Privacy Policy

Auryth, version 1.0, effective 14 August 2026

These documents apply to each of the following products. Where a fact differs between them — the processors, where processing takes place, what the Corpus contains — it is stated per product below.

1. Who is responsible

Original Media BV, Achtzalighedenlaan 9, 2920 Kalmthout, België, company number BE 0471.421.879 (we, us), is the controller for the processing described in this policy.

Telephone: +32 3 667 17 61. Data protection questions: [email protected]. Auryth is a brand of Original Media BV. We have not appointed a data protection officer; this processing does not require one under Article 37 GDPR.

If, as a customer, you enter third-party personal data into the Service (for example details of co-owners, tenants or buyers, details of clients, directors or shareholders and details of clients, suppliers or consignees in a question), you are the controller for that data and we act as processor. Annex B to the Terms of Service applies to that processing. We process the content of conversations solely as processor, on your instructions.

2. What we process

Account data. Email address, display name, role, account status, and an irreversible, salted derivation of your password (scrypt). We never store your password in readable form and cannot recover it. Accounts predating the move to scrypt may still hold a bcrypt derivation, which is equally irreversible.

Providing an email address and a password is a contractual requirement: without them we cannot create an account or provide the Service. The remaining data you provide voluntarily.

Organisation and subscription data. Organisation name, plan, number of seats, membership and role, invitations (including the invitee’s email address and who sent it), customer and subscription identifiers held by our payment provider, subscription status and the end date of the current period.

Conversation content. The questions you ask, the answers the Service generates, your conversation titles, and the data attached to an answer: sources consulted, citations, confidence indicators and the sequence of search steps. What you type into a question is stored. Do not enter more personal data than your question requires.

Preferences. Language, display settings, and whether to search the web.

Ratings. Your thumbs up or down on an answer and any comment you write with it.

Usage data. Per question: timestamp, user, session and organisation identifier, type of processing, model used, the number of text units processed and the associated cost. This record contains no question or answer text.

Product analytics. Page views and actions in the application: event name, path, referrer, language, browser family, campaign parameters, durations, and a random identifier stored on your device and in a cookie. This processing takes place only with your consent (point 5); until you give it, no identifier is placed on your device and nothing is transmitted. If you later sign in, we link the events you left on this device in the preceding seven days to your account. Free text in event properties is filtered before transmission; path, referrer and campaign parameters are filtered on receipt at our server.

Registration. If you create an account yourself at the public signup form, we also store the IP address the registration came from, the moment you accepted the Terms of Service and this policy, and which version of those documents was in force. The IP address serves the same purpose as the one recorded on a password reset: spotting a flood of registrations, not identifying you. The acceptance record is the timestamped evidence clause 2.1 of the Terms requires. Both are deleted with your account.

Security data. On a password reset, and on a request to confirm your email address: an irreversible representation of the token, the address the token was issued for, the timestamp and the IP address of the request. Our web server also keeps access logs containing IP address, timestamp, requested path and browser identifier.

Free-trial record. When you confirm your email address, we record once that this mailbox has had its free trial. That record holds no email address. It holds a one-way cryptographic digest (HMAC-SHA256) of your address in normalised form, computed with a secret key held only on our servers, together with the date the address was first seen and the date on which the trial it was granted ends. Your address cannot be recovered from the digest, and the record cannot be tied to you by anyone who does not already know the address and hold the key. Normalised means: lowercased, any +tag suffix removed, and — for gmail.com and googlemail.com only, where the provider itself treats them as one mailbox — dots before the @ ignored.

We keep it because deleting an account also deletes its organisation. Without this record the same mailbox could take a fresh free trial indefinitely: register, use the trial, delete the account, register again. It is used for exactly one thing — deciding whether a new organisation receives a trial or the remainder of one already granted. Nothing is inferred from it, it feeds no profile, and it makes no decision about you as a person. It is the one record that is not deleted when you delete your account; point 8 states how long it lasts and point 9 what that means for your rights.

Payment data. Your card details never reach our servers. Payments and invoicing run entirely at Stripe Payments Europe, Ltd., which also collects your address and VAT number and determines the VAT treatment. We receive the customer and subscription identifiers and the status, and retain the event messages that provider sends us.

3. Purposes and legal bases

We take no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. The Service generates answers; a human decides.

4. What we do with your questions and answers

This is the most important point in this policy; read it if you want to know whether “the AI trains on your files”.

We do not use the content of your conversations for our own purposes. For that content we are the processor: we process it to generate your answer, to secure the Service, and, on the customer’s instruction, to measure whether the right sources were found.

For improving the Corpus and the search methods we use only material from which personal data has been removed, or aggregate measurements that concern no person: how often the right source was found, which citations did not hold up, how long an answer took. Names, addresses, account numbers and case details are not needed for that and are not used for it.

If you want us to be able to use the raw content of your conversations for improvement, that is possible on your express written instruction as controller, revocable at any time. Without that instruction we do not do it. Ask us at [email protected].

Excluded in every case. Input containing special categories of personal data (health, trade union membership, origin) or data on criminal convictions is never used for improvement, not even after an instruction.

Our model providers. Your question is sent to a model provider in order to generate the answer. We require those providers not to use input to train their own models. Point 6 states, per provider, what safeguard we hold.

Objection. You may object at any time to processing based on legitimate interest, at [email protected]. If you are not a customer but someone whose data a customer entered, read the last paragraph of point 9.

We continue to use aggregated and anonymised statistics, from which nobody can still be identified, including after termination.

5. Cookies and storage on your device

We use no advertising cookies and no tracking cookies. For product analytics we set one first-party cookie, and only after your consent.

