Privacy Policy

1Introduction and Data Controller

This Privacy Policy describes how VuraOs LLC ("VURAOS", "we", "us", or "our"), with offices at 1309 Coffeen Avenue, STE 1200, Sheridan, WY 82801, United States, collects, uses, stores, and protects the personal information of Users who access our platform and services (the "Service").

VURAOS acts as the data controller for the personal data of its Users. For data that the User manages through the Service regarding their own customers, the User acts as the controller and VURAOS as the data processor, under the terms detailed below.

By using the Service, the User accepts the practices described in this Policy. If you do not agree, you must refrain from using the Service.

2Information We Collect

We collect information from different sources and in different contexts:

• Account information: first name, last name, email address, company name, position, and password (stored in encrypted format).
• Billing information: payment method data, transaction history, and billing address. Card data is processed directly by our certified payment providers and VURAOS does not store complete card numbers.
• Usage data: features used, access frequency, activity logs, IP address, browser type and version, operating system, and language settings.
• User Content: data, text, conversations, AI agent configurations, and any other content uploaded, transmitted, or generated by the User through the Service.
• Communications: messages sent to our support team, inquiries, contact forms, and survey responses.
• Newsletter subscription information: email address and subscription date, for those who voluntarily subscribe to our communications.

3How We Use the Information

We use the information collected for the following purposes:

• Provide, operate, maintain, and improve the Service.
• Manage user accounts, subscriptions, and billing processes.
• Respond to inquiries, provide technical support, and manage communications with the User.
• Send operational communications, Service change notices, and security alerts.
• Analyze use of the Service to identify improvements, detect errors, and optimize performance.
• Detect, prevent, and investigate fraud, abuse, unauthorized access, and other unlawful activities.
• Comply with legal or regulatory obligations or requests from competent authorities.
• Send marketing communications and news, only to those who have given express consent.

4AI and Automated Processing

The Service uses artificial intelligence technologies to process queries and generate automated responses. The User should be aware of the following:

• VURAOS does not use User Content (entered data, conversations, or configurations) to train its own artificial intelligence models, unless the User gives express consent to do so.
• AI models integrated into the Service may be provided by specialized third parties. Such providers are subject to confidentiality and data processing contracts that limit the use of information exclusively to the provision of the Service.
• Responses generated by AI agents are automatic and do not involve direct human intervention by VURAOS in each conversation. The User may request human review at any time by contacting our support team.
• We do not make automated decisions that produce significant legal effects on the User based exclusively on the processing of their personal data, without human intervention.

5Legal Bases for Processing

Personal data processing is performed on the basis of the following legal grounds, as applicable to each processing activity:

• Contract performance: processing is necessary to provide the Service contracted by the User.
• Legitimate interest: to improve the Service, prevent fraud, and ensure the security of the platform.
• Consent: for marketing communications, non-essential cookies, and any optional processing that requires express authorization.
• Legal obligation: when processing is necessary to comply with legal obligations or requests from competent authorities.

For users located in Argentina, data processing is governed by Law 25.326 on Personal Data Protection and its regulatory decree. For users in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) applies.

6Information Sharing

VURAOS does not sell, rent, or commercialize the personal data of its Users. We may share information only in the following cases:

• Service providers: we share data with providers of technology infrastructure, payment processing, email delivery, usage analytics, and support, who act as data processors under contracts that guarantee confidentiality and limited use of the data.
• Integrated messaging platforms: when the User enables integrations with third-party communication channels, the data needed to operate such integrations is transmitted to the corresponding platforms according to their own privacy policies.
• Professional advisors: lawyers, accountants, and auditors who require access to data in the course of their professional duties, subject to confidentiality obligations.
• Legal authorities: when required by law, court order, or a competent government authority, or when necessary to protect the rights, safety, or property of VURAOS or third parties.
• Corporate transactions: in case of merger, acquisition, spin-off, or sale of VURAOS assets, data may be transferred to the acquirer, who will be obligated to respect this Policy or notify the User in advance.

7International Data Transfers

VURAOS operates from the United States and may use service providers located in different countries. Therefore, the User's personal data may be transferred to and stored on servers located outside their country of residence, in jurisdictions that may have data protection regulations different from those of their country.

When we carry out international transfers of personal data, we adopt appropriate safeguards to protect it, including:

• Data processing contracts with protection clauses equivalent to those required by applicable regulations.
• Use of providers that hold internationally recognized security certifications.
• Minimization of data transferred to those strictly necessary for each service.

8Data Retention

We retain personal data for the time necessary to fulfill the purposes described in this Policy, and in particular:

• Account data is retained as long as the account is active and for 30 days after cancellation, during which the User may request export or deletion.
• Billing and transaction data is retained for the periods required by applicable tax and accounting legislation (generally between 5 and 10 years).
• Activity logs are retained for a period of up to 12 months.
• Newsletter subscription data is retained until the User requests to unsubscribe.

After the retention periods elapse, data is securely deleted or irreversibly anonymized.

