Aiursoft Privacy Policy

Last Updated: September 2026
Company Entity: AIURSOFT LIMITED (Hong Kong)

1. The Aiursoft Privacy Philosophy

At Aiursoft, our foundational mission is to bring the spirit of open-source and free software to every enterprise and individual. This commitment to freedom inherently extends to your privacy and data sovereignty. We believe that your data belongs exclusively to you.

We are unequivocally committed to the following principles:

  • No Data Selling: We do not, and will never, sell, rent, or lease your personal or business data to third parties.
  • No Hidden Telemetry: Our software solutions are designed without concealed telemetry, advertising trackers, or behavioral profiling mechanisms.
  • Minimal Data Collection: We collect only the absolute minimum data necessary to provide you with secure, reliable, and functional services.

2. Core Distinction: Data Controller vs. Data Processor

To clearly understand how your data is handled, it is crucial to differentiate between the types of deployment plans we offer, as our legal and technical relationship to your data changes significantly based on your chosen architecture:

  • For Cloud-Hosted Plans (e.g., Aiursoft Substratum Core): When you utilize our cloud-hosted infrastructure (such as Mailcow, Nextcloud, or Authentik instances managed on our servers), AIURSOFT LIMITED acts as a Data Processor. You remain the Data Controller. Infrastructure administrators may have technical access to hosted systems, databases, and backups. We restrict access to authorized personnel and service duties. Access to business content for a support request requires your explicit authorization, is limited to that request, and is revoked when the work ends.
  • For On-Premise Plans (e.g., Aiursoft Substratum Startup & Enterprise): For services deployed on your servers or private cloud, you control the infrastructure and access permissions. Aiursoft accesses these systems only within the authorization you grant for deployment, maintenance, or support. You can revoke that access. Separately selected hosted services remain subject to the cloud-hosted terms.

3. What Data We Actually Collect

To facilitate our business relationship and manage your subscriptions, we collect the following limited categories of information:

  • Account Information: When you register for an Aiursoft commercial account or engage with our sales team, we collect necessary contact details, including your name, your work email address, and your company name. This information is used strictly for account administration and communication.
  • Billing and Payment Data: Crucially, AIURSOFT LIMITED does not collect, process, or store your full credit card numbers or sensitive financial instruments on our servers. All payment transactions are securely handled by our PCI-DSS compliant third-party payment processor, Stripe, Inc. We only receive and retain non-sensitive billing information from Stripe, such as your billing address, subscription status, and the last four digits of your payment card, strictly for the purposes of issuing invoices, managing your active subscriptions, and complying with financial record-keeping laws.
  • Technical and Diagnostic Data: When you visit our public-facing websites (e.g., aiursoft.com), our web servers automatically log standard technical information, such as your IP address, browser type, and access times. This data is utilized exclusively for security monitoring (e.g., preventing DDoS attacks), ensuring the stability of our web infrastructure, and basic, anonymized traffic analysis. We do not employ invasive third-party tracking cookies for behavioral advertising.

4. How We Use Your Data

The limited data we do collect is utilized solely for the following legitimate business purposes:

  • Service Provisioning: To create your account, configure your chosen deployment (whether cloud-hosted or coordinating on-premise setup), and authenticate your access.
  • Transaction Processing: To facilitate subscription billing and process payments securely via Stripe.
  • Communication: To send you critical system notifications (such as scheduled maintenance alerts or downtime warnings), billing receipts, and responses to your technical support inquiries.
  • Strict Prohibition on AI Training: We do not use your private documents or communications to train our models or third-party models. Customer-requested local training requires explicit authorization and uses only the data you select. Local inference keeps model inputs within your deployment. If you choose an external model provider, prompts and selected content are sent to that provider under its terms; the provider and data flow must be agreed before activation.

5. Data Sharing and Third-Party Sub-Processors

We do not share your personal information with external parties except where absolutely necessary to deliver our services. To operate effectively, we utilize the following trusted third-party sub-processors:

  • Stripe, Inc.: Exclusively for secure payment processing and subscription management.
  • Voxihost: For provisioning the underlying high-performance cloud infrastructure that powers our official websites and Cloud-Hosted (S1 Core) client instances.

Beyond these essential operational partners, Aiursoft will never disclose your data to any third party, including government entities, unless legally compelled to do so by a valid, binding court order or subpoena originating from a competent jurisdiction.

6. Data Retention and Deletion

  • During Active Subscription: We securely retain your account and hosted data for the duration of your active subscription to ensure continuous service delivery.
  • Upon Cancellation (Cloud-Hosted Plans): If you choose to cancel a Cloud-Hosted subscription, your account will remain active until the end of the current billing cycle. Following the expiration of your subscription, we observe a strict 30-day grace period. After this 30-day period, all of your associated business data (emails, files, databases) will be permanently, irreversibly, and securely hard-deleted from our hosting infrastructure. We cannot recover data once this deletion process has occurred.
  • Upon Cancellation (On-Premise Plans): For on-premise deployments, cancellation simply terminates our support and update services. Your data remains entirely intact on your own servers, under your complete control.

7. Your Data Rights

In accordance with global privacy standards, including the principles outlined in regulations such as the GDPR and the Hong Kong Personal Data (Privacy) Ordinance (PDPO), you possess the following rights regarding your personal data held by Aiursoft:

  • Right to Access: You may request a copy of the personal data we hold about you.
  • Right to Rectification: You may request that we correct any inaccurate or incomplete personal data.
  • Right to Erasure (The "Right to be Forgotten"): You may request the complete deletion of your account and associated personal data from our systems, subject to our retention policies for cancelled subscriptions and legal compliance requirements.

To exercise any of these rights, please contact us using the information provided below or manage your preferences directly within your Aiursoft account dashboard.

8. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact our executive team: