Privacy Policy

Who we are and what this covers

Aurathex is based in College Station / Bryan, Texas and provides websites, search systems, e-commerce, and AI workflow automation. Aurathex Labs develops Ava, a desktop AI assistant and operator. This policy covers the Aurathex website, inquiries, Ava, and Ava’s connected third-party services, including Google services. Contact support@aurathex.com with privacy questions.

Information you provide

Our contact form collects your name, email, optional phone and business name, selected service, and message. We use these details to respond, assess projects and beta applications, and manage related correspondence. Please do not send passwords, API keys, payment details or sensitive personal information. Applying for beta access does not guarantee acceptance.

Website and analytics information

Our hosting provider, Cloudflare, processes technical request information, such as IP address and browser details, to deliver and protect the site. If you accept analytics, Google Analytics processes browsing events and device information using identifiers such as analytics cookies. We do not intentionally send contact-form contents to Analytics. Our initial page-view configuration omits URL queries and fragments.

Cookies and your choice

Optional Google Analytics is blocked until you accept it. Rejecting optional cookies does not prevent browsing or contacting us. We store your choice in this browser for up to 180 days. Use Cookie settings in the footer to change it. Withdrawal stops future analytics collection and removes accessible Google Analytics cookies from this site; it cannot undo information already processed. Read our Cookie Policy.

Ava and connected services

Ava can connect with third-party services only after a user chooses to connect them and authorizes access. Ava uses connected-service data only to provide features the user requests. When a user asks Ava to perform a task involving connected-service data, relevant information may be processed by the AI or model provider configured for that Ava session solely to fulfill that request. Ava does not sell connected-service data or use it for advertising or ad profiling.

Ava and Google Account Data

Ava requests Google Account access only when a user chooses to connect Google. Ava requests userinfo.email and userinfo.profile to identify the connected Google account and show the connection correctly.

Google Calendar

Ava requests calendar.events to show upcoming calendar events and answer scheduling questions. Only when requested or authorized by the user, Ava can create events, update or reschedule events, and delete or cancel events.

Google Drive

Ava requests the narrow drive.file permission. It can access Google Drive files created, selected, or used with Ava. Ava does not request unrestricted access to a user’s entire Google Drive.

Google data retention and deletion

Ava retrieves Calendar event data and Drive file data when needed for a user-requested operation. Its Google Calendar and Drive integrations do not create a separate persistent Calendar-event database, Drive-file cache, or local copy of Drive file contents. However, when Google data is needed to answer a request, a formatted tool result or Ava response containing that data can be saved in Ava’s local conversation transcript. Tool results are limited in size when stored, but conversations do not have an automatic deletion deadline: they remain on the user’s device until the user deletes the conversation. Ava may also save a derived fact from a conversation in its local long-term memory; users can delete those memory entries in Ava’s Memory view. Deleting a conversation or memory entry removes it from Ava’s local SQLite system of record. If an optional local semantic-memory index is configured, it may retain a stale local mirror that Ava excludes from future results; Ava does not use that index as its system of record.

OAuth access and refresh tokens, together with connection metadata such as granted scopes and connected-account email, remain locally stored while the Google connection remains active. Disconnecting Google makes a revocation request to Google and removes Ava’s local token record even if Google does not confirm revocation. Revoking Ava through Google Account permissions stops Google authorization; users should also disconnect Google in Ava to remove its local token record. Users can delete relevant chats and memory entries in Ava, disconnect Google, and email support@aurathex.com for deletion guidance or help identifying Ava data associated with their Google connection. Uninstalling Ava does not automatically delete local conversations or memory.

Google data security

Ava communicates with Google API endpoints over HTTPS/TLS. Google authorization uses OAuth with PKCE and state validation. OAuth credentials are stored locally in the operating system credential store where available; on Windows, Ava falls back to an encrypted DPAPI-protected local file if that store is unavailable. Ava does not write OAuth credentials in plaintext. Other retained conversation and memory records are stored in Ava’s local app-data directory on the user’s device. Ava does not represent that local database as encrypted by Ava; access to it depends on the protections of the user’s operating-system account and device. Ava limits Google access to user-authorized connection functionality and the scopes described above.

Google data sharing and AI/ML use

Ava sends Google data to Google only to use authorized Google APIs. When a user asks Ava to perform a feature involving connected Google data, relevant content may be sent to the AI or model provider configured for that Ava session only as needed to perform that user-requested feature. Aurathex and Ava do not sell Google user data, use it for advertising or ad profiling, or use information obtained from Google Workspace APIs to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models. Aurathex does not make claims here about a separately configured third-party model provider’s retention or training practices; users should review that provider’s terms and privacy information.

Google API Services Limited Use

Ava’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Service providers and disclosures

Cloudflare delivers and protects this website. Web3Forms processes contact submissions and delivers them to our email; our email provider also processes correspondence. Google processes analytics when you opt in. Google Fonts delivers the site typeface and receives connection information when it is requested, independently of analytics consent. For Ava, Google and any AI or model provider configured for the Ava session may process data needed to provide a requested connected-service feature. Providers may process data outside your country. See Cloudflare’s notice, Web3Forms’ policy, and Google’s policy. Information may also be disclosed when required by law or necessary to protect rights and security. We do not sell contact-form information or Google user data.

Retention and security

We keep inquiries and project correspondence as needed to respond, maintain the relationship and meet applicable obligations. Ava-specific Google data retention, deletion, and security practices are described above. Provider retention depends on the service and account configuration. We do not promise a specific deletion period that has not been confirmed. We use HTTPS and reasonable access controls, but no online service can guarantee absolute security.

Your privacy rights

Depending on your location and applicable law, you may be able to request access, correction, deletion, a copy of your information, or restrictions on processing, and withdraw consent or object to certain uses. Email support@aurathex.com to make a request. We may verify your identity and may need to retain information for legal or legitimate operational reasons. You may also contact your local data protection authority. Where a legal basis is required, we rely on consent for optional analytics, steps toward a requested agreement for project inquiries, and legitimate interests or legal obligations for essential operations.

Children and updates

This website and Ava are intended for business users and adults. Please contact us if you believe a child has submitted personal information. We may update this notice as our practices change; the date above identifies this version.