Privacy policy

Effective 1 October 2026

This policy explains how AURA, the workflow automation service at aura.genrpa.com, handles data. AURA is operated by SoftBox Technology, Çifte Havuzlar Mah. Eski Londra Asfaltı Cad. Kuluçka Merkezi A1 Blok, Kat B01_06, Esenler, İstanbul, Türkiye ("we"). Questions and requests: the contact page.

1. Our role

Organizations (our customers) use AURA for their own work. For the content they put into AURA — their workflows, files, the data their workflows read and write — the organization decides what happens and we process it on its behalf (in Turkish law: the organization is the veri sorumlusu, we are the veri işleyen; in the GDPR: controller and processor). For the data we need to run accounts and the service itself, such as sign-in records, we decide and are responsible.

2. What we process

Data	What it is	Why
Account data	Name, user name, e-mail address, role, departments, organization; password only as a salted PBKDF2 hash.	To let people sign in and to apply their permissions.
Workflow content	Workflows, their settings, files people upload to the workspace, and the run history: each run with every step's input and output.	To run the workflows and to show what each run did.
Connections	The accounts, keys and passwords people save so their workflows can reach other services (for example a database, Google or Microsoft 365). Secrets are stored encrypted (AES) and never shown again.	To reach those services when a workflow runs.
Data from connected accounts	Whatever the steps a person puts in a workflow read from or write to that account — for example an e-mail's text, a spreadsheet's rows.	Only to carry out those steps (see section 3 for Google).
Audit and activity records	Who changed access, sharing and settings, and when; what a desktop bot did for AURA — where a call went and how it ended, never what was sent.	Security and accountability.
Technical logs	Server logs: times, addresses, errors. They do not contain passwords, tokens or message contents.	To keep the service running and secure.
Feedback	What people write with the Feedback button, and which screen they were on.	To improve AURA.

AURA uses no advertising or tracking cookies and no third-party analytics. The browser keeps the sign-in token in its local storage; signing out removes it.

3. Google user data

A person can connect their Google account with Connect with Google. AURA asks Google for these permissions:

Permission	Used for
`gmail.modify`	The Gmail steps in the person's workflows: find, read, send and reply to messages, save attachments, mark as read, add labels, move to trash.
`drive`	The Google Drive steps: find and list files and folders by their path, upload, download, create, copy, rename, move, share and delete files, fill a document template, convert to PDF.
`spreadsheets`	The Google Sheets steps: read, find, add, update and delete rows; clear ranges; add and remove sheets; create a spreadsheet.
`calendar`	The Google Calendar steps: list, read, create, update and delete events, answer invitations, check free/busy times.
`userinfo.email`	To show which Google account is connected.

Limited Use. AURA's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google data is used only to carry out the steps the person or their organization put in a workflow, and to show the results of those runs to the people allowed to see them.
It is not used for advertising, not sold, and not used to build or train AI or machine-learning models — ours or anyone else's.
It is passed to another service only when a step in the workflow does so on purpose — for example an AI step that the organization added, which sends its text to the AI provider the organization chose with its own key — and only for that step.
People at SoftBox Technology do not read it, except with the person's permission (for example when they ask for support), to investigate abuse or a security incident, or when the law requires it.
The tokens Google issues are stored encrypted. Disconnect in AURA deletes the connection and withdraws AURA's access at Google; access can also be removed at myaccount.google.com/permissions.

4. Microsoft 365 and other connected services

Microsoft 365, Slack and the other services work the same way: AURA asks only for the permissions its steps need, uses the data only for the steps in the workflows, stores the tokens encrypted, and Disconnect deletes the connection and, where the service allows it, withdraws the access.

5. Who may see an organization's data

Inside an organization, people see what their role and the sharing allow: a connection is used only by the person who added it and the people it is shared with; private workflows are seen only by their maker and the administrators. Our support staff do not open an organization's content unless the organization asks for help or the law requires it.

6. Who else processes data

Hosting: LeaseWeb Netherlands B.V. — AURA's servers are in a data centre in Amsterdam, the Netherlands.
AI providers chosen by each organization under Settings › AI providers, with the organization's own key — only the text the organization's AI steps send. Before it leaves AURA, e-mail addresses, identity numbers, IBANs, card and phone numbers in it are replaced by placeholders and put back only in the answer AURA receives, unless an administrator of the organization switched this off.
Google, Microsoft and the other services people connect — as described above.
E-mail delivery for password links and invitations, through SoftBox Technology's Microsoft 365 mailbox.

We do not sell data. Because the servers are outside Türkiye, using AURA involves transferring data abroad; we do so on the grounds the Turkish Personal Data Protection Law (KVKK, article 9) provides, which the organization's agreement with us sets out.

7. How long data is kept

Data	Kept
Runs, with their step data, and bot activity	The period the organization chooses — 7, 14, 30, 60, 90, 180 or 365 days; 30 days unless it chooses otherwise.
Workflows, files, connections, accounts	Until the organization deletes them, or until the organization's agreement ends.
Server logs	14 days.
Backups	The seven most recent; older ones are deleted.
Audit records of runs (each step: which, how it ended, how long — never its data)	As long as the runs.
Audit records of access, sharing and settings	As long as the organization's account exists, so access can be accounted for.

8. Security

All traffic uses HTTPS. Passwords are stored only as salted hashes; connection secrets, tokens and AI provider keys are encrypted (AES-256-GCM, a key per organization derived from the server's own key). A sign-in ends at once when the account is deactivated or its password, role or organization changes. Every request is checked against the organization and the person's role. Run reports can be downloaded with personal data masked and protected by a password. Systems inside a customer's network are reached through AuraBot, which connects out to AURA, so no firewall port has to be opened, and it reaches only the addresses listed on that computer.

9. Your rights

You may ask for access to your data, its correction or deletion, and object to its processing (KVKK article 11; GDPR articles 15–21 where they apply). If your data is in an organization's AURA, that organization decides and we help it answer. Write to us through the contact page. You may also complain to the Personal Data Protection Authority (KVKK) in Türkiye.

10. Changes

When this policy changes, the new version is published here with its date; organizations are told of important changes in AURA's What's new.