Auffy fills web forms from documents you upload. That means we handle personal data: yours, and whatever is in the documents you give us. This policy explains what we collect, why, where it goes, how long we keep it and what you can do about it. It covers the Auffy website, the Auffy Chrome extension and the account behind them.
1. Who is responsible
The data controller is BITRUX SYSTEMS SRL, a Romanian company registered at str. Suhurlui 8, Pechea, Galați County, Romania, which owns and operates auffyapp.com. For anything about your data, write to [email protected].
Because we are established in Romania, our processing is governed by the General Data Protection Regulation and by Romanian Law no. 190/2018, and supervised by the National Supervisory Authority for Personal Data Processing (ANSPDCP).
2. What we collect
Account details
When you register we store your first name, last name and email address, and a hashed password if you chose one. If you sign in with Google we receive your Google account ID, name, email address and profile picture, and whether Google has verified your email. If you turn on two-factor authentication we store the secret and recovery codes needed to check your codes.
Your knowledge base
The files you upload to a Project (PDF, Word, text, Markdown, JSON or CSV) and the notes you paste. We extract the text from each file and store it alongside the original so it can be used to answer forms. Whatever personal data those documents contain, about you or about other people, is processed too. You are responsible for having the right to use it.
The forms you fill
When you ask the extension to fill a form it sends us: the page's address (without query strings or fragments), its title, a short extract of the page's headings and text, and the form's structure, including field labels, placeholders, options and any values already typed in. It does not send password, credit-card, one-time-code or CAPTCHA fields; those are filtered out in the browser. It also sends any notes you typed for that form, any chat messages you sent about it, and the language you asked for.
From each fill we keep the website's hostname, the chat transcript for that form, the answers the AI produced, and a record of the credit spent.
Billing
Stripe processes your payments. We store your Stripe customer ID, the type and last four digits of your payment method, your subscription and trial status, and your credit balance. We never see your full card number. Stripe collects your billing address and tax details at checkout.
Technical data
Our servers record the IP address and browser of each signed-in session, and log security-relevant events such as sign-ins, failed logins and extension authorisations, tagged with your user ID or email address. If an administrator acts on your account, that action is recorded with the administrator's IP address.
Support
If you email us we keep the correspondence so we can answer you and follow up later.
3. Why we use it, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Running your account and letting you sign in | Account details, sessions | Performance of our contract with you |
| Filling forms and answering questions about them | Knowledge base, form data, notes, chat | Performance of our contract with you |
| Taking payment, managing plans and credits | Billing data | Performance of our contract; legal obligation for tax and accounting records |
| Sending service emails such as verification, password reset and payment notices | Email address | Performance of our contract |
| Keeping the service secure and preventing abuse | IP addresses, security log, rate-limit counters | Our legitimate interest in protecting the service and its users |
| Answering your questions and enforcing our terms | Support correspondence, account details | Our legitimate interest in running the business; legal obligation where a law requires it |
We do not use your data for advertising, we do not profile you, and we do not sell it.
An email address and basic account details are needed to create and run an account, and billing details are needed for a paid subscription; without them we cannot provide the service. Everything else is your choice — your Projects, the documents and notes you add, the forms you ask us to fill, signing in with Google and two-factor authentication — but Auffy cannot carry out a request without the data that request needs.
4. AI processing
To draft answers we send your Project text, the form data, your notes and the chat history to the AI companies named on the linked page. The same happens when you upload a file: the file is sent so that its text can be read. Which companies these are, what personal data is involved and where each of them is, is set out on our list of companies that handle your data, which is part of this policy and is kept current.
We require those companies to process your content only in order to provide and secure the service, and not to use it to train models. We do not train models on it either. What each of them keeps, and for how long, is governed by its own terms and summarised on that page.
As models improve we expect to change the model we ask for, and in time the company we ask. Changing the model inside a company already listed does not change who receives your data. Sending your data to a different company does, and we update that list before it starts.
Be aware that a language model works from the text it is given. If a web page contains hidden instructions, the model could be tricked into placing information from your Project into a field the page controls. Auffy only ever writes into fields you can see, and nothing is submitted until you press submit, so always review the filled form before sending it.
