Document 01

Privacy Policy

Last updated October 2026.

1. Introduction

This Privacy Policy (“Policy”) describes how Aura Lift AI Development Holdings, LLC, a Wyoming limited liability company, doing business as AuraLift Ai (“Company,” “we,” “us,” or “our”), collects, uses, discloses, and protects information in connection with the AuraLift platform, including all websites, mobile applications, application programming interfaces, AI companion services, and related tools and services (collectively, the “Service”).

By accessing or using the Service, you (“User,” “you,” or “your”) acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with this Policy, you must not access or use the Service.

AURALIFT IS AN AI-POWERED WELLNESS COMPANION. IT IS NOT A HEALTHCARE PROVIDER, LICENSED THERAPIST, OR MEDICAL SERVICE. THE SERVICE DOES NOT CREATE A DOCTOR-PATIENT, THERAPIST-CLIENT, OR ANY OTHER CLINICAL RELATIONSHIP. DATA COLLECTED THROUGH THE SERVICE IS NOT PROTECTED HEALTH INFORMATION UNDER HIPAA UNLESS SPECIFICALLY INDICATED OTHERWISE IN A SEPARATE BUSINESS ASSOCIATE AGREEMENT WITH AN INSTITUTIONAL PARTNER.

2. AI Disclosure and Transparency

AuraLift provides AI companion support through artificial intelligence technology. In accordance with applicable state and federal regulations, we disclose the following:

All companion interactions on AuraLift are conducted by artificial intelligence, not by human beings.
The AI companion system is a computer program. It is not a human, it cannot feel human emotion, and it does not possess consciousness or subjective experience.
AI companion support does not constitute professional therapy, counseling, psychiatric care, medical treatment, or any form of licensed mental health service.
AI-generated responses are based on computational analysis of text patterns and evidence-informed wellness frameworks, not on clinical judgment.
The AI system cannot independently diagnose mental health conditions, prescribe medications, or create clinical treatment plans.
Users are reminded of the AI nature of the Service at the start of each session and at regular intervals during extended sessions.

We provide these disclosures to comply with laws governing AI companions and chatbots where they apply.

3. Information We Collect

Information you provide directly

Account registration information: email address, first name, last name, and password (or, if you sign in with Google or Apple, the account details that sign-in provides)
Consultation intake responses: presenting concerns, wellness goals, preferred session pace, prior experience with therapy or similar support, current mood
Conversation content: text and voice messages exchanged with the AI companion
Journal entries: written reflections, personal notes, and tagged entries
Mood tracking data: self-reported emotional states, mood scores, and contextual notes
Goals and commitments: personal wellness goals, progress tracking, and action plans
Payment information: handled by our payment providers — Square for subscriptions bought on the web, Apple for purchases in the iOS app, and Google Play for purchases in the Android app, with RevenueCat processing subscription events from the app stores. We receive subscription and purchase records from them; we do not store credit card numbers or bank account details on our servers
Feedback and support communications: messages sent to our support team, survey responses, and feature requests

Information collected automatically

Device and browser information: device type, operating system, browser version, screen resolution
Usage data: session frequency, session duration, feature usage patterns, navigation paths
Technical logs: error reports, crash data, performance metrics, API response times
Cookies and similar technologies: in the AuraLift web app, sign-in cookies keep you signed in and protect your requests (access_token, 15 minutes; refresh_token and csrf_token, 7 days); on this website, the cookies and browser storage listed in our Cookie Policy
Voice data: when you use voice features, your audio is streamed in real time to Inworld AI for speech-to-text; our servers do not save the raw audio

Information derived from AI processing

Emotional state analysis: emotional indicators derived from conversation text by software, including AI models, (e.g., anxious, sad, happy) used to calibrate AI response style
Conversation trajectory analysis: emotional trends tracked within individual sessions to inform how the AI responds
Crisis risk assessment: automated detection of crisis-related language patterns for safety protocol activation
Behavioral patterns: aggregated patterns of engagement, mood trends over time, and goal completion rates

Crisis detection starts with automated pattern matching that runs on every message. For some matches, an AI model (Anthropic’s Claude) reviews the flagged message in the context of the conversation to decide how LAura responds. None of this uses biometric monitoring, facial recognition, brain-computer interfaces, or any form of physiological measurement.

