Auffy fills web forms from documents you upload. That means we handle personal data: yours, and whatever is in the documents you give us. This policy explains what we collect, why, where it goes, how long we keep it and what you can do about it. It covers the Auffy website, the Auffy Chrome extension and the account behind them.
1. Who is responsible
The data controller is BITRUX SYSTEMS SRL, a Romanian company registered at str. Suhurlui 8, Pechea, Galați County, Romania, which owns and operates auffy.net. For anything about your data, write to [email protected].
2. What we collect
Account details
Account and sign-in information, such as your name, email address, country and sign-in details. If you sign in with Google, we receive account information from Google, such as your Google account identifier, name, email address and profile picture.
Your knowledge base
The Projects you create and what you add to them, such as documents, images and notes. Where we can read a file, we store its text with it so it can be used to answer forms. This content may include personal data about you or other people, which we process to provide the service. Only add information you are allowed to share with us, and please do not add sensitive information about yourself or anyone else, such as health data, ethnic origin, political or religious beliefs, or sexual orientation.
The forms you fill
When you ask the extension to fill a form, it sends us the content of that page and form, including anything already entered in it, together with your notes and chat messages for that form. It is designed not to send passwords or payment card details.
We keep records of your fill requests, such as the page address, the request sent to the AI and its answers, and a record of the credits used, including the site.
Billing
Stripe processes your payments and collects your payment and billing details at checkout. We keep what we need to run your subscription, such as your Stripe customer reference, the type and last four digits of your payment method, your plan and your credit balance.
Technical data
Technical information, such as your IP address and browser, sessions and access tokens, security logs and technical records of AI requests.
Support
If you contact us, we keep your message and our replies so we can handle your request.
3. Why we use it, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Running your account and letting you sign in | Account details, sessions | Performance of our contract with you |
| Filling forms and answering questions about them | Knowledge base, form data, notes, chat | Performance of our contract with you |
| Taking payment, managing plans and credits | Billing data | Performance of our contract; legal obligation for tax and accounting records |
| Sending service emails such as verification, password reset and payment notices | Email address | Performance of our contract |
| Keeping the service secure and preventing abuse | IP addresses, security log, rate-limit counters | Our legitimate interest in protecting the service and its users |
| Answering your questions and enforcing our terms | Support correspondence, account details | Our legitimate interest in running the business; legal obligation where a law requires it |
We do not use your data for advertising, we do not profile you for advertising, and we do not sell it.
An email address, basic account details and, for a subscription, billing details are needed to provide the service. Everything else you add is your choice, but Auffy cannot carry out a request without the data that request needs.
4. AI processing
To draft answers we send your Project text, the form data, your notes and the chat history to the AI companies named on the linked page. When you upload a file, depending on its type, the file or the text read from it may be sent to an AI company to be read. Which companies these are, what personal data is involved and where each of them is, is set out on our list of companies that handle your data, which is part of this policy.
We use AI companies whose published terms say they do not use this content to train their models, and we do not train models on it either. What each of them keeps, and for how long, is governed by its own terms.
5. How long we keep it
| Data | Kept for |
|---|---|
| Account details | Until you delete your account |
| Uploaded files and extracted text | Until you delete the file, the Project or your account; copies used in a conversation are kept for that conversation's period |
| Form-fill requests, the AI's answers, per-form chat transcripts and AI conversation history | Up to six months after the conversation was last used |
| Technical records of AI requests | Up to one year |
| Credit and subscription records | Until you delete your account; invoices are kept by Stripe and by us for as long as tax law requires |
| Sessions and extension access tokens | Until you sign out or they expire |
| Security logs | Up to 90 days |
| Support correspondence | As long as needed to handle your request |
Deleting your account, from the settings page, cancels your subscription immediately and deletes your Projects, files, form history, conversations and tokens, and removes your identifier from the records of AI requests. Deleted data can remain in our backups for a limited time before they are overwritten.
6. Who we share it with
We share data with the companies we use to run Auffy. The main ones are named on our list of companies that handle your data, together with what each does, what personal data is involved and which country it is in. In outline they are:
- our hosting provider, a Romanian company whose servers are in Germany: it holds the application, the database, your uploaded files and our outgoing account email;
- the AI companies that draft your answers and read your uploaded files, in the United States and Singapore;
- our payment provider, in Ireland, if you subscribe;
- Google, in Ireland, if you choose to sign in with Google;
- the consent banner on the public website, if it is enabled.
Auffy does not send your Projects or your forms to the payment provider or to Google, which are also controllers in their own right for their part. The others process it to provide their service to us, under their own published terms.
We will also disclose data if the law requires it, or to protect our rights or the safety of others. If our business is sold, your data is transferred only as the law allows, and only with your consent where the Chrome Web Store's rules require it.
7. Where your data goes
Our servers are in Germany, and our hosting, payment and sign-in providers are based in the European Economic Area. The AI companies are not: they are in the United States and Singapore, and neither country is covered by a European Commission adequacy decision that applies to these transfers. For these transfers we rely on the safeguards each company describes in its own published terms. You can ask us about them by writing to [email protected].
8. Security
Traffic between the extension, the website and our servers is sent over HTTPS, passwords are hashed, and access to your files is restricted. The extension's access token is limited to the extension's features and is revoked when you sign out or delete your account. Two-factor authentication is available. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the supervisory authority as the law requires.
9. Your rights
Under the General Data Protection Regulation you can:
- ask for a copy of the personal data we hold about you;
- ask us to correct it, or correct most of it yourself in the account settings;
- ask us to delete it, or delete your files, Projects and account yourself from the website;
- ask us to restrict certain processing;
- receive the data you gave us in a portable format;
- ask which recipients have received personal data about you;
- withdraw consent at any time where consent is the basis, without affecting what was done before.
You can object at any time to processing based on our legitimate interests.
Email [email protected] to exercise any of these. We will reply within one month, or tell you within that month if we need longer, as the law allows. You can also complain to your local data protection authority; in Romania that is the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro).
10. Cookies
The website uses cookies to run the service and remember your privacy choices: a session cookie that keeps you signed in, a longer-lasting one if you choose "Remember me", a security token that protects forms and, where the consent banner is enabled, a first-party cookie recording your consent choice. None of them is used for tracking. Stripe sets its own cookies on its checkout and billing pages. We do not use analytics or advertising cookies.
The extension stores your sign-in, settings and working data such as notes and chat in Chrome's extension storage on your device, not in cookies.
The declaration below is generated by our consent tool and lists the cookies our consent tool detects on the public website. If we add any that need consent, the banner will ask you first.
11. The Chrome extension
The extension looks at pages in your browser to find forms it can help with. When you ask it to fill, it sends the data described in section 2 to our servers and writes the answers into the form.
Auffy's use of information received through the extension and from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
12. Children
Auffy is not for anyone under 18. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.
13. Changes to this policy
We will update this page when our data practices change, and change the date at the top. Changes to the companies that handle your data are published on the list of companies that handle your data. If we change this policy in a way that materially affects you — a new purpose for your data, a new legal basis, or a new country your data is sent to — we will email you or show a notice in the app before it applies.
14. Contact
BITRUX SYSTEMS SRL, str. Suhurlui 8, Pechea, Galați County, Romania. Email: [email protected] for general questions, [email protected] for anything about your data.