Auxillo is operated by Jaundre van Staden, trading as Auxillo, an individual trader (Empresário em Nome Individual), NIF 309215099, CAE 58290, 62202 and 63110. Address: Rua da Comporta 12, 2D, 8500-454 Portimão, Portugal.
1. Who is responsible
This notice covers the Auxillo website, Auxillo accounts, the hosted products (Web, Email, Database, App, AI and Game Hosting), Aux Mail, Aux Tools, AMI and support. The operator identified above is the controller for the processing described here: accounts, sign-in, billing, security, AMI, support and our own communications.
When you use a hosted product, Aux Mail or Aux Tools to process other people’s data, such as your website visitors, mailbox correspondents or campaign contacts, you decide why and how that data is processed. You are the controller for it and Auxillo is your processor under the Data Processing Agreement. Section 12 explains this.
Write to [email protected] for anything about your personal data. Auxillo has not appointed a data protection officer. The GDPR requires one only for public authorities and for organisations whose core activities consist of large-scale regular and systematic monitoring of individuals or large-scale processing of special categories of data (Article 37). Auxillo is an individual trader and its core activities are neither. Jaundre van Staden handles privacy matters personally.
2. Information we process
- Account: name, email address, password hash, two-factor settings, sign-in and security events, plan and service entitlements, and settings.
- Sign-in with Google, Microsoft or GitHub: if you choose it, the account identifier, name and email address the provider returns to us. We do not receive your password for that provider.
- Billing: customer and invoice references, billing name and address, tax number, payment status and limited payment-method details (such as card brand and last four digits). Stripe handles full card details; we never see or store them.
- Service data: content and configuration you put into a product, mailbox and connection credentials where a feature needs them (stored encrypted), Aux Tools targets and results (domains, IP addresses and email addresses you enter), monitor history and reports.
- AMI and support: messages you send to AMI or to support, conversation identifiers, attachments and the product context you choose to share.
- Devices: if you allow push notifications in an Auxillo app, a push token for your device.
- Security and server logs: IP address, request details, browser type and time of access, used to run and protect the services.
3. Purposes and legal bases
Each activity has one legal basis under Article 6 GDPR. Where we rely on legitimate interests, the interest is stated and you can object (section 7).
| Activity | Personal data | Legal basis |
|---|---|---|
| Creating and running your account, signing you in | Account data, sign-in events, session tokens | Contract, Article 6(1)(b). |
| Sign-in with Google, Microsoft or GitHub (only if you choose it) | Provider account identifier, name, email address | Contract, Article 6(1)(b). The provider is a separate controller for its own processing. |
| Orders, subscriptions and payments | Billing data, order history | Contract, Article 6(1)(b). |
| Invoices, tax and accounting records | Billing data, invoices | Legal obligation under Portuguese tax and accounting law, Article 6(1)(c). |
| Payment fraud prevention in checkout | Payment and device signals collected by Stripe | Legitimate interests in preventing payment fraud, Article 6(1)(f). |
| Security, abuse prevention and server logs | IP address, request details, audit log entries | Legitimate interests in keeping the services and their users secure, Article 6(1)(f). |
| AMI chat on the website | Your messages, chat session identifier | Legitimate interests in answering the questions visitors ask, Article 6(1)(f); for customers asking about their service, contract, Article 6(1)(b). |
| AMI features you use in a product: AI analysis of Aux Tools results, AI features in Aux Mail | The results or mail content you send to the feature | Contract, Article 6(1)(b). Where the content contains other people’s data, we act as your processor (section 12). |
| Account events sent to AMI for operations | Account identifier, event type (such as sign-up or plan change), plan. No IP address. | Legitimate interests in operating and supporting the services, Article 6(1)(f). |
| Aux Tools lookups and monitoring | The domains, IP addresses and email addresses you enter, and the public records returned for them | Contract with you, Article 6(1)(b). Where the results concern other people, such as names in public DNS or registration records, legitimate interests in network security and diagnostics, Article 6(1)(f). |
| Push notifications in Auxillo apps (only if you allow them) | Device push token, an opaque notification identifier | Contract, Article 6(1)(b). Turn notifications off in the app or your device settings at any time. |
| Support and the contact form | Name, email address, message and anything you attach | Steps you ask for before a contract, or the contract, Article 6(1)(b); otherwise legitimate interests in replying to your message, Article 6(1)(f). |
| Email newsletter (not yet offered) | Email address, consent record | Consent, Article 6(1)(a), and Article 13-A of Portuguese Law 41/2004. We will offer it only with a sign-up you actively confirm, and you can withdraw at any time. |
| Legal claims and requests from public authorities | The data relevant to the matter | Legal obligation, Article 6(1)(c), or legitimate interests in establishing or defending legal claims, Article 6(1)(f). |
We do not sell personal data, show advertising or build marketing profiles. Information marked as required is needed to provide the account or order; without it we cannot supply that service. Optional fields can be left blank.