4. Voice and Audio Data Collection

We collect microphone audio only when you explicitly start a voice session and grant microphone permission. Raw audio is transcribed, and the resulting text transcript of your spoken words plus session context is sent to third-party AI services to generate personalized companion responses. Our servers do not save the raw audio.

5. How We Use Your Information

5.1 Service delivery and personalization. Providing AI companion conversations personalized to your needs, goals, and preferences; maintaining conversation context and memory across sessions to provide continuity of support; processing voice input for voice features; generating personalized insights, mood reports, and wellness summaries; facilitating mood tracking, journaling, and goal-setting features.

5.2 Safety and crisis response. Detecting crisis language and activating safety protocols, including providing crisis resource information (988 Suicide & Crisis Lifeline, Crisis Text Line, 911); age verification enforcement to restrict access to users 18 years of age and older; enforcing content safety boundaries to prevent harmful interactions.

5.3 Service improvement and research. Analyzing aggregated and de-identified usage patterns to improve the AI companion’s quality, safety, and effectiveness; training and improving AI models and session frameworks using de-identified and aggregated conversation data; conducting internal research on AI companion support effectiveness; developing new features and session playbooks.

We reserve the right to use de-identified, anonymized, and aggregated data derived from your use of the Service for research, product improvement, AI model training, and statistical analysis. Such de-identified data cannot reasonably be used to identify you personally. Your conversations are not sold, and are not provided to third parties to train their shared or general-purpose models.

5.4 Business operations. Processing subscription payments and managing billing through Square (web), Apple (iOS), Google Play (Android), and RevenueCat; sending transactional communications (account verification, password resets, billing notifications); providing customer support and responding to inquiries; enforcing our Terms of Service and protecting against fraud, abuse, and security threats; complying with legal obligations, regulatory requirements, and law enforcement requests.

6. How We Share Your Information

6.1 Service providers and other recipients. We share information with the service providers below, each for the purpose listed.

Anthropic (Claude): AI model provider. Generates LAura’s replies and reviews messages flagged by crisis detection. Receives conversation text and the context needed for a reply (for example, earlier messages and your stated goals).
Voyage AI: Embedding and ranking provider that lets LAura recall earlier conversations. Receives excerpts of conversation text.
Inworld AI: Speech-to-text and text-to-speech for voice features. Receives your voice audio and the text of LAura’s spoken replies.
Amazon Web Services (AWS): Cloud hosting, databases, file storage, encryption key management, transactional email, and message queues. Holds the account data described in this Policy.
Sentry: Error monitoring. Receives technical error reports from our servers, which we filter before sending to remove conversation and account content.
Square: Payment processing for subscriptions bought on the web. Receives the billing details needed to process the payment.
Apple: App Store purchases (StoreKit), Sign in with Apple, and push notifications. Receives purchase records, sign-in tokens, and the device push token.
Google: Google Play purchases, Google Sign-In, and Google Analytics. Receives purchase records and sign-in details. Our servers may also send Google Analytics product-usage events (for example, sign-up, subscription, and session started or ended) linked to your AuraLift account identifier; these events do not include the content of your conversations.
RevenueCat: Processes subscription events (purchases and renewals) from the app stores.
Meta: Advertising measurement. Receives page-view and lead events from this website, with campaign details, through the Meta Pixel and from our servers (Meta’s Conversions API). The Meta Pixel loads only when advertising is allowed for your browser and you have not opted out, and neither path receives anything from pages under Resources, Pillars, Articles, or Sit with LAura. The events our servers send to Meta do not include your AuraLift account identifier or email address.
AppsFlyer: Measures which website visits and advertising lead to app installs. When enabled on this website, receives page events, a random browser identifier, and campaign details.
Website hosting (AWS S3 and CloudFront): Serves this website and keeps standard request logs.

