuhost.bond, including the AI gateway and the REST API toolkit.
• “Account data” — the account record, key material and settings tied to your AunuCore account.
• “Usage data” — request metadata (timestamp, model, endpoint, token counts, latency, status). It never includes prompt or output bodies.
• “Content” — prompts, files and other material you send through the API, and the output returned to you.
• “Sub-processor” — a third party we engage to process data on our behalf, listed in Section 13.

1. Who we are

AunuCore is operated by AuR AI, the data controller for the account and usage data described below. For content you send through the API, you are the controller and we act as your processor.

2. What we collect

We do not use advertising cookies or third-party trackers. Your browser stores your key and cached profile locally so the dashboard works; clearing site data removes them.

3. Data we receive from Google (Google Sign-In)

AunuCore uses Google Sign-In (Google OAuth 2.0) as the sign-in method for the dashboard at ai.aunuhost.bond. When you choose “Continue with Google”, Google asks for your consent and — only after you approve — shares the following information with us, under the scopes openid, email and profile:

• Your Google account ID (a unique identifier, the sub claim) — used as the stable key of your AunuCore account, so that one Google identity maps to exactly one account.
• Your email address and whether Google has verified it — used to identify your account, to link a pre-existing AunuCore account registered under the same verified address, and to contact you about your account.
• Your name and profile picture URL — shown in your dashboard profile.

How we use Google user data. We use the data listed above only to create your account, sign you in, keep your account secure (including abuse prevention), display your profile in the dashboard, and provide customer support. In particular:

• We do not sell Google user data to anyone.
• We do not use Google user data for advertising, and we do not share it with advertisers or data brokers.
• We do not use Google user data to train, develop or improve machine-learning or artificial-intelligence models.
• We do not share Google user data with AI model providers. It is processed only by our authentication and account infrastructure and is never included in API requests.
• We do not request access to your Gmail, Google Drive, contacts, calendars or any other Google product data, and we never receive or store your Google password.

Limited Use. AunuCore’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Storage, protection and retention. Google sign-in data is stored in our account database on Cloudflare infrastructure, encrypted in transit (TLS) and at rest by our provider. Access is restricted to what is needed to operate the Service and privileged actions are recorded in an audit log. We keep this data for as long as your account exists. If you delete your account (see Section 9), your Google sign-in data is erased within 30 days, except for limited records we must retain to comply with legal obligations.

Revoking access. You may revoke AunuCore’s access to your Google account at any time on your Google Account’s third-party access page. Revoking access does not by itself delete your AunuCore account; contact us to have the account and its data deleted.

4. Prompt content

Prompts and completions pass through the Service in memory and are forwarded to the selected model provider. We do not write message bodies to storage. Only metadata such as token counts, model, latency and status is recorded.

5. Legal bases

• Contract — issuing keys, metering usage, providing dashboards.
• Legitimate interests — security, abuse prevention, capacity planning, aggregate analytics.
• Legal obligation — tax, accounting and lawful requests.
• Consent — support requests (you tick the consent box on the form; the platform rejects requests without it), optional communications, withdrawable at any time.

6. Sharing

• Cloud infrastructure providers — edge hosting, compute and storage used to run the Service.
• Model providers (for example OpenAI, Anthropic, Google, Meta) process prompt content to generate output. Requests may be routed to whichever independent inference route currently serves your chosen model.
• Email delivery provider — support tickets are relayed to our support inbox through a transactional email service; the ticket content and your reply-to address are processed solely to answer your request.
• Your webhook endpoints — when you register webhooks, event payloads are delivered to URLs you control. You are the controller of any data your endpoints receive.

Google sign-in data (Section 3) is never shared with model providers, advertisers or data brokers; it stays within our authentication and account infrastructure. We do not sell personal data and do not share it for cross-context behavioural advertising. Disclosure to authorities occurs only where legally required, and we resist overbroad demands where lawful.

7. International transfers

Because the Service runs on a global edge network, data may be processed outside Indonesia, including in the United States and the European Union. Transfers rely on the safeguards offered by our providers, including standard contractual clauses where applicable.

8. Security

• TLS everywhere; no plaintext endpoints.
• API keys are stored as salted hashes, never in plain text.
• Prompt and completion bodies are never persisted — only usage metadata is kept.
• Administrative access is restricted and every privileged action is written to an audit log.
• Rate limiting on authentication attempts and least-privilege access to data stores.

No system is perfectly secure. If we discover a breach affecting your data, we will notify affected accounts and, where required, regulators without undue delay.

9. Your rights

Subject to applicable law you may request access, correction, deletion, export, restriction of processing, or object to processing based on legitimate interests. Contact us via the support page or at dwia20353@gmail.com; we respond within 30 days and may ask you to verify control of your key or registered email. To delete your account and all associated data — including the data received from Google — email dwia20353@gmail.com from your account address or contact support; verified deletion requests are completed within 30 days and confirmed by email. You can also disconnect AunuCore from your Google account at any time as described in Section 3. You may also lodge a complaint with your local data protection authority.

10. Children

The Service is not directed to children under 13, or the higher local minimum age. We do not knowingly collect their data; contact us for removal if you believe we have.

11. Changes

Material changes are announced on this page and by email where we hold your address, at least 14 days before taking effect. The “last updated” date above reflects the current version.

12. Contact us

AunuCore is operated by AuR AI (AunuCore Creative Network), Indonesia. For privacy questions and for access, correction or deletion requests, contact us at dwia20353@gmail.com, via Telegram @AunuHostv, or through the support page. We respond within 30 days.

