Privacy Policy
Version 1.2 | Effective August 13, 2026
This Privacy Policy describes how AurellaAI, Inc. (“AurellaAI,” “we,” or “us”) collects, uses, and discloses personal information when AurellaAI acts on its own behalf — that is, in the operation of its websites, in its dealings with prospective and current subscriber firms, and in its marketing, sales, support, and business operations. It applies to the AurellaAI website, to any AurellaAI web property or evaluation tool that links to this Policy, and to communications between AurellaAI and the individuals who interact with it.
What this Policy does not cover
This Policy does not describe how AurellaAI processes information on behalf of a subscriber firm. Where a professional services firm (a “Subscriber”) has licensed the Aurella platform (the “Platform”), AurellaAI processes information on that firm’s instruction and for that firm’s purposes, under the Master Subscription Agreement between AurellaAI and the firm. In that processing AurellaAI is a service provider, not a controller, and the firm’s own privacy notice governs. Individuals whose information is processed in that way should direct inquiries to the firm with which they have a relationship. One exception is described in Section 10. Where AurellaAI delivers text messages to a Subscriber’s clients, AurellaAI is the sender of record for those messages and operates that messaging channel on its own behalf, and Section 10 governs it. The Subscriber’s own privacy notice continues to govern the Subscriber’s collection and use of its clients’ information for every other purpose.
Practitioners who access the Platform as authorized Users of a Subscriber should read the Practitioner Privacy Notice, which AurellaAI furnishes to Subscribers and which Subscribers make available to their Users before first access. That Notice, not this Policy, describes what the Platform generates about a practitioner and who can see it.
This Policy does not address AurellaAI’s handling of information about job applicants, employees, or other personnel. It is not a contract and creates no rights or obligations beyond those imposed by applicable law.
1. INFORMATION WE COLLECT
The information AurellaAI collects depends on how an individual interacts with it.
Information provided directly
Contact and professional information — name, business email address, telephone number, firm name, role or title, professional credentials, and jurisdiction of practice — provided when an individual requests a demonstration, contacts AurellaAI, subscribes to communications, registers for an event, or corresponds with AurellaAI. We use this information to respond to the request, to evaluate and administer a prospective or existing commercial relationship, and to send communications in accordance with the individual’s preferences and applicable law.
Account and administrative information — credentials, authentication factors, account settings, designated contacts, and administrative configuration — provided in the course of establishing or administering a Subscriber account. We use this information to provision and administer access, to authenticate Users, and to provide support.
Evaluation tool inputs — information entered into any self-service tool, calculator, matrix generator, or similar utility made available on a AurellaAI web property, together with the email address and other registration details supplied in order to continue using it beyond any free-use threshold. We use these inputs to operate the tool, to generate and deliver its output, to understand how the tool is used, and to assess and pursue commercial interest.
Commercial and diligence information — information exchanged in the course of contracting, security review, procurement, and vendor onboarding, including the identities and contact details of a firm’s personnel involved in that process.
Billing information — billing contact details, purchase orders, and remittance information. Payment card and bank account details are collected and processed by third-party payment processors, and AurellaAI does not retain full payment instrument numbers.
Feedback and support information — the contents of support requests, correspondence, survey responses, testimonials, and, where permitted by applicable law and with notice, recordings or transcripts of calls and meetings.
Information collected automatically
When an individual visits a AurellaAI web property or uses the Platform, AurellaAI and its service providers automatically collect device and network information (including IP address, device and browser type, operating system, and identifiers associated with a device or browser); activity information (including pages viewed, referring and exit pages, links followed, session duration, email opens and click-throughs, feature usage, error and diagnostic events, and authentication and access events); and approximate location derived from IP address. Collection is by means of cookies, pixels, tags, embedded scripts, server logs, and similar technologies. Section 6 describes the choices available.
Information of this kind generated through use of the Platform constitutes Usage Data as defined in the Master Subscription Agreement, and AurellaAI’s rights in respect of it are as set out there.
Information from other sources
AurellaAI may receive information about an individual from the firm that employs or engages them; from Subscriber administrators who provision access on their behalf; from professional and business contact data providers, marketing and analytics providers, and event and association partners; from publicly available and generally available sources, including professional directories, regulatory registries, and firm websites; from single sign-on and identity providers where an individual elects to authenticate through them; and from referrals.