4. AMI and automated decisions
AMI, Auxillo’s AI assistant, runs only on hardware that Auxillo owns and operates in Portugal, using models that run locally on that hardware. Your messages to AMI are not sent to any external AI provider. Conversations are not used to train AI models. The AMI Policy lists what AMI receives and how long it is kept.
In Aux Tools you can choose to connect your own AI model or agent from the Professional plan. If you do, the findings you send go to the provider you configured, under your own agreement with that provider. That provider is not an Auxillo subprocessor.
Support replies. Jaundre van Staden reads every message sent to [email protected] and approves every reply before it is sent. No reply is sent automatically. To prepare replies, the support desk uses AI models from Anthropic and OpenAI to sort tickets, gather technical context and draft a reply. Both are named in the Subprocessor List. A model receives only the ticket text the reply needs, with email addresses, IP addresses, telephone numbers, long numbers, secrets and recognisable names removed or replaced. This is pseudonymisation, not anonymisation, so please put no more personal data in a ticket than the problem needs. A model never receives messages to [email protected], abuse reports, evidence, appeals, privacy requests, legal orders, identity documents or payment card details, and never the content of your hosted websites, mailboxes or databases. Support looks at that content only if you give permission for that ticket, and the permission is recorded in the ticket. This use stays switched off until the written agreement and transfer safeguards for both providers are recorded and the exclusions above are enforced.
Auxillo makes no decisions based solely on automated processing that produce legal effects for you or similarly significantly affect you (Article 22 GDPR). Sign-in, billing, monitoring and provisioning include automated steps, such as an expired card pausing a renewal. If an automated step affects you, write to [email protected] and a person will review it.
5. Retention and deletion
We keep personal data only as long as each purpose needs. The Data Retention Schedule sets out the period for each category. In summary: account data while the account exists; Aux Tools scan history by plan, up to 365 days (never more than 395 days); server logs 14 to 30 days; IP addresses in audit logs shortened after 90 days and the entries deleted after 2 years; invoices and accounting records 10 years, as Portuguese law requires.
Deleting your Auxillo account erases your account data and starts the deletion of your data in Aux Tools, Aux Mail and AMI. The deletion is recorded and retried until each product confirms it. Only the records we must keep by law, such as invoices, are kept, for their legal period. This includes the customer record we hold with our payment provider Stripe (your name, email address, billing address and invoices): erasing your account does not delete it, because Portuguese tax and accounting law requires us to keep invoicing records, and we use it only for those duties.
Deleting active data and expiring recovery backups are separate operations. Some historical recovery copies are currently held under a recovery preservation hold and do not expire on a guaranteed 30-day schedule. Access is restricted. Contact us for the retention position applicable to your data or to exercise your rights.
6. Recipients
Only Auxillo itself and the providers we need to deliver the services receive personal data, each only the data its role requires. The Subprocessor List names every one with its role, the data it receives, its location and the transfer safeguard. In summary:
- Hosting and network: Hetzner (servers in Germany and Finland) and Cloudflare (DNS, content delivery, secure tunnels, protection and encrypted off-site recovery archives).
- Payments: Stripe, for checkout, subscriptions, invoices and fraud prevention.
- Push notifications: Google Firebase Cloud Messaging delivers notifications to Auxillo apps. It receives only an opaque identifier, never the message content.
- Lookup services used by Aux Tools: services such as Have I Been Pwned, AbuseIPDB, Shodan, SecurityTrails, Globalping, crt.sh, Cert Spotter, Robtex, HackerTarget and Team Cymru receive the domain, IP address or email address you asked Aux Tools to check, and nothing else about you. Breach checks run only for your own email address or addresses at a domain you have verified.
- Optional connections you choose: Google, Microsoft or GitHub if you sign in with them; Clearbit if you switch on contact enrichment in Aux Mail; your own AI provider if you connect one in Aux Tools.
- Support drafting: Anthropic and OpenAI, whose AI models draft support replies from minimised ticket text. A person reads every ticket and approves every reply. See section 4.