9Information Security

VURAOS implements reasonable technical and organizational measures to protect personal data against unauthorized access, loss, alteration, disclosure, or accidental or unlawful destruction. The measures adopted include:

• Encryption of data in transit through secure protocols (TLS/HTTPS).
• Encryption of passwords and sensitive data at rest.
• Role-based access control and principle of least privilege.
• Continuous infrastructure monitoring to detect anomalous access.
• Periodic security evaluations.

However, no security system is infallible. VURAOS cannot guarantee the absolute security of data. The User must keep their access credentials in strict confidentiality and notify us immediately of any unauthorized access.

10Your Rights

In accordance with applicable legislation, the User may have the following rights regarding their personal data:

• Access: request information about what personal data we have about you and how we use it.
• Rectification: request the correction of inaccurate or incomplete data.
• Erasure: request the deletion of their personal data when it is no longer necessary or when they withdraw consent.
• Objection: object to the processing of their data for certain purposes, including direct marketing.
• Restriction: request restriction of the processing of their data in certain circumstances.
• Portability: receive their data in a structured, commonly used, and machine-readable format.
• Consent withdrawal: withdraw at any time the consent given for processing based on it, without affecting the lawfulness of prior processing.

Users from Argentina may exercise the rights of access, rectification, and erasure provided for in Law 25.326 and have the right to appeal to the Public Information Access Agency (AAIP) as the supervisory authority.

To exercise any of these rights, you can contact us at privacy@vuraos.com. We will respond within 30 business days. We may request identity verification before processing the request.

11Cookies and Similar Technologies

The Service uses cookies and similar technologies (such as browser local storage) to ensure operation, remember User preferences, and analyze Service usage.

• Essential cookies: necessary for Service operation. Cannot be disabled without affecting basic functionality.
• Preference cookies: remember User settings, such as the visual theme (light/dark) and language preferences.
• Analytics cookies: allow us to understand how the Service is used to improve it. Can be disabled without affecting essential functionality.

The User can control and manage cookies from their browser settings. Disabling essential cookies may prevent the Service from functioning correctly.

12Marketing Communications

We will only send commercial communications, newsletters, or Service news to those who have given their express consent to receive them, either when registering their account or by expressly subscribing to our communications.

The User may unsubscribe from marketing communications at any time through:

• The unsubscribe link included in each marketing email.
• Email request to privacy@vuraos.com.

Unsubscribing from the newsletter does not affect operational communications related to your account or the Service.

13Minors

The Service is intended exclusively for individuals over 18 years of age. VURAOS does not knowingly collect personal data from minors. If we become aware that we have collected data from a minor under 18 without parental or legal guardian consent, we will proceed to delete such information as soon as possible.

If you believe we have collected data from a minor, please contact us immediately at privacy@vuraos.com.

14Third-party Services and Sites

The Service may contain links to third-party websites or services not operated by VURAOS. This Privacy Policy does not apply to such services. Use of third-party services integrated with the Service (such as messaging platforms, analytics tools, or payment processors) is subject to each third party's own privacy policies.

VURAOS is not responsible for the privacy practices of third-party sites and services. We recommend that the User review the privacy policies of any third-party service before using it.

Google account data

If the User connects their Google account, the Service only accesses what is needed for the actions the User enables:

• Google Calendar: view availability and the list of calendars, and create, edit or cancel the events the User's assistant schedules at the request of the User or their customers.
• Google Drive, Docs and Sheets: only the files the User picks with the Google picker or that the Service itself creates (drive.file scope). The Service cannot see the rest of the User's Drive.

This data is used only to provide those features to the User within the Service. It is not sold, not used for advertising or to train or improve general-purpose artificial intelligence models, and not transferred to third parties except as necessary to provide the requested feature (for example, processing of the request by the artificial intelligence model that performs the action), to comply with the law, or for security. No person reads this data except with the User's consent, for security purposes, or as required by law.

Access permissions are stored encrypted. The User can disconnect their account at any time from Integrations or from myaccount.google.com/permissions; disconnecting deletes those permissions.

VuraOs's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

15Security Breach Notification

If VURAOS becomes aware of a security breach affecting Users' personal data that poses a significant risk to their rights, we undertake to:

• Notify affected Users within a reasonable period after becoming aware of the incident, unless the competent authorities require confidentiality.
• Inform about the nature of the breach, the types of data affected, the measures adopted to mitigate damage, and the steps the User can take to protect themselves.
• Notify competent data protection authorities when required by applicable legislation.

16Changes to this Policy

VURAOS may update this Privacy Policy periodically to reflect changes in our practices, the Service, or applicable legislation. The updated version will be published on this page with the new effective date.

If changes are material, we will notify the User via email to the address registered in their account or through a prominent notice within the Service, at least 15 days prior to the effective date.

Continued use of the Service after the publication of changes implies acceptance of the updated Policy.

17Contact and Inquiries

To exercise your rights, submit inquiries, file complaints, or report incidents related to the privacy of your data, you can contact our team at:

Users from Argentina may also direct their inquiries or claims to the Public Information Access Agency (AAIP), enforcement authority of Law 25.326, located at Av. Pte. Gral. Julio A. Roca 710, floor 2, Buenos Aires.