2. HOW WE USE INFORMATION
AurellaAI uses personal information to operate its business and to provide, maintain, secure, and improve the Platform and its web properties. Specifically, AurellaAI uses personal information to respond to inquiries and fulfil requests; to evaluate, negotiate, establish, administer, and perform commercial relationships with Subscribers; to provision, authenticate, and administer access; to invoice and collect fees; to provide support and to investigate and resolve issues; to operate, test, maintain, secure, monitor, audit, and improve the Platform, its web properties, and its internal systems; to develop new features, capabilities, and offerings; to detect, investigate, and prevent fraud, abuse, unauthorized access, and other malicious, deceptive, or unlawful activity; to conduct research and analysis concerning its market, its users, and the performance of its offerings; to market its offerings and to develop, target, measure, and improve its marketing; to administer events, promotions, and surveys; to establish, exercise, and defend legal claims and to enforce its agreements and policies; to effect a corporate transaction; and to comply with applicable law and with its contractual obligations.
AurellaAI also uses personal information to create de-identified and aggregated information. Once information has been de-identified and aggregated such that it can no longer reasonably be associated with an identifiable individual, AurellaAI uses and discloses it for any lawful purpose, and this Policy does not restrict that use. Where such information is derived from information processed on a Subscriber’s behalf, the de-identification standards in the Master Subscription Agreement apply.
Improvement of the Platform
The Platform improves over time. AurellaAI uses information generated through use of the Platform, including information about how Users interact with it, to maintain, correct, evaluate, and improve the Platform and the capabilities on which it depends, and to develop new capabilities.
Two limits apply to that use, and they are contractual rather than discretionary. First, information is de-identified and aggregated in accordance with the standards set out in the Master Subscription Agreement before it is used beyond the purposes for which it was provided, and those standards require that no individual practitioner and no individual firm be identifiable from the result. Second, AurellaAI does not train models on identifiable Client Tax Return Information at any time. Information that has been de-identified and aggregated is not subject to deletion; Section 5 addresses this.
Legal bases
Where applicable law requires AurellaAI to identify a legal basis for processing, AurellaAI relies on the performance of a contract with the individual or with the firm they represent; on its legitimate interests in operating, securing, improving, and marketing its business, where those interests are not overridden by the individual’s rights; on compliance with legal obligations; and, where required, on consent. Where AurellaAI relies on consent, consent may be withdrawn as described in Section 6, and withdrawal does not affect the lawfulness of processing carried out before withdrawal. Where AurellaAI relies on consent, it obtains that consent separately from any other information provided to the individual, in a manner and with an emphasis appropriate to the sensitivity of the information concerned, and at or before the time of collection.
3. HOW WE DISCLOSE INFORMATION
AurellaAI discloses personal information to service providers and subprocessors that perform functions on its behalf, including hosting and cloud infrastructure, storage, security monitoring, analytics, customer relationship management, marketing, email delivery, text message delivery, payment processing, and professional services. These parties are permitted to process personal information only as necessary to perform those functions and are bound by written obligations of confidentiality and security.
AurellaAI discloses personal information to the firm that employs or engages an individual, where the individual interacts with AurellaAI in that capacity. This includes disclosing to a Subscriber information concerning its Users’ access to and use of the Platform, and the reporting the Subscriber has licensed.
AurellaAI discloses personal information to professional advisors, including legal counsel, accountants, auditors, and insurers, in the ordinary conduct of its business.
AurellaAI discloses personal information in connection with a corporate transaction — including a financing, merger, acquisition, reorganization, sale of assets, or insolvency proceeding — to prospective and actual counterparties and their advisors, and as an asset in any such transaction.
AurellaAI discloses personal information where it believes in good faith that disclosure is necessary or appropriate to comply with applicable law or legal process; to respond to a lawful request from a governmental, regulatory, or law enforcement authority; to establish, exercise, or defend legal claims; to enforce its agreements, policies, and terms; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of AurellaAI, its Subscribers, its personnel, or any other person.
AurellaAI discloses personal information with the individual’s consent or at their direction, and discloses de-identified and aggregated information as described in Section 2.
AurellaAI does not sell personal information, and does not disclose personal information for cross-context advertising or targeted advertising, as those terms are defined under applicable state privacy legislation.
4. LOCATION OF INFORMATION AND CROSS-BORDER TRANSFER
AurellaAI is incorporated in the State of Delaware and its infrastructure for the Platform is located in the United States. Personal information collected under this Policy is processed and stored in the United States, and AurellaAI personnel located in the United States and in Canada may access it for support, maintenance, and engineering purposes.
