Privacy Policy

Last Updated: September 25, 2026 · Aidora Labs

At AIDORA LABS (operating via aidoralabs.in), we are committed to protecting the privacy, confidentiality, and data integrity of our clients, website visitors, and SaaS product users. This Privacy Policy details how we collect, process, secure, and retain your data when you interact with our website, use our SaaS products (including GrowthLens AI), book consultations, submit inquiries, or engage our custom software engineering services.

1. Information We Collect

We collect only the information necessary to fulfill our service commitments, provide accurate technical audits, and communicate effectively. Depending on your interaction:

• Contact & Project Inquiries: When you submit a project inquiry or request an estimate, we collect your name, business email address, phone number, organization name, project requirements, budget bracket, and optional timeline.
• Meeting Scheduler: When scheduling a discovery call, we collect your name, email, phone number, preferred date/time slot, and timezone.
• Careers & Recruitment: When applying for open roles, we collect your name, email, phone number, resume links, LinkedIn profile URL, portfolio/GitHub link, and cover statement.
• GrowthLens AI SaaS Data: When you use our website auditor or connect external analytics accounts, we process the target URL, public SEO metadata, page performance indicators, and, where authorized via Google OAuth, read-only Search Console and Google Analytics 4 performance metrics.
• Bring Your Own Key (BYOK) Data: For users configuring custom AI model keys in GrowthLens AI, API keys are stored encrypted at rest and accessed only during active report generation.
• Technical Usage & Cookies: Anonymous telemetry (browser type, device viewport, approximate country, pages viewed, interaction speed) collected via privacy-conscious analytics tools (Google Analytics 4, Microsoft Clarity, Vercel Web Analytics). IP addresses are anonymized.

2. Google OAuth 2.0 & Google API User Data

When using GrowthLens AI to analyze website visibility, you may choose to connect your Google Search Console or Google Analytics accounts:

• Strictly Read-Only Access: We request only read-only scopes (e.g., webmasters.readonly and analytics.readonly). GrowthLens never requests or possesses permissions to modify, add, or delete your Google Search Console properties or Google Analytics settings.
• Purpose of Access: Google API data is fetched exclusively to compute search visibility trends, identify keyword growth opportunities, and generate your diagnostic report.
• Limited Use Compliance: GrowthLens AI’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Non-Distribution: We do not transfer, sell, or disclose Google user data to third parties, data brokers, or advertisers under any circumstances.

3. AI Model Processing Disclosures

For AI-powered features in GrowthLens AI and client software implementations:

• Supported AI Providers: Diagnostic report summaries are generated using verified enterprise AI endpoints, including Google Gemini, OpenRouter, and OpenAI where enabled.
• Zero Foundational Training: Customer data transmitted to third-party AI providers via official API endpoints is not used to train public foundational language models.
• Data Minimization: Only aggregated numerical SEO metrics, URL paths, and keyword data necessary for analysis are sent to the AI processing layer. Personally identifiable information (PII) is excluded.

4. Data Protection & Technical Safeguards

We deploy multi-layered architectural safeguards to protect your business information:

• Encrypted Transport: All communication between your browser and our servers is encrypted in transit using TLS 1.3 / HTTPS.
• Encryption at Rest: Sensitive credentials, OAuth tokens, and BYOK API keys are stored with industry-standard AES-256 encryption.
• Access Control: Firestore security rules and role-based access restrictions prevent unauthorized multi-tenant data access.
• Bot & Abuse Mitigation: Cloudflare Turnstile and server-side rate limits protect our public endpoints from automated abuse and credential stuffing.
• Transactional Communication: Inquiries and notifications are transmitted through secure serverless pipelines and authenticated Brevo / Google Workspace SMTP relays.

5. Cookies & Tracking Technologies

We use cookies to maintain secure sessions, prevent bot submissions, and gather aggregated performance analytics. For an exhaustive inventory of cookies, analytics scripts, and how to manage your cookie preferences, please review our dedicated Cookie Policy.

6. Data Retention & Deletion Principles

We adhere to strict data minimization principles:

• Inquiries & Consultations: Stored only as long as necessary to facilitate business discussions and active project delivery.
• Audit Reports: Generated diagnostic reports are cached temporarily to allow client download and review, after which they are subject to automated purging.
• OAuth Tokens: Stored securely during the active integration lifecycle and permanently deleted upon client disconnection or account deletion request.

7. Your Rights & How to Contact Us

Under applicable data protection regulations (including the Digital Personal Data Protection Act in India and GDPR internationally), you have the right to:

• Request confirmation of the personal data we hold about you.
• Request rectification of inaccurate or outdated information.
• Request complete erasure of your contact submissions, audit histories, or OAuth credentials.
• Withdraw consent for marketing communications or analytics tracking at any time.

To exercise any of these rights, or for inquiries regarding this Privacy Policy, please reach out to our privacy team: