Ainora Lite Privacy Policy

This policy explains how Aero Ainora Software Design LLC ("Ainora", "we", "us"), based in Dubai, United Arab Emirates, handles personal data in the Ainora Lite mobile app for iOS and Android (the "App").

Ainora Lite is a business tool. Businesses that use Ainora (our "Clients") invite their owners and staff to use the App to manage their customer conversations, contacts, appointments and social media posts.

1. Two kinds of data, two roles

• Your account data (if you are a staff member who signs in): we decide how it's used, so we are the controller.
• Business data (the customers, messages, appointments and posts of the business you work for): this belongs to the business. We process it on the business's behalf, as a processor, under our agreement with that business. If you are a customer of one of our Clients and have a question about your data, please contact that business first. We'll help them answer you.

2. What we collect

When you sign in and use the App

• Email address, used to send you a one-time sign-in code and identify your account.
• Name and role in the business (for example owner, admin or team member), taken from your business account or entered by your admin.
• Sign-in codes. We store only a scrambled (hashed) version, and each code expires after 10 minutes.
• Push notification token and device platform (iOS or Android), if you allow notifications, so we can alert you to new messages and bookings. We do not collect your device's advertising ID.
• Basic records such as when your account was created and when you last signed in.

Business data you view or change in the App

• Customer contacts: names, phone numbers, email addresses, tags and notes.
• Conversations: messages exchanged with customers by SMS, email, chat and social channels, including sender, time and content.
• Appointments: calendar, time, customer and title.
• Social media posts: text, media links, schedule and the connected social accounts.
• Team members of the business: names, email addresses and roles, used to decide who can see what.

Most business data is fetched from the business's account when you open a screen and is not stored on our servers. We do store:

• secure, encrypted access tokens that connect the App to the business's account (never your password);
• the list of the business's team members (name, email, role);
• notification events (for example "new message from <name>: <first 120 characters>") so we can send push notifications, kept for up to 30 days.

What we don't collect: your location, your phone's address book, photos, camera or microphone, health or financial information, or browsing history. The App has no advertising, no analytics and no tracking SDKs, and we don't track you across other companies' apps or websites.

3. How we use data

• Sign you in and keep your account secure.
• Show you, and let you act on, the business data you're allowed to see. Owners and admins see the whole business; team members see the records assigned to them.
• Send you push notifications about new messages and bookings, and service emails (sign-in codes, invitations).
• Keep the service running, fix problems and prevent abuse.
• Meet legal obligations.

We do not sell personal data, do not use it for advertising, and do not use business data for any purpose other than providing the App to that business.

Legal bases (where UK GDPR or similar laws apply): performance of our contract with you or your employer; our legitimate interest in running a secure service; and legal obligation. Business data is processed on the business's instructions.

4. Who we share it with

Only service providers that help us run the App, under contracts that require them to protect the data:

• Cloud hosting and database: Railway Corporation, with servers in the United States.
• Email delivery of sign-in codes and invitations: Resend, sending from the European Union.
• Push notifications: Expo, Apple Push Notification service and Google Firebase Cloud Messaging.
• Our CRM platform provider, which hosts the business's customer, conversation, calendar and social data on behalf of the business.

We may also disclose data if required by law, to protect our rights or users' safety, or as part of a merger or acquisition (with notice to you). Some of these providers process data outside your country, including in the United States and the European Union. Where required, we use appropriate safeguards such as standard contractual clauses.

5. How long we keep it

• Your account: while you have access to at least one business, and deleted within 30 days after you ask us to delete it or after the business removes you and asks us to delete it.
• Sign-in codes: expire after 10 minutes and can only be used once.
• Notification events: up to 30 days.
• Push tokens: until you sign out, uninstall the App or delete your account.
• Business data: stored by the business's account, not by us. When a business disconnects from Ainora Lite, we delete its access tokens and team list.

6. Security

All traffic between the App and our servers is encrypted (HTTPS/TLS). Your session token is kept in your device's secure storage (iOS Keychain / Android Keystore). Access tokens are stored encrypted on our servers, and access is limited to staff who need it. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires it.

7. Your choices and rights

• Notifications: turn them off at any time in your phone's settings.
• Delete your account: in the App go to Settings → Delete account, or email contact@ainora.ai from the email you sign in with (see how to delete your account). We delete your account data within 30 days. Business data belongs to the business and is not deleted by deleting your account.
• Access, correction, deletion, restriction, objection and portability: depending on where you live (for example under the UAE PDPL, Saudi Arabia's PDPL or UK GDPR), you may have these rights. Email contact@ainora.ai. We reply within 30 days, and may need to confirm your identity first.
• Complaints: you can also complain to your local data protection authority (in the UK, the ICO).

8. Children

The App is for businesses and their staff. It is not directed at children, and you must be at least 18 to use it. We do not knowingly collect children's data as account holders. A business's customer records may include people of any age; the business is responsible for that data.

9. Changes

We may update this policy. We'll change the "last updated" date and, for significant changes, tell you in the App or by email.

10. Contact