Individuals outside the United States should understand that personal information transferred to the United States may be subject to lawful access by United States governmental authorities under United States law, on terms that differ from those applying in the individual’s own jurisdiction, and that AurellaAI may not be able to prevent such access. Where an individual’s personal information is transferred in connection with a Subscriber’s use of the Platform, the Subscriber is responsible for providing the notice its own obligations require, and the Master Subscription Agreement and the Practitioner Privacy Notice address that transfer.
Where AurellaAI transfers personal information across borders in reliance on a legal mechanism prescribed by applicable law, AurellaAI implements the measures that mechanism requires.
5. RETENTION
AurellaAI retains personal information for as long as necessary to fulfil the purposes described in this Policy, and thereafter for so long as required or permitted by applicable law, by its records retention practices, or by its legitimate business interests, including the resolution of disputes, the enforcement of its agreements, and the establishment or defence of legal claims. In determining an appropriate retention period, AurellaAI considers the volume, nature, and sensitivity of the information, the purposes for which it is processed, the potential for harm from unauthorized use or disclosure, whether those purposes can be achieved by other means, and its legal, regulatory, and contractual obligations.
Retention of information processed on a Subscriber’s behalf is governed by the Master Subscription Agreement, not by this Section.
Where retention is no longer necessary, AurellaAI deletes or de-identifies the information, or, where deletion is not reasonably practicable — for example because the information is held in backup or archival media — securely stores it and isolates it from further active processing until deletion becomes practicable.
Information that has been de-identified and aggregated is no longer information about an identifiable individual and cannot be isolated or extracted. A request to delete personal information will be given effect in respect of identifiable information; it cannot unwind a de-identified aggregate.
6. CHOICES
Marketing communications
An individual may stop receiving promotional communications from AurellaAI by following the unsubscribe instructions in any such communication or by contacting AurellaAI as described in Section 11. Communications relating to an account, a transaction, security, or a change to terms are not promotional and cannot be declined while an account remains active, except that text messages may be stopped at any time as described in Section 11.
Cookies and similar technologies
Most browsers allow cookies to be blocked or deleted through their settings, and device settings may permit the resetting or limiting of advertising identifiers. Where AurellaAI presents a cookie banner or preference control on a web property, an individual may use it to manage non-essential technologies; technologies that are strictly necessary to operate a web property or the Platform cannot be disabled. Disabling technologies may impair functionality. AurellaAI does not currently respond to browser “do not track” signals.
Withdrawal of consent
Where AurellaAI processes personal information on the basis of consent, that consent may be withdrawn by contacting AurellaAI as described in Section 11. Withdrawal is prospective. It does not affect the lawfulness of processing carried out before withdrawal, it does not require AurellaAI to reverse or unwind processing already performed, and it does not extend to de-identified and aggregated information as described in Section 5.
7. INDIVIDUAL RIGHTS
Applicable law may grant an individual rights in respect of their personal information. Depending on the jurisdiction and the circumstances, these may include the right to confirm whether AurellaAI processes personal information about them and to obtain access to it; the right to obtain a copy in a portable format; the right to have inaccurate information corrected or incomplete information completed; the right to request deletion; the right to restrict or object to certain processing; the right to withdraw consent; the right to be informed of the reasoning applied in an automated decision producing a significant effect and to request that a natural person review it; and the right not to be subjected to discriminatory treatment for exercising a right.
These rights are not absolute. They apply only to the extent granted by the law applicable to the individual, and they are subject to the exceptions that law provides — including where AurellaAI is required to retain information, where a request would adversely affect the rights of another person, where information is subject to legal privilege or an obligation of confidentiality, and where AurellaAI is unable to verify the identity of the requester. AurellaAI is obliged to give effect to these rights only where it acts as a controller of the information in question.
Where AurellaAI processes personal information on behalf of a Subscriber, the Subscriber is the accountable organization. AurellaAI will not respond directly to a request concerning such information; it will refer the request to the Subscriber’s designated contact within five business days, and the Subscriber will respond in accordance with its own obligations.
