Privacy Policy

Information We Collect

When you register for an account, we collect information you provide directly, including your company name, contact name, work email address, and billing details. As you use our platform, we also collect sending metadata such as campaign names, message volume, delivery timestamps, bounce records, and complaint signals generated by your email activity. Recipient data you upload or submit through our API — including email addresses and any personalisation fields — is processed on your behalf as a data processor under applicable privacy law; you remain the data controller for that information and are responsible for having a lawful basis to send to each recipient.

How We Use Information

We use the information we collect to provision and operate your account, process and route the email, WhatsApp, and push messages you send through our platform, detect abuse and enforce our Acceptable Use Policy, generate delivery analytics and reputation dashboards, respond to your support requests, and improve the reliability and features of our service. We do not sell your personal data or your recipients' data to third parties, and we do not use recipient data you upload to target advertising to them. Aggregate, anonymised statistics about platform usage may be used internally to monitor system health and plan capacity.

Cookies & Tracking

Our marketing website uses essential cookies required for session management and CSRF protection. We may also set analytics cookies to understand how visitors navigate the site and to measure the effectiveness of our content; these cookies do not identify you personally and you may opt out via your browser settings or a consent manager widget if one is presented to you. Our email-sending infrastructure may embed a small tracking pixel or rewrite links in messages you send, but only when you have enabled open and click tracking for a specific campaign through your account settings. You can disable tracking per campaign or globally from your account preferences at any time.

WhatsApp Messaging Data

If you connect a WhatsApp Business Account to send messages through the Service, we process additional, WhatsApp-specific data on your behalf as a data processor. This includes: your recipients' phone numbers (in international E.164 format); their opt-in status and the timestamps they opted in or out; the content and template variables of the messages you send; delivery status (sent, delivered, read, or failed) and the timestamped history of those status changes; and connection metadata about your WhatsApp Business Account (business name, WhatsApp Business Account ID, and phone number ID) obtained when you connect your account via Meta's Embedded Signup. Your WhatsApp Business Account and phone number remain your own — we do not operate a shared or platform-level WhatsApp number, and connecting your account does not transfer ownership of it to us.

As with email recipient data, you are responsible for obtaining valid opt-in consent from each recipient before sending them a WhatsApp message through the Service and for honouring opt-out requests; the Service records opt-in and opt-out timestamps to support this. The Service stores inbound replies from your recipients and provides two-way conversation (inbox) functionality within your account, in addition to outbound template and session messages and the delivery-status updates Meta sends back about them. A recipient's WhatsApp data is retained for as long as their contact record exists in your account; deleting a contact removes its associated WhatsApp opt-in, message, reply, and delivery-status records. You may request deletion of a recipient's WhatsApp data at any time using the same process described in "Your Rights" below.

Push Notification Data

If you install AuraPost's push notification script on your website, we process browser push subscription data on your behalf as a data processor. This includes: the unique push subscription endpoint and cryptographic keys a visitor's browser assigns when they grant notification permission; basic device metadata (browser, platform, and the site origin they subscribed from); and, only where you choose to call our identify function, the email or phone number used to link that subscription to an existing contact in your account. We also record on-site activity your script reports — page views, cart and purchase events, and any custom events you configure — to power push automations and analytics; this activity is linked to the subscription, and to a contact record only where you've linked one.

A push subscription is anonymous until you link it — we do not know who a visitor is unless your site tells us. Delivering a notification also requires relaying it through your visitor's browser vendor's own push service (for example Google, Mozilla, or Apple, depending on the browser); those services receive only the encrypted notification and the delivery address needed to route it, not your account or customer data. Live subscriptions are kept until they expire or are revoked; expired or unsubscribed subscriptions are purged automatically 365 days after going inactive. Activity data is retained for a period your plan configures (7 to 365 days), after which only permanent aggregate daily counts are kept. You may request deletion of a visitor's push data at any time using the same process described in "Your Rights" below.

Sub-processors

AuraPost relies on a limited set of third-party sub-processors to deliver its service. Amazon Web Services (Amazon SES and related AWS infrastructure) is our primary email delivery and cloud hosting provider; data is processed in AWS data centres subject to AWS's data-processing agreements. For customers using our WhatsApp messaging feature, Meta Platforms, Inc. is a sub-processor: messages you send and the delivery-status webhooks we receive travel over Meta's WhatsApp Business Platform (Cloud API), subject to Meta's own data-processing terms. For customers using our push notification feature, delivery is relayed through the push service operated by each visitor's browser vendor (for example Google, Mozilla, or Apple) — these services receive only the encrypted notification payload and delivery address needed to reach the browser. Payment processing is handled by a PCI-DSS compliant payment provider, and transactional support communications may pass through a dedicated helpdesk tool. We contractually require all sub-processors to protect personal data to a standard at least as protective as our own obligations and to process data only on our documented instructions. An up-to-date list of sub-processors is available on request by emailing support@theaurapost.com.

Data Retention

Account information is retained for as long as your account is active and for a reasonable period thereafter to satisfy legal, accounting, and dispute-resolution obligations. Sending logs — including recipient email addresses, delivery status, bounce and complaint records — are retained for up to 90 days by default, after which they are automatically purged; you may request earlier deletion through your account settings. Suppression list entries (hard bounces and unsubscribes) are retained indefinitely to prevent re-delivery to addresses that have opted out or rejected mail, which is required by law in many jurisdictions. Billing records are kept for the period required by applicable tax and financial regulations, typically seven years.

Your Rights

Depending on your jurisdiction, you may have rights under the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), or other applicable laws. These rights may include the right to access a copy of personal data we hold about you, the right to request correction of inaccurate data, the right to erasure ("right to be forgotten"), the right to data portability in a machine-readable format, and the right to object to or restrict certain processing activities. To exercise any of these rights, please contact us at support@theaurapost.com; we will respond within the timeframe required by applicable law (typically 30 days). Where we act as a processor for your recipients' data, please be aware that we can only act on access or deletion requests you submit as the controller on behalf of your recipients.

International Data Transfers

EWARDS ENGAGEMENT PRIVATE LIMITED is incorporated under the laws of West Bengal, and data we process may be transferred to and stored in countries other than your own, including the United States where our primary infrastructure operates. When we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to a third country, we rely on appropriate safeguards such as Standard Contractual Clauses adopted by the European Commission, or other legally recognised transfer mechanisms. By using our service, you acknowledge that your information may be processed in jurisdictions whose data-protection laws may differ from those of your home country.

Security

We implement industry-standard technical and organisational measures to protect your data against unauthorised access, disclosure, alteration, and destruction. For a full description of our security practices, including encryption standards, authentication controls, and infrastructure safeguards, please visit our Security & Trust page. Despite our efforts, no system is perfectly secure; you are responsible for maintaining the confidentiality of your account credentials.

Children's Privacy

Our service is directed to businesses and professional senders and is not intended for individuals under the age of 16 (or the applicable age of majority in your jurisdiction). We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately at support@theaurapost.com and we will take steps to delete the information promptly.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the effective date at the top of this page and, where required by law, notify you by email or through an in-app notification prior to the changes taking effect. Your continued use of the service after the effective date of a revised policy constitutes your acceptance of the updated terms. We encourage you to review this page periodically.

Contact

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, you may reach us by email at support@theaurapost.com. You may also write to us at: EWARDS ENGAGEMENT PRIVATE LIMITED, 46 C, Chowringhee Road, 10th Floor Room No. 10A/1, Kolkata-700071. If you are located in the European Economic Area and believe we have not addressed your concern adequately, you have the right to lodge a complaint with your local supervisory authority.