Back to Auro
Auro

Privacy Policy

Effective: 28 September 2026

1. Who we are

This Privacy Policy explains how Auro collects and uses personal data when you use Auro, our construction cost planning, benchmarking, pricing, tendering and document production platform at app.auro.build, when you visit our website at auro.build and when you contact us or ask for a demonstration.

Auro is operated by Auro Online Limited ("Auro", "we", "us", "our"), a company registered in England and Wales (company number 17310305) with its registered office at 131 Finsbury Pavement, London, England, EC2A 1NT. Auro Online Limited is the data controller for the personal data described in this policy, and is registered with the Information Commission, the UK data protection regulator, formerly the Information Commissioner's Office (registration number ZC186921).

For any privacy question or request, or to exercise your rights, contact us at hello@auro.build.

2. What this policy covers

This policy covers personal data we process about the people who use Auro, including account holders, members of organisations on Auro (organisations are called workspaces in the app) and people who are invited to join. It also covers people who visit our website, contact us or ask for a demonstration. It does not cover third-party websites we link to.

A note on roles: when you add information about other people into Auro as part of your own projects (for example a client's name, a site address, or a contractor's contact details), you are responsible for that information as its controller, and we process it on your behalf to provide the Service.

3. The personal data we collect

  • Account and profile: your name, email address, profile image and similar details, provided through our authentication provider (including where you sign in using a third-party login such as Google).
  • Organisation data: if you create or join an organisation, we process membership details, roles and invitations (including invitee email addresses).
  • Your project content: the information you put into Auro, which can include personal data: for example client names, site addresses and location coordinates, uploaded price-list files, cost plans, pricing documents, tenders and tender returns, and the messages or short voice notes you provide when using AI features.
  • Contractor contacts and tender invitations: if your organisation uses tender features, the names, company names and email addresses of the contractor contacts it adds, and the tender invitations emailed to those addresses (these contacts may not hold Auro accounts).
  • Usage and activity data: records of actions taken in the Service (such as creating or editing documents), used for features like history and audit and to keep the Service secure.
  • Technical data: information your device and browser send automatically, such as IP address, device/browser type, and basic analytics about how the Service is used.
  • Support data: information you give us when you contact us, for example by email.
  • Enquiry data: if you contact us, ask for a demonstration or fill in a form on our website, the details you give us, such as your name, work email address, company, a few questions about how you work, any notes you add and the time of any call you book with us. Our customer relationship management provider may add publicly available business information, such as a job title, to these details.

4. How we collect it

We collect personal data: directly from you when you use Auro, contact us or fill in a form on our website; automatically as you use the Service or our website; from our authentication provider and any third-party login you choose to use; and, if you join an organisation, from that organisation's administrator.

5. Why we use your data, and our legal bases

We use personal data to:

  • provide, operate and secure the Service, manage your account and organisation, and handle your subscription and payments. Legal basis: performance of our contract with you;
  • keep the Service safe, prevent misuse, fix problems, and improve and develop our features. Legal basis: our legitimate interests in running and improving a secure, reliable service;
  • respond to your enquiries and arrange and hold demonstrations. Legal basis: our legitimate interests in responding to people who contact us, and steps taken at your request before entering into a contract;
  • send you service and account messages. Legal basis: contract and/or legitimate interests;
  • send you marketing about Auro, such as product news and feature updates, and one reminder if you start booking a demonstration and do not finish. Legal basis: our legitimate interests in promoting our services to business users, or your consent where the law requires it;
  • comply with our legal obligations. Legal basis: legal obligation;
  • do anything you specifically agree to. Legal basis: consent (which you can withdraw at any time).

You can opt out of marketing at any time, using the link in any message or by emailing hello@auro.build, and we will stop promptly. When you ask for a demonstration you can also opt out at the time by ticking the box on the form, and we will not send the reminder either. Service and account messages (for example billing or security notices) are not marketing.

6. AI features

Some features use third-party AI providers to process your content, for example to import supported documents, extract information from uploaded price lists and schedules, help you edit cost plans and pricing documents, transcribe short voice notes, or compare benchmarks. Only the content needed for the feature is sent to these providers.