Requests may be submitted as described in Section 11. AurellaAI will require information sufficient to verify the identity of the requester and may request further information for that purpose. An authorized agent may submit a request on an individual’s behalf on production of evidence of authority. An individual may appeal a decision by writing to AurellaAI, and may lodge a complaint with the supervisory authority having jurisdiction, including the Office of the Privacy Commissioner of Canada, a provincial privacy commissioner, or a state attorney general, as applicable. AurellaAI asks to be contacted first.
8. SECURITY
AurellaAI maintains a written information security program comprising administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, acquisition, use, disclosure, alteration, and destruction. Those safeguards include encryption in transit and at rest, role-based access control, multi-factor authentication, logging of access, personnel confidentiality obligations and training, and vulnerability management. AurellaAI’s Information Security Program describes them and is furnished to Subscribers and prospective Subscribers subject to a confidentiality undertaking.
No method of transmission or storage is entirely secure, and AurellaAI does not guarantee the security of personal information. The security of an account also depends on the individual: credentials must be kept confidential and must not be shared, and any suspected unauthorized use should be reported without delay.
9. ADDITIONAL DISCLOSURES
Children
The Platform and AurellaAI’s web properties are intended for tax and accounting professionals and are not directed to children. AurellaAI does not knowingly collect personal information from any person under the age of sixteen. Where AurellaAI learns that it has done so, it deletes that information.
Third-party properties
AurellaAI’s web properties may link to, or integrate with, websites, applications, and services operated by others. This Policy does not apply to them, and AurellaAI is not responsible for their practices. Individuals should consult the privacy notices of those parties.
Automated processing
The Platform employs automated processing to produce its outputs. Those outputs support professional judgment; they do not substitute for it, and AurellaAI does not use them to make decisions about any individual. Decisions concerning a practitioner are made by the firm that employs or engages them, and the firm is accountable for them.
Canada
For individuals in Canada, personal information is handled in accordance with the Personal Information Protection and Electronic Documents Act and, where applicable, the Personal Information Protection Acts of Alberta and British Columbia, the Act respecting the protection of personal information in the private sector (Québec), and other applicable provincial legislation. AurellaAI has designated a privacy officer, whose contact details appear in Section 11, accountable for its compliance. Section 4 constitutes notice that personal information is transferred to and stored in the United States and may there be accessed by United States authorities.
United States
For residents of states with comprehensive privacy legislation, the categories of personal information AurellaAI collects, the sources from which it is collected, the purposes for which it is used, the categories of parties to which it is disclosed, and its retention practices are as described in Sections 1 through 5. AurellaAI does not collect or process sensitive personal information as that term is defined under applicable state privacy legislation, and does not use or disclose personal information for purposes requiring a right to limit. AurellaAI does not sell personal information and does not process it for cross-context behavioural advertising or targeted advertising. Where AurellaAI processes personal information on behalf of a Subscriber, it does so as a service provider or processor and not as a business or controller.
10. TEXT MESSAGING
AurellaAI operates the text messaging channel through which the Platform delivers verification codes and account notifications to the clients of a Subscriber. AurellaAI is the sender of record for those messages and is registered as such with the United States mobile carriers. In operating that channel AurellaAI acts on its own behalf, and this Section applies notwithstanding the limitation described under “What this Policy does not cover” at the head of this Policy. This Section applies to every recipient of a text message sent by AurellaAI, whether that recipient is a client of a Subscriber or an authorized User of the Platform.
Messages we send
AurellaAI sends two kinds of text message and no others.
Verification codes, sent when a recipient attempts to sign in to the client portal or to the Platform, or otherwise requests a code, and used solely to confirm that the person signing in controls the mobile number on the account.
Account notifications concerning the recipient’s engagement with the firm, comprising requests for outstanding documents, notice that a return is available for the recipient’s review, and confirmation of a change to the recipient’s portal profile or contact details.
The two kinds of message are sent from different telephone numbers and are registered with the carriers as separate programs, so that a recipient can stop notifications without affecting delivery of the verification codes required to sign in. AurellaAI does not send marketing or promotional text messages, does not send text messages on behalf of any party other than the firm whose client the recipient is, and does not include tax return information in the body of a text message. A notification message identifies the firm, states the nature of the matter requiring attention, and where appropriate contains a link to the client portal. It does not contain figures, form or schedule names, or any part of a taxpayer identification number.
How consent is obtained
Consent is obtained separately for each of the two programs.