You can turn off the Meta Pixel, Google’s advertising features, and AppsFlyer on this website with Your Privacy Choices. The Cookie Policy lists what each one stores in your browser.

6.2 Data isolation between users. Your personal data, including your conversations, journal entries, mood logs, goals, and assessment results, is strictly isolated to your account. No user can access, view, or interact with another user’s data. Access is restricted by authenticated, per-user authorization controls. Section 10 describes the safeguards we use, including which data is encrypted. We do not aggregate identifiable data across user accounts.

6.3 Institutional partners. When you access AuraLift through an institutional partner (employer, charitable organization, or educational institution), we may share aggregated and de-identified usage statistics with that partner. We will not share your individual conversation content, journal entries, or identifiable wellness data with institutional partners without your explicit consent.

6.4 Legal and safety disclosures. We may disclose your information when we believe in good faith that disclosure is necessary to: comply with applicable law, regulation, legal process, or governmental request; enforce our Terms of Service or other agreements; protect the safety, rights, or property of AuraLift, our users, or the public; detect, prevent, or address fraud, security issues, or technical problems; respond to an emergency involving danger of death or serious physical injury.

6.5 Business transfers. In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website of any change in ownership or uses of your personal information.

7. Data Retention

Raw microphone audio is passed to Inworld AI for transcription; our servers do not save it.

Account data, including conversation transcripts, journal entries, mood logs, and goals, is kept for as long as your account exists, so LAura can keep continuity across sessions, or until you delete it. When your account is deleted, the data linked to it is removed as described in Section 8.

Records of access to sensitive data (which kind of record was accessed, by which account, when, and from which IP address) are kept in an audit log for at least six years, including after an account is deleted. They do not contain the content of your conversations.

8. Account and Data Deletion

If you have an AuraLift account, you can permanently delete your account and all associated personal data (including voice transcripts, sessions, and any derived embeddings) directly from within the app. Go to Settings → Account → Delete Account.

Deleting your account removes your account and the data linked to it from our database. Depending on where you start it, deletion happens immediately or is scheduled and completed by an automated job within 30 days. Deleting your account does not delete copies a service provider listed in Section 6.1 may keep under its own retention terms; we do not send deletion requests to those providers.

Account deletion is irreversible. If copies of your data exist in database backups, they are not edited; they are removed when those backups expire. The access audit log described in Section 7 is kept.

You can also turn off future data collection in Settings → Data & Privacy without deleting your account.

9. Consent

Before your first voice session (and before any data is sent to third-party AI services), we show a clear screen explaining that your voice transcript will be sent to Anthropic (Claude), Inworld AI, and Voyage AI for companion responses and session storage. You must actively tap “Yes” for voice features to work. You can revoke microphone access at any time in your device Settings.

10. Data Security

We use administrative and technical safeguards to protect your information, including:

Application-level encryption of the text of conversation messages, journal entries, and several other sensitive fields, with keys managed in AWS Key Management Service, before they are stored. Some fields, such as numeric mood scores, are not yet encrypted this way, and some older records may predate it.
Hosting on Amazon Web Services.
Authenticated, per-user authorization on account requests, so one user’s data is not returned to another.
An administrator role required for administrative tools, and an audit log of access to sensitive records.

NO METHOD OF ELECTRONIC TRANSMISSION OR STORAGE IS 100% SECURE. WHILE WE STRIVE TO USE COMMERCIALLY REASONABLE MEANS TO PROTECT YOUR INFORMATION, WE CANNOT GUARANTEE ABSOLUTE SECURITY. YOU ACKNOWLEDGE THAT YOU PROVIDE YOUR INFORMATION AT YOUR OWN RISK.

