Privacy Policy

We collect information to provide, maintain, and improve AuraBio services. The types of information we gather include:

We use the information we collect for the following purposes:

• Service Delivery: Provide, personalize, and maintain your AuraBio profile and associated features.
• Account Management: Manage your subscription, process payments, and send transactional emails (receipts, security alerts).
• Analytics & Insights: Generate aggregated, anonymized analytics to help you understand your profile performance (available in your dashboard).
• Platform Improvement: Analyze usage patterns to improve features, fix bugs, and develop new functionality.
• Security: Detect fraud, abuse, and security threats; enforce our Terms of Service.
• Communication: Send product updates, newsletters (opt-in only), and respond to your inquiries.
• Legal Compliance: Fulfill legal obligations and respond to lawful requests from authorities.

We do not sell your personal data. We share information only in these limited circumstances:

• Service Providers: Trusted vendors who assist in operations (hosting via Cloudflare, payments via Stripe, email delivery via SendGrid) under strict data processing agreements.
• Public Profile Data: Information you publish on your AuraBio page is publicly accessible by design — this is the core purpose of the platform.
• Legal Obligations: When required by law, subpoena, or valid legal process.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with advance notice to affected users.
• With Your Consent: Any other sharing requires your explicit, informed consent.

We implement industry-standard security measures to protect your data:

• Encryption: All data in transit is encrypted with TLS 1.3. Sensitive data at rest is encrypted with AES-256.
• Access Controls: Role-based access with least-privilege principles. All admin actions are logged and auditable.
• Infrastructure: Hosted on Cloudflare's global edge network with DDoS protection, WAF, and automatic failover across 300+ locations.
• Password Security: Passwords are hashed using bcrypt with individual salts. We never store plaintext passwords.
• Incident Response: We maintain a documented incident response plan and will notify affected users within 72 hours of a confirmed breach.
• Regular Audits: Penetration testing and security audits are conducted quarterly by independent third parties.

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update or correct inaccurate personal information via your dashboard settings.
• Deletion: Request deletion of your account and associated data. We will process this within 30 days, subject to legal retention requirements.
• Data Portability: Export your profile data in a machine-readable format (JSON) from your dashboard at any time.
• Opt-Out: Unsubscribe from marketing communications at any time. Manage cookie preferences via our consent banner.
• Restriction: Request that we limit processing of your data in certain circumstances.
• Complaint: Lodge a complaint with your local data protection authority if you believe your rights have been violated.

To exercise any of these rights, email us at [email protected] or use the settings in your AuraBio dashboard.

• Active Accounts: We retain your data for as long as your account is active and you continue to use AuraBio.
• Deleted Accounts: Upon account deletion, personal data is purged within 30 days. Anonymized analytics data may be retained indefinitely.
• Backups: Encrypted backups are retained for up to 90 days for disaster recovery and then permanently destroyed.
• Legal Holds: Data subject to legal preservation obligations will be retained as required by applicable law.

AuraBio operates globally via Cloudflare's edge network. Your data may be processed in the United States and other jurisdictions. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission for EU/EEA data transfers.
• Data Processing Agreements (DPAs) with all sub-processors meeting GDPR requirements.
• Compliance with the UK GDPR and the Swiss Federal Data Protection Act as applicable.

AuraBio is not directed at children under 16 years of age. We do not knowingly collect personal information from children. If we discover that a child under 16 has provided us with personal data, we will promptly delete it. If you believe a child has submitted data to us, please contact us at [email protected].

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes:

• We will notify you via email and/or a prominent notice on the AuraBio platform at least 30 days before the changes take effect.
• The "Effective Date" at the top of this policy will be updated accordingly.
• Continued use of AuraBio after the effective date constitutes acceptance of the updated policy.