For verification codes, the client portal sign-in screen presents a mobile number field, which is not pre-filled, and a consent checkbox, which is not pre-selected, by which the recipient agrees to receive text messages from AurellaAI, Inc. (Aurella) comprising one-time sign-in codes. Beside that checkbox the screen states the messages the recipient will receive, that a code is sent only when the recipient requests one, that message and data rates may apply, and that the recipient may reply STOP to cancel or HELP for help, together with links to this Policy and to the Text Message Terms. A recipient enters their own mobile number, selects the checkbox, and submits. No code is sent to a number the recipient has not entered and selected that checkbox for, and a Subscriber cannot cause a code to be sent to a client. Access to the client portal requires a mobile number able to receive text messages, because the verification code is the means by which a sign-in is confirmed.
For account notifications, the same screen presents a second checkbox, also not pre-selected, distinct from the checkbox described above and not bundled with it. A recipient may sign in and use the client portal without selecting it, in which case AurellaAI delivers notifications by electronic mail instead. No notification message is sent to a number before that checkbox is selected.
An authorized User of a Subscriber elects text message authentication in their Platform profile and provides a mobile number for that purpose, and Section 4 of the Platform Terms of Use describes that election.
Message frequency
Verification codes are sent only in response to a request. The frequency of notification messages varies according to the activity on the recipient’s engagement with the firm and does not ordinarily exceed ten messages in a calendar month.
Charges
Message and data rates may apply. AurellaAI does not charge a recipient for text messages; a recipient’s mobile carrier may charge for messages received.
How mobile numbers are handled
AurellaAI does not sell, rent, or share a recipient’s mobile telephone number, or the record of that recipient’s consent to receive text messages, with any third party or affiliate for marketing or promotional purposes.
That information is disclosed only to the messaging provider that transmits the messages on AurellaAI’s behalf, which is permitted to use it solely for the purpose of transmitting them, and to the firm whose client the recipient is. It is not used to build advertising audiences, is not disclosed for cross-context behavioural advertising or targeted advertising, and is not disclosed to any other Subscriber.
Stopping messages
A recipient may stop notification messages at any time by replying STOP to any notification message. AurellaAI acknowledges the request by return message and sends no further notification messages to that number, and delivers notifications by electronic mail instead. A recipient may also withdraw consent by contacting AurellaAI as described in Section 11 or by asking the firm to update their contact preferences, and AurellaAI gives effect to a withdrawal communicated by any reasonable means. Stopping notification messages does not close the recipient’s portal account and does not stop communications sent by electronic mail or by the firm through other means.
Because verification codes are sent from a different number, stopping notification messages does not prevent delivery of a verification code that the recipient subsequently requests, and does not affect the recipient’s ability to sign in.
A recipient who replies STOP to a verification code will stop receiving those codes, and will be unable to sign in to the client portal until they reply START to the same number, because the code is the means of authentication. AurellaAI does not invite recipients to stop verification codes, and a recipient who needs help signing in should reply HELP or contact their firm.
A recipient may reply HELP to any message for assistance, or contact AurellaAI at support@aurella.ai. The Text Message Terms published at https://aurella.ai/sms-terms describe these programs in the form given to recipients.
Records of consent
AurellaAI retains a record of each consent and each withdrawal, comprising the text displayed to the recipient, the date and time, the mobile number concerned, and the portal session in which the action was taken. Those records are retained for so long as necessary to demonstrate that consent was obtained and honoured and thereafter as described in Section 5.
11. CONTACT
Inquiries, requests, and complaints concerning this Policy or AurellaAI’s handling of personal information may be directed to AurellaAI’s privacy officer at privacy@aurella.ai.
Practitioners with questions about what their firm can see, or wishing to exercise a right in respect of information processed on their firm’s behalf, should contact their firm’s designated administrator in the first instance.
AurellaAI, Inc.
10531 4S Commons Drive, Suite 166-432
San Diego, CA 92127
12. CHANGES
AurellaAI may revise this Policy. The current version is published on AurellaAI’s website and is identified by the version number and effective date appearing at the head of this document. Where a revision materially affects the manner in which AurellaAI handles personal information, AurellaAI will provide notice by appropriate means before the revision takes effect. Continued use of a AurellaAI web property or of the Platform following the effective date of a revision constitutes acceptance of it, to the extent acceptance is capable of being given in that manner under applicable law.
Where this Policy conflicts with the Master Subscription Agreement between AurellaAI and a Subscriber, the Master Subscription Agreement governs the parties’ legal rights and obligations.