The honest versionof how we handle this.

01 · Data privacy

Your household data stays inside your household.

The most important promise on this page is the boring one: Aule was built to keep your household private. No third-party tracking pixels on Aule pages, no behavioral profile sold to anyone, no model trained on the contents of your home.

• +No third-party tracking on Aule surfaces. First-party analytics only, with PostHog and Vercel Analytics running on our own infrastructure.
• +Your household data lives in your household’s instance. It is not pooled across households and it is not used to train shared AI models.
• +Aggregated, anonymized benchmarks may inform our annual State of Household Intelligence report. Individual responses or member-level data, never.
• +One-click delete-my-data inside the app. Confirm twice; we erase. A portability export is available the same way.
• +Authentication is handled by industry-standard providers; passwords are hashed and salted; sessions are scoped and revocable.

How delete-my-data works (HMLI) →

02 · Approval gates and gradual trust

Full auto by default. Two beats of confirmation.

Aule closes loops end-to-end without the household in the middle. Two gates are kept on by default — they are the ones that matter most — and the layer gradually loosens them as it earns your trust. The gates are per-household configurable; you can lock anything tighter or accelerate the loosening at any moment.

• +Grocery gate: any grocery order, any size, asks first. After roughly 30 days and at least four successful grocery confirmations, the household can graduate to "approve the weekly meal plan, run orders against it" — the cart still drafts every week; you just stop signing each one.
• +Spend gate: any single spend at or above $200 surfaces with the quote, the context, and the recommendation. The household can raise the threshold, lower it, or remove it once the layer has earned the latitude.
• +Hard rules layered on top: anything touching a child’s identity escalates regardless of the gate, anything ambiguous about consent escalates, anything the household has flagged "always ask" escalates. These are not loosenable.
• +Every rule is reversible inside the app. The gates are not a one-time onboarding artifact — they are the live policy your household runs on.
• +The household can lock the whole layer with one tap, pause any single loop, or send the agent back to the "ask first" position on anything. The latitude is yours to grant and yours to revoke.

How the gates loosen → /products/how-it-works

03 · 95%+ completion target

A real operations team tunes the agent toward closed loops.

Inside Aule, an internal operations team works behind the agent — not on your individual transactions, but on the architecture that runs everyone’s. The mandate is simple: push the layer toward 95%+ closed-loop completion across the founding cohort, and keep it there.

• +Failure modes from every household are aggregated and reviewed. When the layer drops a loop, our team finds the gap and ships a fix.
• +Playbooks for new domains are tested against real household data before they ship. New loop types do not light up until the closed-loop rate is in range.
• +Anything ambiguous about consent, identity, or money still escalates inside your household — the operations team is improving the layer, not making your decisions.
• +You can request a human at any moment in chat. We are not running a 24/7 concierge; we are running a high-quality layer with a team that takes its failure rate personally.
• +Every escalation, override, and outcome lives on the household’s memory ledger — auditable in-app, exportable on request.

04 · Vendor handoff

Aule coordinates vendors. You authorize the spend above the gate.

When Aule books your plumber, the agent handles the back-and-forth — sourcing, quoting, scheduling, drafting replies, confirming, following up. Money flowing to a vendor follows the spend gate: anything at or above $200 surfaces for your nod; anything below closes end-to-end.

• +Aule does not store your credit-card numbers. Payment to vendors goes through your card or account, against the spend gate you have set.
• +Recurring vendor work the household has pre-approved (lawn care, pool service, recurring deliveries) executes on the schedule you set, regardless of the spend gate.
• +Vendor contact information is stored in your household memory; we do not share it across households or with other vendors.
• +A vendor receipt is generated for every booking — what was quoted, what was approved, what was paid — and lives on the third memory layer for the life of the membership.
• +Receipted close: when a vendor visit ends, Aule confirms the work, reconciles the invoice against the quote, files the warranty, and surfaces an anomaly if anything does not line up.

05 · Payment security

Stripe holds your card. We do not.

Aule itself does not store your payment card. Membership billing is handled by Stripe — your card data lives with Stripe, not with us — and any in-app authorization of vendor payment runs through the same kind of tokenized handoff.

• +Stripe is PCI-DSS Level 1 compliant. Aule does not see, store, or transmit your raw card number — only the Stripe payment-method token.
• +Our application form (and any cost-gated workflow) is protected by Vercel BotID against automated abuse.
• +Refunds inside the 30-day money-back window go through the same Stripe channel; the refund posts to the same card that paid.
• +For households that prefer it, a separate household-only payment method (a virtual card scoped to the operating layer) is on our near-term roadmap.

Pricing and refund policy → /pricing

06 · Session and access management

You decide who can see what, and you can revoke it.

Aule is meant to be shared by both partners and, where appropriate, by other adults in the household. Access is granular, sessions are revocable, and the audit trail is yours.

• +Both partners get equal access by default — adding a partner adds zero to the rate, and the household layer was never meant to live in one head.
• +Per-member access controls let you scope what each adult in the household can see and act on (e.g., a co-parent who needs visibility into the kids’ calendar but not the household finances).
• +Active sessions are visible inside the app and revocable in one click. If a phone goes missing, the session goes with it.
• +Multi-factor authentication is available and recommended; for accounts that include shared financial visibility, MFA is required.

07 · What we will never do

The list of promises that are easier to read than the policy.

A few things Aule will not do, ever, no matter what is going on in the household.

• +Sell or rent your household data to third parties. Not in aggregate, not in part, not at all.
• +Train shared AI models on your household’s content. Your memory is yours; pooling for the benefit of someone else’s household is not a thing we do.
• +Auto-execute payments above your household-spend thresholds. The threshold is a hard stop, not a guideline.
• +Make decisions on behalf of a child without you in the room. Anything touching a child’s identity is escalated to a human, always.
• +Hide what the AI did. Every action lives on the third memory layer as a receipts ledger you can audit anytime, including November of next year.

08 · Accessibility

A household OS is only useful if everyone in the house can use it.

Aule is being built to WCAG 2.2 AA as a baseline. We are not done — and we are not going to tell you we are — but the work is ongoing and we publish it.

• +All marketing and product surfaces ship through automated accessibility checks (axe-core / Lighthouse) and a manual review by the design team before release.
• +Keyboard navigation, focus states, and screen-reader semantics are first-class. Visual contrast matches WCAG 2.2 AA across the cream/paper/ink/ochre system.
• +A direct email — accessibility@getaule.com — reaches a human on the success team. If you hit a barrier, we want the report; we treat it like a bug, not a feature request.
• +Voice-driven onboarding and chat are available for households where typing is not the easiest path; the interview can happen entirely by voice.