11. Your Rights

Depending on where you live, you may have the right to:

Know and access the personal information we hold about you, including the categories of sources, the purposes we use it for, and the recipients we share it with;
Correct inaccurate personal information;
Delete your personal information;
Receive a portable copy of your personal information;
Opt out of the sale or sharing of your personal information, of targeted advertising, and of profiling used for decisions with legal or similarly significant effects;
Limit, or give or withdraw consent to, our use of sensitive personal information, including consumer health data;
Not be discriminated against for using these rights. We will not deny you the Service, charge you a different price, or give you a different quality of service because you made a request.

How to make a request

To delete your account, use Settings → Account → Delete Account in the app. For any other request, or to delete without the app, write to legal@auraliftai.com from the email address on your account and tell us which right you want to use. For advertising and analytics on this website, use Your Privacy Choices.

Verifying your identity. We verify a request by matching it to your account, for example by asking you to confirm it from the email address on the account. We ask only for what we need to verify you and use it only for that purpose.

Authorized agents. You may have an authorized agent make a request for you. We may ask the agent for your signed permission and may ask you to confirm your identity with us directly, unless the agent holds a power of attorney.

Timing. We acknowledge a request within 10 business days and respond within 45 days of receiving it. If we need more time, we may extend that once by up to 45 more days; if we do, we will tell you within the first 45 days and explain why.

Appeals

If we decline your request, in whole or in part, we will tell you why. To appeal, reply to our decision or write to legal@auraliftai.com with “Privacy appeal” in the subject line. We respond to an appeal within 45 days and tell you what we decided and why. If you disagree with the outcome, you may contact the Attorney General of your state.

12. State-Specific Privacy Rights

12.1 California residents (CCPA / CPRA). If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including the right to know, the right to delete, the right to correct, the right to opt out of sale/sharing, the right to limit the use of sensitive personal information, and the right to non-discrimination. Section 11 explains how to use them.

12.2 Other state privacy laws. Residents of states with comprehensive privacy legislation (including but not limited to Virginia, Colorado, Connecticut, Utah, and Texas) may have additional rights under their respective state laws. We will honor applicable rights requests in accordance with state law.

12.3 Consumer health data. Washington residents, and anyone else whose state law covers consumer health data, can read our Consumer Health Data Privacy Policy.

Do Not Sell or Share My Personal Information. We do not sell your personal information for money. This website uses advertising tools (the Meta Pixel and Google’s advertising features) that some state laws treat as “sharing” for cross-context behavioral advertising, or as targeted advertising. To opt out on this browser, open Your Privacy Choices. We also honor a Global Privacy Control signal as an opt-out on the browser that sends it. To opt out by email, write to legal@auraliftai.com.

13. Children’s Privacy

AuraLift is intended exclusively for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. Our AI companion system includes active age detection, and users identified or suspected to be under 18 are immediately redirected to age-appropriate resources and denied access to the Service.

If we learn that we have collected personal information from a user under 18, we will promptly delete that information and terminate the associated account. If you believe a minor has provided us with personal information, please contact us at support@auraliftai.com.

14. International Data Transfers

AuraLift is operated exclusively from the United States. Our own servers and databases are hosted with Amazon Web Services in the United States. Service providers listed in Section 6.1 may process data in other locations under their own terms. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to the transfer and processing of your information in the United States, which may have different data protection laws than your jurisdiction.

15. Third-Party Links and Services

The Service may contain links to third-party websites, apps, or services (e.g., crisis resources, therapist directories). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing them with your information.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Policy on our website and, where appropriate, sending you an email notification. The effective date at the top of this Policy indicates when it was last revised. Your continued use of the Service after any changes constitutes acceptance of the revised Policy.

17. Contact

Aura Lift AI Development Holdings, LLC, d/b/a AuraLift Ai · Boca Raton, FL
legal@auraliftai.com · support@auraliftai.com

In a crisis, please reach a human. 988 · Text HOME to 741741 · 911

The paperwork.