5. How long we keep it
| Data | Kept for |
|---|---|
| Account details | Until you delete your account |
| Uploaded files and extracted text | Until you delete the file, the Project or your account |
| Form-fill requests, the AI's answers, per-form chat transcripts and AI conversation history | Seven days after the conversation was last used, or sooner when you delete your account |
| AI call log (which model was asked, how long it took, token counts, and the provider's error text when a call failed) | 90 days, or sooner when you delete your account |
| Credit and subscription records | Until you delete your account; invoices are kept by Stripe and by us for as long as tax law requires |
| Signed-in sessions | Removed after two hours of inactivity or when you sign out |
| Extension access tokens | 30 days, or until you sign out of the extension |
| Security log | 90 days |
| Administrative audit entries | Kept after account deletion with your identifier removed |
Deleting your account, from the settings page, cancels your subscription immediately and permanently deletes your Projects, files, form history, conversations, AI call log and tokens. Backups of our database are rotated within three months, so a deleted account, file or conversation can survive in a backup for up to that long. Companies that act as controllers in their own right, such as our payment provider, keep what their own legal obligations and privacy notices require.
6. Who we share it with
We share data only with the companies we need to run Auffy. Our direct providers and routine recipients are named on our list of companies that handle your data, together with what each does, what personal data is involved and which country it is in. In outline they are:
- our hosting provider, a Romanian company whose servers are in Germany: it holds the application, the database, your uploaded files and our outgoing account email;
- the AI companies that draft your answers and read your uploaded files, in the United States and Singapore;
- our payment provider, in Ireland, if you subscribe;
- Google, in Ireland, if you choose to sign in with Google;
- the consent banner on the public website, if it is enabled.
Auffy does not send your Projects or your forms to the payment provider or to Google. Our payment provider acts as our processor for parts of its service and as a controller in its own right for payment, fraud-prevention and legal-compliance purposes; Google acts as a controller in its own right for the Google account you sign in with. Their privacy notices apply to that processing as well as ours. The others act on our instructions, under the data processing terms we have agreed with them.
You are entitled to ask which recipients have actually received personal data about you, and we will name them. Write to [email protected].
We will also disclose data if the law requires it, to protect our rights or the safety of others, or as part of a sale or merger of our business, in which case the new owner takes over this policy.
7. Where your data goes
Our servers are in Germany, and our hosting, payment and sign-in providers are all inside the European Economic Area. The AI companies are not: they are in the United States and Singapore, and neither country is covered by a European Commission adequacy decision that applies to these transfers. For both we rely on the European Commission's Standard Contractual Clauses. You may ask for a copy of the safeguards that apply to a particular transfer by writing to [email protected]; we may redact commercially confidential terms first. The country each company is in is listed on our list of companies that handle your data.
8. Security
All traffic between the extension, the website and our servers is encrypted with HTTPS. Passwords are hashed, never stored in plain text. Uploaded files are stored outside the web root and are only ever served to their owner. The extension holds an access token limited to what the extension does: it can read your account and Project details, create Projects, upload files and ask for a form to be filled, but it cannot delete a Project or a file. It expires after 30 days, and is revoked when you sign out or delete your account. Two-factor authentication is available on every account. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the supervisory authority as the law requires.
9. Your rights
Under the General Data Protection Regulation you can:
- ask for a copy of the personal data we hold about you;
- ask us to correct it, or correct most of it yourself in the account settings;
- ask us to delete it, or delete your files, Projects and account yourself from the website;
- ask us to restrict or stop certain processing, and object to processing based on our legitimate interests;
- receive the data you gave us in a portable format;
- withdraw consent at any time where consent is the basis, without affecting what was done before.
Email [email protected] to exercise any of these. We will reply within one month. You can also complain to your local data protection authority; in Romania that is the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro).
10. Cookies
The website sets only the cookies it needs to run the service and remember your privacy choices: a session cookie that keeps you signed in, a CSRF token that protects forms from cross-site requests and, where the consent banner is enabled, a first-party cookie recording your consent choice. None of them is used for tracking. Stripe sets its own cookies on its checkout and billing pages. We do not use analytics or advertising cookies.
The extension stores your access token and basic profile in Chrome's local extension storage on your device, not in cookies.
The declaration below is generated by our consent tool and lists the cookies our consent tool detects on the public website. If we add any that need consent, the banner will ask you first.
11. The Chrome extension
The extension reads the form and page text described in section 2, sends them to our servers over HTTPS when you ask it to fill, and writes the answers into the form. It does not keep a history of the sites you visit and does not send anything anywhere other than auffyapp.com.
12. Children
Auffy is not for anyone under 18. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.
13. Changes to this policy
We will update this page when our data practices change, and change the date at the top. A change to the companies that handle your data is published on the list of companies that handle your data, before a newly added company starts processing it. If we change this policy in a way that materially affects you — a new purpose for your data, a new legal basis, or a new country your data is sent to — we will email you or show a notice in the app before it applies.
14. Contact
BITRUX SYSTEMS SRL, str. Suhurlui 8, Pechea, Galați County, Romania. Email: [email protected] for general questions, [email protected] for anything about your data.