Privacy Policy
LAST UPDATED: September 2026
1. Introduction
Aurix AI Solutions Pty Ltd ("Aurix AI", "we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard your information when you visit our website, sign up for or use the Serenox.One distributed AI security and model routing platform, or interact with our mobile, desktop, or web applications (collectively, the "Service").
By accessing or using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this policy, please discontinue use of the Service and uninstall any Aurix AI applications you have installed.
2. Information We Collect
We collect information from and about you in the following ways:
Account and profile data. When you create an account, request a demo, or contact us, we collect your full name, work email address, company name, job title, phone number (where provided), billing address, and account credentials (encrypted password and authentication tokens).
Authentication and access data. When you sign in, we collect sign-in timestamps, IP address, user agent string, device identifiers, and multi-factor authentication metadata to protect your account.
Platform and usage data. When you use the Serenox.One platform, we collect service interaction logs, feature usage, configuration settings, API request metadata (excluding request bodies), error and diagnostic logs, performance telemetry, and audit events. This data is used to operate, secure, and improve the Service.
Security and threat-detection data. Because Serenox.One is a security platform, our agents, honeypots, and routing layer may collect network telemetry (source/destination IP addresses, ports, packet metadata, TLS fingerprints, user-agent strings, request paths, and correlated session identifiers) from traffic you direct through the platform for the purpose of detecting threats. This telemetry is processed in accordance with your deployment configuration and is not retained beyond the periods you specify.
Model routing and prompt metadata. When you use the routing layer, we collect metadata about model invocations including the model identifier, token counts, latency, success/error status, and a content hash of the prompt. By default we do not retain the contents of prompts or model responses; this behaviour can be changed in your workspace settings, in which case the data is encrypted at rest and only accessible to authorised members of your workspace.
Device and connection data. When you use our websites, mobile, or desktop applications we collect device type, operating system and version, browser type and version, language, time zone, screen resolution, app version, install identifier, advertising identifier (where permitted), and mobile carrier information.
Cookies, SDKs, and automatic tracking. We and our third-party providers use cookies, local storage, pixels, and similar technologies to recognise you, remember your preferences, analyse traffic, and (where you opt in) measure marketing performance. See Section 4 for details.
Communications data. When you contact our support, sales, or security teams, we collect the contents of your communications, attachments you provide, and any information you choose to share with us.
Payment data. Payments are processed by third-party payment processors (currently Stripe). We do not store full payment card numbers on our servers. We receive from the processor your billing name, billing address, last four digits of the card, card brand, and transaction identifiers.
3. How We Use Your Information
We use the information we collect for the following purposes:
Provide, operate, maintain, and improve the Service, including the Serenox.One platform, our websites, and our mobile and desktop applications.
Authenticate users, manage accounts, and provide customer support.
Process transactions, issue invoices, and manage subscriptions.
Detect, prevent, and respond to security incidents, fraud, abuse, and violations of our terms.
Analyse usage trends, monitor service health, and diagnose technical issues.
Develop new products, features, and AI models using de-identified or aggregated data. We do not use your private prompts or model responses to train shared foundation models.
Send you service-related announcements (security notices, billing alerts, product updates, and policy changes).
Send marketing communications, but only where you have opted in or where otherwise permitted by law. You may opt out at any time using the unsubscribe link in any marketing email or by contacting privacy@aurixai.com.
Comply with legal obligations, resolve disputes, and enforce our agreements.
Legal bases for processing (where applicable, including under the EU/UK GDPR): performance of a contract; our legitimate interests in operating a secure, reliable service; your consent (which you may withdraw at any time); and compliance with legal obligations.
4. Cookies and Tracking Technologies
We use the following categories of cookies and similar technologies on our websites:
Strictly necessary cookies — required for the Service to function (for example, to keep you signed in, remember your cookie preferences, and prevent cross-site request forgery). These cannot be disabled.
Analytics cookies — used to understand how visitors use our site (currently Google Analytics 4 in anonymised mode). These can be disabled through the cookie consent banner.
Marketing cookies — used to measure the effectiveness of campaigns and, where you have consented, to deliver relevant content. These can be disabled through the cookie consent banner.
You can withdraw or change your choices at any time by clicking "Cookie preferences" in the footer of our website, or by clearing cookies in your browser. You may also use your browser's privacy features, including blocking all cookies, to limit tracking.
We do not respond to "Do Not Track" or "Global Privacy Control" signals in a manner inconsistent with applicable law, but where required by law we will treat such signals as an opt-out of sale or sharing.
5. Third-Party Services and Data Sharing
We do not sell your personal data. We share personal data only with the following categories of recipients, and only the minimum information necessary to provide our services:
Service providers. Hosting (Amazon Web Services), content delivery (Cloudflare), email delivery (Postmark), customer support (Linear and Intercom), analytics (Google Analytics 4), payment processing (Stripe), error monitoring (Sentry), and product analytics (PostHog). Each provider is bound by contractual obligations to protect your data.
Workspace members and administrators. If you use Serenox.One through an organisation, administrators of your workspace may access your account information and platform activity as needed to manage the workspace.