We use third-party AI providers whose terms do not permit your content to be used to train or improve their models. Depending on the provider and model, content may be retained for a limited period for security, safety and legal compliance purposes before being deleted. Where zero data retention options are available, we use them. Requests may be routed to providers through intermediary services that do not retain the content of your requests. We may change the models, providers or services we use from time to time. The providers we currently use are listed on our Sub-Processors page.

Our AI features are there to assist you, and a person is always in control. They do not make solely-automated decisions that produce legal or similarly significant effects about you.

7. Who we share your data with

We do not sell your personal data. We share it only with:

  • Other Auro users, when you use features that share content between organisations, at your or your organisation's direction: for example, issuing a tender shares its content and your organisation's name with the invited contractors, and submitting a tender return shares it with the issuing organisation.
  • Service providers who help us run Auro and who act on our instructions. These fall into the following categories: cloud hosting and database; authentication; AI processing; document and PDF generation; email delivery; error monitoring; product analytics; customer relationship management; scheduling and video meetings; and payment processing.
  • Professional advisers, authorities and regulators, where we are required to share, or where it is necessary to protect our rights or comply with the law.
  • A buyer or successor, if our business is reorganised, sold or transferred (with your rights protected).

We choose providers that offer appropriate protection for your data, and we put data-processing terms in place with them. The current list of these providers is published on our Sub-Processors page. Where we take card payments, they are processed by our payment provider, which acts as an independent data controller for your payment information under its own privacy policy.

8. Where your data is processed (international transfers)

We aim to keep your data within the UK or European Economic Area (EEA) where we can, and our main database is hosted in the EEA. Some of our providers are based outside the UK, including in the United States, so some personal data may be transferred internationally. Where it is, we rely on a recognised legal transfer mechanism, such as the UK Extension to the EU-US Data Privacy Framework (the "UK-US Data Bridge"), or the UK International Data Transfer Agreement / the UK Addendum to the EU Standard Contractual Clauses, to keep your data protected.

9. How long we keep it

We keep personal data for as long as your account or organisation is active. After your account or organisation is closed, by you or by us under our Terms, or your membership ends, we delete or anonymise your personal data within a reasonable period, normally within 30 to 90 days, except where we need to keep certain information for longer to meet a legal, accounting or security obligation, such as billing and transaction records, which we keep for up to six years for tax and accounting purposes. Backups are overwritten on a rolling basis shortly afterwards. Content you have submitted to another organisation (such as a tender return) forms part of that organisation's records, and is retained under their account even after yours closes.

If you contact us or ask for a demonstration without becoming a customer, we keep your enquiry details for up to 24 months after our last contact with you, or for as long as we have an ongoing business relationship with you, and delete them sooner if you ask.

10. How we keep it safe

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, keeping each customer's data separated, and an error-monitoring tool configured to strip out personal information. No system is completely secure, but we work to protect your data and to deal quickly with any problems.

11. Your rights

Under UK data protection law you have the right to: access your personal data; have it corrected; have it erased; restrict or object to how we use it; ask for a copy in a portable format; and, where we rely on consent, withdraw that consent. To exercise any of these, email hello@auro.build. We will respond within one month. These rights are usually free, and some limits and exceptions apply under the law.

If you have put other people's personal data into Auro as part of your projects, some requests about that data may be for you (as its controller) to handle. We will help where we can.

12. How to complain

If you have a concern about how we handle your personal data, please contact us first at hello@auro.build so we can put it right. We will acknowledge your complaint within 30 days and respond to it without undue delay. You also have the right to complain to the Information Commission (formerly the Information Commissioner's Office), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

13. Cookies

Auro uses a small number of cookies and similar technologies, mostly to keep you signed in and to remember your preferences. For details, see our Cookie Policy.

14. Children

Auro is for business and professional use and is not intended for anyone under 18. We do not knowingly collect data about children.

15. Changes to this policy

We may update this policy from time to time. If we make a significant change, we will take reasonable steps to let you know. The date at the top shows when the current version took effect.

16. Contact us

Auro Online Limited, 131 Finsbury Pavement, London, England, EC2A 1NT. Email hello@auro.build.