Revision 2026-10-11-privacy-bounded-retention-1 · Reviewed 2026-10-11
Who we are. AURONA, INC. provides information about industrial equipment and materials and handles sourcing inquiries and related support. This notice covers this website, requests for quotation (RFQs), the Support Center, Ask Aurona and related business communications, where those services are available.
For privacy questions or requests concerning your information, email support@auronainc.com. Our mailing address is 1201 3rd Ave, Suite 2200, Seattle, WA 98101, United States. We currently serve the United States only. This does not mean that all processing by our service providers occurs in the United States.
Information we handle and why. We handle information you submit and records created while responding to you:
RFQs: company and contact details, requirements, quantities, delivery needs and destination, requested documentation, notes, attachments and correspondence. We use these to understand and follow up on the inquiry.
Support: contact details, issue descriptions, categories, language, product or reference information, messages and attachments. Handling records can include assignments, internal staff notes, actions and resolutions.
Ask Aurona: questions and responses, public page context, language, feedback, conversation identifiers, timing and any contact details you provide for follow-up. Staff handling a conversation can review its history and add internal handling notes.
Files: document contents, filenames, types, sizes, identifiers and security-check results. Files may contain information about you or others in your organization.
Security and operation: network and browser information, session and verification records, access attempts, rate-limit identifiers, audit events, delivery outcomes and diagnostic records. These help protect access, investigate misuse, process background work, recognize retries and recover services.
Website measurement is described below. Information may be supplied by someone acting for your organization. Provide only information you are authorized to share and that is necessary for the request. Do not submit passwords, payment-card details, identity documents, health information or unrelated sensitive information. Contact us before sharing restricted material.
Required fields are identified in forms. Without information necessary to understand a request or verify access, we may be unable to process it or disclose private records. Submitting an RFQ, Support request or chat does not enroll you in promotional email. A submission or AI response is not a binding quote, purchase, engineering approval or guarantee of availability; technical and commercial commitments require human review.
AI assistance and human messaging. When Ask Aurona generates an AI answer, we send OpenAI your question, a limited recent history from your conversation, language and public page context, and relevant approved Aurona website information. Some guidance is provided without a model request. The assistant does not automatically retrieve private RFQs, uploaded customer files, staff notes or other visitors’ conversations. Information you include in a chat message can nevertheless be included in the request sent to OpenAI.
Aurona stores conversations in its own database. Our requests turn off OpenAI's optional response storage, but this does not mean OpenAI keeps no data. OpenAI describes separate abuse-monitoring retention that can include prompts and responses for up to 30 days, with exceptions, and other feature-specific storage. Provider handling depends on the service and applicable account controls. See OpenAI’s API data controls (https://developers.openai.com/api/docs/guides/your-data).
Uploaded customer documents are not currently sent for AI document analysis. An RFQ submission does not authorize a future document-analysis feature. AI answers can be incomplete or incorrect. You can request human help or use the RFQ, Support or contact channels without asking the AI assistant a question. A request for human help does not mean a person is currently online or guarantee a response time. Automatic AI replies pause when staff takes over.
Starting a new conversation does not erase earlier conversations. Use the privacy contact above to request deletion.
Who receives information. Aurona personnel handling a request can access the information needed for their work. If a sourcing inquiry involves prospective manufacturers or suppliers, relevant requirements may need to be shared with them to assess the inquiry or prepare a response. Contact us before submitting information that requires restricted handling so the arrangements for the particular inquiry can be agreed. This describes possible recipients and purposes; it does not authorize unrestricted disclosure of your information.
Our service architecture uses:
Cloudflare for website delivery, security and Turnstile checks, private file storage, background processing, connections to the database and scanning service, website measurement described below, and Email Routing for incoming company email.
Neon for operational database records, including inquiries, Support, conversations and access records.
Google Gmail for receiving and storing company correspondence forwarded through Cloudflare Email Routing.
Amazon Web Services for outgoing SES transactional email and encrypted recovery archives in S3.
Contabo for the Aurona-controlled file-scanning server, through which submitted files pass for security checks.
GitHub Actions for restricted release and backup automation. Backup runs temporarily process database exports and eligible files to create encrypted archives.
OpenAI for the AI requests described above. Correspondents' email providers also handle messages delivered to or sent from their accounts.
These services can process information needed for their respective functions. Provider processing and retention are separate from Aurona’s application records. Cloudflare Turnstile processes browser, network and related signals for site protection and bot detection; Cloudflare also describes processing for improving its detection service in its Turnstile privacy notice (https://www.cloudflare.com/turnstile-privacy-policy/).
Transactional notifications can contain a reference or an expiring private access link. Current Support and chat notification templates omit transcripts and attachments; ordinary email correspondence may contain information you or staff include. Your own email provider also handles delivered messages. Do not forward private access links or codes. Deleting an application record does not delete copies from a recipient’s mailbox.
Information may also be disclosed when required by applicable law or when necessary to address fraud, security incidents or legal claims.
Cookies, browser storage and website measurement. Essential controls support private access, uploads, language preferences and protection against misuse. Current application storage includes:
Upload session: Associates uploads with the browser; 24 hours.
Chat session: Accesses conversations associated with that browser; 30 days.
Support and staff sessions: Verified case access or staff sign-in; 8 hours, with access revoked on logout.