There is one third party your browser contacts: the registration form runs an anti-abuse check that loads a script from Cloudflare, which may set a cookie of its own for the sole purpose of telling a person from a bot. It is not used for advertising, it plays no part in our analytics, and it appears on no other page.

Auryth Vastgoed

Auryth Tax

Auryth Customs

We ask for your consent once, after sign-in. No answer counts as a refusal, and nothing is placed or transmitted. You may withdraw at any time from the Service settings, with a single switch. On withdrawal we remove the identifier from your browser, clear the cookie on our server, and delete the analytics records attached to that identifier.

6. Who receives data

We do not sell or trade your data. We engage the following service providers:

Auryth Vastgoed

The anti-abuse check runs in your browser. When the registration form loads, your browser requests a script from Cloudflare and sends it the result of the check; we never see more than whether it passed. Every other processor above is contacted by our servers, not by you.

Auryth Tax

Auryth Customs

Auryth Vastgoed

Which route your question takes depends on the model selected. By default the model runs on our own servers and nothing goes to a model provider. Only where a tier is expressly configured to an external provider is your question sent to it. The Service states which model produced a given answer.

Auryth Tax

Which route your question takes depends on the model selected. Auryth Tax runs no model of its own; every question goes to one of the providers in the table above. The Service states which model produced a given answer.

Auryth Customs

Which route your question takes depends on the model selected. Auryth Customs runs no model of its own; every question goes to one of the providers in the table above. The Service states which model produced a given answer.

We may also disclose data to our advisers under confidentiality, and to an authority or court where legally required. On a transfer of our business the data may transfer with it; we will inform you beforehand.

Changes to this list are notified as set out in Annex B to the Terms of Service.

7. Transfers outside the European Economic Area

Some providers are established outside the EEA. A transfer then takes place on the basis of a European Commission adequacy decision (for US recipients, the EU-US Data Privacy Framework, and only to the extent that recipient is actually certified on the official DPF list for the data categories concerned), or otherwise on the basis of the Commission’s standard contractual clauses together with a documented transfer impact assessment. The basis relied on per recipient appears in the table in point 6. You may request a copy of the safeguards at [email protected].

8. How long we keep data

9. Your rights

You have the right of access, rectification, erasure, restriction, portability, and the right to object to processing based on legitimate interest. You may withdraw consent at any time, without affecting processing before withdrawal.

Two rights you can exercise yourself, immediately, without contacting us:

• Access and portability. Download your account, your conversations, your preferences and your ratings as a file from the Service settings. For usage data, product analytics and organisation data, request a copy at [email protected].
• Erasure. Delete your account and the associated data from the Service settings.

What erasure does not remove. Deleting your account removes the account, your conversations, your ratings, your preferences, your product analytics and your membership of an organisation. One record survives it: the free-trial record described in point 2 — a one-way digest and two dates, containing no email address. It is kept so that deleting an account does not hand out a second free trial, it is erased automatically 24 months after the address was first seen, and it holds strictly less about you than the account that was removed. You may object to it on grounds relating to your particular situation at [email protected]; we will weigh those grounds against the interest it protects and tell you the outcome.

For the other rights: [email protected]. We respond within one month; for a complex request we may extend that by two months and will tell you within the first month. We may ask for proof of identity where there is reasonable doubt.

Not a customer of ours? If your data is in the Service because a managing agent, estate agent or property manager, an accountant, tax adviser or lawyer and a customs representative, a declarant or a lawyer entered it in a question, that person or firm is the controller and we are the processor. Address your request to them first. If you do not know who to approach, write to us at [email protected]; we will refer you and, where it falls to us, carry out the request on their instruction.

If you are dissatisfied you may lodge a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, +32 2 274 48 00, [email protected], or with the authority where you live. We would appreciate the chance to resolve the matter first.

10. Security

We take appropriate technical and organisational measures, including:

• encrypted connections (TLS) with HSTS;
• passwords stored as a salted, slow derived key (scrypt);
• logical separation of customer data: every query in the application is confined to the signed-in person’s user and organisation;
• sign-in tokens with a limited lifetime, revoked immediately on a password change;
• rate limiting on sign-in attempts;
• access to production data limited to those who need it.

No service is perfectly secure. If you find a vulnerability, report it to [email protected]. We investigate every report and will not take legal action against anyone who researches in good faith, causes no damage, and gives us the opportunity to fix the issue before disclosure. This undertaking prevails over the prohibition in clause 8 of the Terms of Service.

11. Children

The Service is aimed at professionals and is not intended for persons under sixteen. We do not knowingly collect data from children.

12. Changes

We may amend this policy. We announce a material change at least thirty days in advance by email and in the Service. The date at the top indicates the applicable version.

13. Visitors to auryth.ai

This policy also covers the website itself, where Original Media BV is the controller.

Waitlist and contact form. If you leave your email address to join a waitlist, or write to us through the contact form, we process that address and what you write in order to answer you and to tell you when a product becomes available. The basis is your consent, which you may withdraw at any time at [email protected]. Waitlist addresses are held by Brevo (Sendinblue) as our processor, within the European Union.

Website statistics. We use Cloudflare Web Analytics, which sets no cookie, tracks no individual visitor and collects no personal data.

Cookies on the website. No advertising and no tracking cookies are set. Two functional cookies exist: locale, which remembers the language you chose, and auryth_auth, set only if you sign in to the investor area. Both are strictly necessary for something you asked for.

How long. A waitlist address is kept until you ask us to delete it, or until the product it concerns has launched and you have decided whether to open an account. A message sent through the contact form is kept for as long as handling it requires.

Questions about this policy: [email protected].