13. Sub-processors

We engage a small set of sub-processors, each bound to process data only on our instructions. The current categories are:

Enterprise customers may request notice of sub-processor changes by emailing dwia20353@gmail.com. Material changes to this list are also reflected on this page before they take effect.

14. Cookies and browser storage

We do not use advertising cookies, analytics beacons or third-party trackers. The Service uses only strictly-necessary browser storage: your session/API key and cached profile (so the dashboard works), your theme and language preferences, and short-lived anti-abuse tokens from our edge gate. Clearing site data in your browser removes all of it. Because none of this storage is used for advertising or cross-site tracking, we do not present a cookie-consent banner.

15. Enterprise data-processing terms

• Roles. For account and usage data we are the controller; for Content you send through the API you are the controller and we are your processor (Section 1).
• Processing on instructions. As processor we process Content only to provide the Service, enforce the Terms, and comply with law.
• Confidentiality. Personnel with access to account data are bound by confidentiality duties, and privileged actions are written to an audit log.
• Assistance. We will reasonably assist enterprise customers with data-subject requests and security enquiries that concern data we hold for them, via dwia20353@gmail.com.
• Data-processing addendum. Enterprise customers who require a signed data-processing addendum (DPA) may request one at dwia20353@gmail.com or via Telegram @AunuHostv. The commitments in this policy form the baseline of any such addendum.
• Return and deletion. On termination, account data is deleted on the schedule in Sections 2 and 9 (account life + 30 days; verified deletion requests completed within 30 days).

16. Exercising your rights — process

To exercise any right in Section 9: (1) email dwia20353@gmail.com from your account address, or open a ticket on the support page stating the right you are exercising; (2) we verify control of the account (registered email or key) to protect you from impersonation; (3) we respond within 30 days, and sooner where the law requires it. Export requests are fulfilled as a machine-readable copy of your account record and usage metadata — prompt and output bodies cannot be exported because we never store them.

17. Regional notices

• Indonesia. We process personal data in line with Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP). Indonesian users hold the rights described in Section 9 under that law.
• European Economic Area / UK. Our legal bases are set out in Section 5 and transfers rely on the safeguards in Section 7. You may complain to your local supervisory authority (Section 9).
• California. We do not sell personal information and do not share it for cross-context behavioural advertising (Section 6).

18. Data processed through agents and bots

This section applies when an account holder (an “Operator”, as defined in Section 20 of the Terms) uses the API to power an automated agent or bot that interacts with people (“End Users”) on a third-party platform such as Telegram, Discord or WhatsApp. It supplements Sections 1, 4, 6, 7, 9, 13, 15 and 16.

Roles. For the personal data of End Users that an Operator sends us through its agent, the Operator is the controller and we are the Operator’s processor, acting only on the Operator’s instructions — the same arrangement as Section 15. We remain the controller of the Operator’s own account and usage data. We have no direct relationship with End Users and we do not contact them.

What transits the Service. We receive only what the Operator’s agent sends to the endpoint:

• the content of End User messages that the agent forwards to us for a reply;
• metadata the agent includes, such as the platform name and the chat or user identifiers used on that platform, where the Operator chooses to send them;
• media attachments — images, audio or files — where the Operator sends them to a vision- or audio-capable model;
• the Operator’s own prompts, system instructions and tool results.

We do not connect to the Operator’s platform accounts, do not read chats directly from Telegram, Discord or WhatsApp, and do not request or pull data from those platforms. If it did not pass through the Operator’s agent to our endpoint, we never see it.

Limited purposes. Agent traffic is processed for the same limited purposes as all Content: relaying it to the selected model and returning the response, plus metering, security and abuse prevention on the Operator’s account. We do not sell this data, do not use it for advertising, and do not use it to train models (Sections 3 and 6).

Retention.

• Message content is relayed in memory and is not stored by us (Section 4), beyond the transient operational handling needed to complete the request.
• Usage data — timestamp, model, endpoint, token counts, latency and status — is retained on the schedule in Section 2 for quota, billing and security. It is tied to the Operator’s account, not to End User identities.
• Where content exceptionally appears outside the relay — for example in a support ticket the Operator sends us, or in security logs — it is deleted on the schedules in Section 2, and verified deletion requests are completed within 30 days (Sections 9 and 16).
• Chat history held by the Operator’s own bot backend, or on the platform itself, sits outside our systems; its retention is the Operator’s responsibility.

End User requests. End Users should send access, correction and deletion requests to the Operator of the agent they interacted with, who is their controller. Operators must handle those requests and may forward any part that concerns data we process to dwia20353@gmail.com or the support page; we then follow the process and the 30-day response commitment in Section 16. Because message content is not stored, in most cases there is no End User content for us to export or erase — the records we hold are the Operator’s usage metadata described above.

Operator duties. The Operator must hold a lawful basis for sending End User data to us, must give its End Users its own privacy notice disclosing that their messages are processed by an AI service (AunuCore) and by model providers, and must not send us data it has no right to share. If we receive a complaint about an agent, we may ask the Operator for evidence of its lawful basis and of the notice it gives, and may suspend processing for that agent until the matter is resolved (Terms, Section 20).

Sharing, transfers and security. Model providers and infrastructure sub-processors handle agent traffic exactly as described in Sections 6, 7 and 13. The security measures in Section 8 and on the security overview — including the additional requirements for agent and bot deployments set out there — apply in full.

Questions? Reach us on the support page. See also our Terms of Service and security overview.