Language preference: Remembers your selection for up to 365 days.
Analytics preference: Stores allow/decline locally until changed or cleared; no automatic expiry is set.
Pending RFQ retry record, where enabled: An operation identifier and request digest in session storage, not form text; cleared after a successful receipt, otherwise subject to the browser session.
Security services may also use their own cookies or similar controls. Clearing browser storage can remove preferences or access, but does not erase server records. An expired access link or cookie is likewise not deletion of its associated records.
Aurona's optional first-party measurement is off until you allow it through Change cookie settings. You can change that choice there. The browser's Do Not Track setting overrides permission for these first-party events. Declining them does not prevent you from submitting an inquiry or Support request. This preference controls those Aurona events, not the separate Cloudflare measurement described below.
Optional first-party events describe approved public pages or categories, broad referral and device categories, and defined actions such as an RFQ submission or resource download. Events can include an event identifier, item count or broad file-size/type category. They exclude contact details, message bodies, free-text requirements and file contents. Essential security processing operates separately from these optional events.
Cloudflare Web Analytics separately measures website use and performance. Measurements can include the page host and path, referring page, device and browser categories, country and loading performance. Cloudflare describes this service as not using cookies or local storage for these measurements. It can operate before you select a cookie preference. Aurona's first-party analytics preference and its Do Not Track handling do not disable this separate measurement. See Cloudflare's description (https://www.cloudflare.com/web-analytics/) and measurement dimensions (https://developers.cloudflare.com/web-analytics/data-metrics/dimensions/).
The first-party event exclusions above should not be read as a guarantee about every provider request or page address. Private links and reference-bearing pages can involve identifiable business information even when a measurement service does not use cookies. This notice does not describe the provider measurement as anonymous or establish a separate provider retention period.
Retention and current deletion limits. We use the retention targets below to review eligibility. Routine automation handles only supported categories of files, closed inactive noncommercial RFQ text and associated records, and eligible inactive AI or human conversations. It rechecks holds, activity and relationships, and records deletion evidence before removing supported content. Complete disposal of Support cases and attachments, linked or derived records, some operational records, provider copies and recovery copies is not yet implemented or verified. These classes require individual review and can remain beyond the targets while their safe disposition is resolved. Deletion requests require individual assessment; the targets do not promise that every copy is automatically deleted on a particular date.
Closed, inactive noncommercial RFQs and related inquiry records: 180 days after last meaningful activity, once eligible; active, shared, linked or held records require separate review.
Closed ordinary-service Support: 180 days after the later of closure or last meaningful activity; linked business records follow their applicable scope.
Unlinked, inactive AI and human conversations: 90 days after last meaningful activity; linked conversations follow their business or Support scope.
Completed transaction records: 7 calendar years after completion where a documented business, accounting or legal purpose justifies retention; this is not a universal legal requirement.
Unsafe or quarantined files; abandoned incomplete uploads: 7 days from quarantine/unsafe classification, or upload initiation for abandoned uploads once inactivity and lack of association are established, unless held. This is not a guarantee that all file classes are already disposed of.
Audit and diagnostic records: Eligible audit records: 12 calendar months. Routine logs and optional analytics: at most 30 days as a target. Security-investigation records: 90 days unless a documented need or hold requires longer.
Completed background work and expired access records: Job/email payload minimization: 30 days after terminal reconciliation; expired or revoked session/token rows: 30 days after expiry/revocation, absent an unresolved security need. Expired routine rate-limit counters: 7 days. Pending or uncertain work is excluded.
Privacy request records: Minimal request and decision records: 24 months after closure. Temporary identity-verification evidence, if needed: 30 days after verification, unless required for a documented dispute or hold.
Recovery copies: A 35-day rolling recovery target; complete archive, version and provider-copy expiry has not been established.
Active work, linked transaction obligations and documented legal, business-retention or security holds can affect eligibility. Our hold-review target is at least every 90 days. Releasing a hold does not restart the original retention clock merely because a record was reviewed.
Minimal deletion, access-revocation and duplicate-prevention evidence may need to remain so an older backup or retry cannot revive disposed information. Such identifiers are not necessarily anonymous. The target is to retain necessary recovery markers through the life of every copy that could revive a record, plus 90 days. Their safe expiry cannot be fixed while that copy inventory is incomplete. Backup, provider and recipient-mailbox copies must be considered separately from deletion in the working database.
Requests, security and changes. Contact support@auronainc.com to request access, correction or deletion of information associated with you or your organization. Include enough detail to locate the inquiry or conversation, preferably its reference; do not send identity documents or additional sensitive material unless a suitable verification step is requested. Authority must be checked before private records are disclosed or changed. Any response must account for applicable obligations, other people’s information, holds and the disposal limitations described above. This notice does not remove rights available under applicable law or promise that every requested action can be completed immediately.
The application uses restricted access, private file storage, file-security checks and protected connections. Files awaiting security clearance are quarantined from ordinary staff download. These controls do not establish the accuracy or engineering suitability of a file, or eliminate all security risk.
The website is intended for business users, not children. Contact the privacy address if a child has submitted personal information. Changes to this notice will be reflected in the published version and its date; materially different handling requires review before that changed service is enabled.
Contact Aurona