Connected model providers. When you invoke a third-party model through our routing layer, the prompt and any attached content are transmitted to that provider under their terms and privacy practices. A list of supported providers and links to their policies is available in the documentation at https://serenox.one/docs.
Legal and safety. We may disclose information where we believe in good faith that it is necessary to comply with applicable law, regulation, legal process, or government request; to protect the rights, property, or safety of Aurix AI, our users, or the public; or to detect and prevent fraud or security issues.
Business transfers. If Aurix AI is involved in a merger, acquisition, financing, reorganisation, bankruptcy, or sale of all or part of its assets, your information may be transferred as part of that transaction. We will notify you of any such change.
Aggregated or de-identified data. We may share aggregated or de-identified information that cannot reasonably be used to identify you with third parties for research, industry reporting, or marketing purposes.
6. International Data Transfers
Aurix AI is headquartered in Australia and uses service providers in the United States, the European Economic Area, and other jurisdictions. When we transfer your personal data across borders, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, the EU-US Data Privacy Framework (where applicable), and equivalent mechanisms in other jurisdictions.
A copy of the safeguards relevant to your jurisdiction can be requested by emailing privacy@aurixai.com.
7. Data Retention
We retain personal data only for as long as necessary to provide the Service and fulfil the purposes described in this policy, and as required by applicable law. Our default retention periods are:
Account data: for the duration of your account, plus up to 30 days after deletion to allow recovery, after which it is deleted or anonymised.
Billing records: 7 years (to comply with tax and accounting obligations).
Platform usage logs and security telemetry: 30 days by default; configurable up to 365 days by workspace administrators.
Model routing metadata: 30 days by default; prompts and responses are not retained by default and are only stored if you explicitly enable prompt logging in your workspace.
Support communications: 3 years from the last interaction.
Marketing contact data: until you unsubscribe, plus a suppression record so we can honour your opt-out.
When personal data is no longer needed, we securely delete or anonymise it.
8. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures include encryption in transit (TLS 1.2+) and at rest (AES-256), strict role-based access controls, multi-factor authentication for staff with production access, segregated environments, regular vulnerability scanning and penetration testing, an incident response plan with breach notification within 72 hours where required by law, and staff training on data protection.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you have reason to believe your interaction with us is no longer secure, please contact us immediately at security@aurixai.com.
9. Your Rights and Choices
Subject to your jurisdiction, you may have some or all of the following rights regarding your personal data:
Access — request a copy of the personal data we hold about you.
Correction — request that we correct inaccurate or incomplete data.
Deletion — request that we delete your personal data, subject to legal exceptions.
Portability — receive your data in a structured, commonly used, machine-readable format.
Restriction — request that we limit how we process your data while a complaint is investigated.
Objection — object to processing based on legitimate interests or for direct marketing.
Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
Opt out of sale or sharing — we do not sell personal data, but you may still direct us not to share personal data for cross-context behavioural advertising.
Lodge a complaint — with a data protection authority in your jurisdiction.
To exercise any of these rights, email privacy@aurixai.com or use the in-product privacy controls. We will respond within the timeframe required by applicable law (typically 30 days). We may need to verify your identity before acting on your request.
10. Mobile and Desktop Application Specifics
When you install and use our mobile or desktop applications, in addition to the data described above we may collect:
Install and update information, including app version, build number, install source, and update history.
Push notification tokens (FCM on Android, APNs on iOS, Web Push on browsers). You may disable notifications at any time in your device or browser settings.
Crash reports and performance traces (via Sentry), which may include device metadata and stack traces. Crash payloads are scrubbed of personal data before storage, and you can disable this collection in application settings.
Permissions you grant to the application, such as camera, microphone, photo library, contacts, location, and notifications. You may revoke any permission at any time in your device settings; doing so may limit certain features.
We do not access your camera, microphone, photos, contacts, or precise location unless you explicitly grant the relevant permission and the feature requires it.
11. Children's Privacy
The Service is not directed at individuals under the age of 16 (or such higher age as your jurisdiction applies for lawful use of online services). We do not knowingly collect personal data from children. If you believe we have collected data from a child in violation of this policy, please contact us at privacy@aurixai.com and we will take steps to delete the information as soon as possible.
12. Automated Decision-Making and AI
The Serenox.One platform uses automated systems to detect threats, route model requests, and recommend security actions. These systems may produce automated outputs that affect the traffic or model invocations in your workspace, but they do not produce legal or similarly significant decisions about individuals within the meaning of Article 22 of the GDPR.
We do not use the contents of your private prompts, model responses, or customer data to train shared or general-purpose AI models. If you choose to enable workspace-level fine-tuning, the resulting model is private to your workspace and is not shared with other customers or with the public.
13. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on this page, update the "Last Updated" date below, and notify you by email and/or through the Service where appropriate. Your continued use of the Service after the updated policy becomes effective constitutes acceptance of the changes. We encourage you to review this policy periodically.
14. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us at privacy@aurixai.com.
Our data controller is: Aurix AI Solutions Pty Ltd, Australia.
EU/UK representative: available on request at privacy@aurixai.com.
For security issues, please contact security@aurixai.com. We accept vulnerability reports through our coordinated disclosure program described at https://serenox.one/security.