- Certificates: Let’s Encrypt (ISRG) issues TLS certificates. Certificate domain names appear in public certificate transparency logs.
We may disclose information where a valid legal requirement obliges us to, or to protect legal rights or investigate abuse, with appropriate safeguards.
7. Your rights
Under the GDPR you can ask for access to your personal data, correction, erasure, restriction of processing and a copy in a portable format. You can withdraw consent at any time without affecting processing before the withdrawal.
Right to object. Where we process your data on the basis of legitimate interests (section 3), you can object at any time on grounds relating to your particular situation. We will then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims (Article 21 GDPR).
You can request an export of your data and delete your account in the account settings. One export request covers your Auxillo account and links to the exports of Aux Tools and Aux Mail. You can also write to [email protected]; you do not need an account to make a request. We may ask for proportionate information to confirm your identity. We reply within one month. If a permitted extension is necessary, we tell you within that month and explain why. See Data Subject Requests.
You have the right to complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the supervisory authority where you live or work.
8. Locations and international transfers
Auxillo’s servers are in the EU: Hetzner data centres in Germany and Finland. Some providers process data outside the European Economic Area. For each of them the Subprocessor List states the safeguard:
- Cloudflare, Stripe and Google (United States): the EU to US Data Privacy Framework, under the European Commission’s adequacy decision of 10 July 2023, and the standard contractual clauses in their data processing terms.
- Lookup services outside the EEA (in the United States and Australia): they receive only the target you asked Aux Tools to check, and only so that the lookup you requested can be carried out. Where that target is personal data, the transfer is necessary to perform your request (Article 49(1)(b) GDPR) or covered by the provider’s standard contractual clauses where it offers them.
- Providers you choose to connect (sign-in providers, your own AI provider, Clearbit) process data under their own terms and safeguards.
- Anthropic and OpenAI (United States and other regions), for support drafting only: the Subprocessor List states that the written agreement and transfer mechanism must be recorded before this use starts, and it stays switched off until then.
Ask [email protected] for a copy of the safeguards relevant to your service.
9. Security
Measures include TLS for public service connections, access controls, scoped authentication, two-factor sign-in, encrypted storage of connection credentials, patching, security monitoring, audit logs and encrypted off-site recovery archives. Controls vary by product. We do not claim that every live disk, database or customer-selected application has end-to-end or at-rest encryption. No service can promise absolute security. The technical and organisational measures are listed in Annex 2 of the Data Processing Agreement. Report a suspected issue to [email protected].
10. Cookies and browser storage
The website stores nothing in your browser on your first visit. Its fonts are hosted by Auxillo, and it runs no analytics script, advertising pixel or tracking cookie. We see aggregate traffic figures that Cloudflare derives from the requests it handles, without a script or cookie. Auxillo uses only storage that is strictly necessary for a service you ask for, such as staying signed in, an AMI chat you start or a payment you make, which is why there is no cookie banner. The Cookie Policy lists every cookie and storage item by name.
11. Children
Auxillo accounts and business services are intended for adults. Do not submit a child’s personal information unnecessarily. If you believe a child has provided information without appropriate authority, contact us so we can investigate.
12. Customer data processed on instructions
For data you control and place in a hosted product, Aux Mail or Aux Tools, you are responsible for having a lawful basis, giving the people concerned the required information and the instructions you give us. The Data Processing Agreement sets out our duties as your processor, including confidentiality, security, assistance, breach notification and deletion or return.
If you send marketing with Aux Mail, you must hold consent or, for your existing customers, meet the conditions of Article 13-A of Portuguese Law 41/2004 (or the equivalent law that applies to you). Aux Mail records the consent evidence you provide, adds a one-click unsubscribe to campaigns and keeps open and click tracking off unless you switch it on; if you do, you must have your recipients’ consent to it. Contact enrichment through Clearbit is off by default and runs only if you switch it on.
13. External applications and links
External providers have their own privacy notices. Desktop applications connect to the systems you configure. Their local files are not automatically uploaded to Auxillo merely because you install the application, but update checks, repository access and support requests can create network or support records.
14. Changes
We publish the revision date here. Material changes are communicated where required before new processing begins. A wording change does not authorise an incompatible new use of your data.
15. Contact
Email [email protected] or write to the operator at the address above. Please identify the product and request without sending passwords, full payment-card details or unnecessary identity documents.
Last updated: 29 October 2026.