Privacy Policy

Effective date: October 14, 2026
Last updated: October 14, 2026

This Privacy Policy explains how Auxilian Technologies, Inc. (“Auxilian,” “we,” “us,” or “our”) collects, uses, shares, and protects information when you use the Auxilian web application at app.auxilian.ai, the Auxilian MCP server at mcp.auxilian.ai, and any related services (together, the “Service”).

Auxilian gives you Postgres storage that you, and AI agents you connect, can create, read, update, and share. This policy covers two kinds of information, and we handle them differently:

• Account Information: information about you as a user of the Service, such as your name, email address, and how you use the Service. We decide how this information is used.
• Customer Content: the projects, tables, columns, rows, descriptions, and other data that you or your connected AI agents put into the Service. You decide what goes in and who can see it. We process it only to provide the Service to you (see Section 4).

By using the Service you acknowledge this Privacy Policy. Our Terms of Service govern your use of the Service, and capitalized terms not defined here have the meanings given in the Terms.

1. Summary

• You sign in with Google. We receive your name, email address, and profile picture from Google through our authentication provider, WorkOS. We do not receive your Google password, and we do not access your Gmail, Drive, Calendar, or any other Google data.
• We do not sell your personal information. We do not share it for cross-context behavioral advertising. We do not use third-party analytics or advertising trackers.
• We do not use your Customer Content to train AI models. We do not sell it, and we do not look at it except as described in Section 4.3.
• When you connect an AI assistant such as Claude, data you or the assistant access through Auxilian goes to that assistant's provider. Their privacy policy governs it from that point.
• You can delete your account from Settings at any time. Section 8 explains what happens to your data when you do.

2. Information We Collect

2.1 Information you provide or authorize

2.2 Information collected automatically

We do not collect precise geolocation, payment card information, or government identifiers. We do not use advertising identifiers, tracking pixels, or third-party analytics.

2.3 Information we do not want

Do not upload sensitive data to the Service, including:

• Protected health information.
• Payment card data.
• Government-issued identification numbers.
• Biometric data.
• Precise geolocation.
• Information about children under 13.
• Any data subject to heightened legal protection, such as “special categories” of data under the GDPR.

The Service is not designed or certified for this kind of data. Uploading it is prohibited by our Terms of Service.

3. How We Use Account Information

We use Account Information to:

1. Provide the Service:
   • Create and authenticate your account.
   • Create your personal workspace.
   • Show your name and profile picture in the product.
   • Resolve invitations that were sent to your email address.
   • Let you collaborate with other people.
2. Operate AI connectors. We issue and validate the tokens that let AI clients you authorize act as you, within the scopes you approved.
3. Keep the Service secure and available:
   • Enforce usage limits and rate limits, which we apply per user and, for sign-in and client registration, per IP address.
   • Detect and prevent fraud, abuse, and security incidents.
   • Investigate violations of our Terms.
4. Communicate with you. We send service-related messages such as workspace invitations, security notices, and changes to our terms or this policy, and we respond to your requests.
5. Maintain and improve the Service. We debug errors, monitor performance and capacity, and decide which features to build. For this we use operational data, not Customer Content.
6. Comply with law. We meet legal obligations, enforce our agreements, and establish, exercise, or defend legal claims.

We do not use Account Information for targeted advertising, and we do not sell it.

4. How We Handle Customer Content

4.1 Your content, your control

You control your Customer Content. Workspace owners and admins, and anyone else granted access to a project, can view and change that project's content, as described in the product and the Terms. Make sure you have the rights and any required notices or consents to put personal information about other people into the Service.

4.2 Our role

For personal information inside Customer Content, you or your organization act as the controller, or “business.” We act as a processor, or “service provider,” and process that information only:

• To provide, secure, and support the Service.
• On your instructions, including instructions given through AI agents you have authorized.
• As required by law.

4.3 When we access Customer Content

We do not routinely access Customer Content. Authorized personnel may access it only when:

• You ask us to, for example for support.
• It is needed to investigate a security incident, abuse, or a suspected violation of our Terms.
• It is needed to keep the Service running, for example to diagnose a failing database operation.
• The law requires it.

4.4 No AI training

We do not use Customer Content to train, fine-tune, or improve any machine-learning model.

5. How We Share Information

We share information only as described below.

5.1 With other users, at your direction

• Workspace and project members. Other members of your workspaces can see your name, email address, profile picture, and role. Members of a project can see its Customer Content and its activity log, which identifies who performed each action.
• People you invite. When you invite someone to a workspace, we send them an invitation email through our authentication provider, WorkOS. The email identifies you and the workspace.

5.2 With AI clients you connect

When you connect an AI client, such as Claude by Anthropic, to the Auxilian MCP server and approve the connection, that client can read, and if you granted write permission, change, the data you have access to in Auxilian.

• Information the client retrieves leaves our control and is handled under the client provider's terms and privacy policy.
• You can revoke a connection at any time from the AI client's settings. Tokens also expire on their own.
• Actions the client takes appear in the project activity log as coming from the connector.

5.3 With service providers (subprocessors)

We use the following vendors to run the Service. They may process information only on our behalf and under contractual confidentiality and data-protection obligations.

5.4 Other disclosures

We may disclose information:

• To comply with law. For example, in response to a valid subpoena, court order, or other legal process, or to meet a legal obligation. Where the law allows and it is practical, we will try to notify you before disclosing Customer Content.
• To protect rights and safety. To protect the rights, property, or safety of Auxilian, our users, or the public, including to prevent fraud and abuse.
• In a business transfer. In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets. This policy, or a policy at least as protective, will continue to apply to the information transferred.
• With your consent. Or at your direction.

We do not sell personal information. We do not “share” it, as that term is defined under California law, for cross-context behavioral advertising.

6. Cookies and Similar Technologies

We use only strictly necessary cookies. We do not use advertising, analytics, or cross-site tracking cookies, so we do not show a cookie consent banner.

If you block these cookies, you will not be able to sign in.

7. Data Location and International Transfers

We are a Delaware corporation based in California, United States. The Service's database is hosted in the United States (AWS us-east-1, through Supabase). Our application runs on Cloudflare's global network, so requests may be processed in a data center near you before they reach the database.

If you use the Service from outside the United States, your information will be transferred to, stored in, and processed in the United States and other countries whose data-protection laws may differ from yours. Where the law requires it, for example for transfers from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards. These include the European Commission's Standard Contractual Clauses and the UK Addendum, as incorporated into our agreements with our service providers.

8. Data Retention and Deletion

8.1 Deleting your account

You can delete your account from Settings → Delete account. When you do:

• Workspaces you own are permanently deleted, along with every project, table, and row in them.
  • If a workspace you own has other members, you must remove them before you can delete your account. This prevents the deletion from destroying other people's work.
• Projects you created in someone else's workspace are not deleted. They pass to that workspace's owner, because they belong to that workspace.
• Your memberships and project access grants are removed, and pending invitations to your email address are deleted.
• Your user record is deleted from our database and from our authentication provider.
• Residual copies:
  • Activity log entries in other people's projects that record actions you took remain visible to those project members until they expire under the 90-day rule.
  • Copies in backups and logs expire on the schedules above.

We may keep limited information for longer where the law requires it, or where it is needed to resolve disputes, prevent abuse, or enforce our agreements.

9. Security

Our safeguards include:

• Encryption in transit (TLS/HTTPS everywhere, with HSTS).
• Encryption at rest by our infrastructure providers.
• Encrypted, HTTP-only session cookies.
• A least-privilege database role for all application access, with row-level security on our internal tables and per-project isolation of Customer Content.
• Server-side permission checks on every operation.
• Scoped, revocable OAuth tokens for AI connectors.
• Rate limiting.
• An audit log of project activity.

No system is perfectly secure, and we cannot guarantee the security of your information. You are responsible for:

• The security of your Google account.
• Deciding whom you grant access to.
• Deciding which AI clients you connect and what permissions you give them.

If we learn of a security breach affecting your personal information, we will notify you and the relevant authorities as the law requires.

10. Your Rights and Choices

10.1 Everyone

• Access and export. You can view your Customer Content in the product and export tables as CSV.
• Correction. Your name and profile picture come from your Google account and refresh each time you sign in. You can edit Customer Content directly.
• Deletion. You can delete content, projects, and your account yourself (see Section 8).
• Disconnect AI clients. You can revoke connector access from the AI client's settings.
• Email. We send only service-related email. We do not send marketing email.

For any request you cannot complete yourself, contact us at [email protected]. We may need to verify your identity before acting on a request.

10.2 EEA, UK, and Swiss residents

If the GDPR or the UK GDPR applies to you, you have the right to:

• Access, rectify, or erase your personal data.
• Restrict or object to its processing.
• Receive it in a portable format.
• Withdraw consent where we rely on consent.

You also have the right to lodge a complaint with your local data-protection authority.

Our legal bases for processing Account Information are:

• Performance of a contract. Providing the Service under our Terms.
• Legitimate interests. Securing the Service, preventing abuse, debugging, and improving the Service. These interests are balanced against your rights.
• Legal obligation. Where the law requires the processing.
• Consent. Where we ask for it.

10.3 California and other U.S. state residents

If the California Consumer Privacy Act (as amended by the CPRA) or a similar state privacy law applies to you, you have the right to:

• Know what personal information we collect, use, and disclose.
• Access it.
• Correct it.
• Delete it.
• Opt out of its “sale” or “sharing.” We do neither.
• Limit the use of sensitive personal information. We do not use sensitive personal information for purposes that would trigger this right.

We will not discriminate against you for exercising any of these rights. You may use an authorized agent, subject to verification.

In the past 12 months, we collected the following categories of personal information, for the business purposes described in Section 3, and disclosed them to the service providers listed in Section 5.3:

• Identifiers: name, email, user ID, IP address.
• Customer records information: name and email.
• Internet or other electronic network activity information: request logs and the activity log.
• Inferences: none.

If we deny your request, you may appeal by replying to our decision or emailing [email protected] with the subject line “Privacy Appeal.”

11. Google User Data

Auxilian's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

We request only the basic openid, email, and profile scopes. We use that information only to:

• Sign you in.
• Identify you to other members of your workspaces.
• Display your profile picture.

We do not transfer it to others except as needed to provide the Service, to comply with law, or as part of a merger or acquisition. We do not use it for advertising, and we do not use it to train AI models.

12. Children

The Service is not directed to children. You must be at least 18 years old to use it (see our Terms of Service). We do not knowingly collect personal information from children under 13, or under 16 in the EEA and UK. If you believe a child has given us personal information, contact us at [email protected] and we will delete it.

13. Third-Party Services

The Service links to and integrates with services we do not control, including Google, WorkOS's hosted sign-in page, and AI clients you choose to connect. Their own privacy policies govern how they handle your information. Profile pictures are loaded directly from Google's servers, so Google may receive the IP address of the person viewing them.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will:

• Notify you by email or through the Service before the changes take effect.
• Update the “Last updated” date at the top of this policy.

If you keep using the Service after the changes take effect, the updated policy applies to you.

15. Contact Us

Auxilian Technologies, Inc.
251 Little Falls Drive
Wilmington, DE 19808, United States
Email: [email protected]