Privacy Policy

Privacy Policy — Last updated: 29 October 2026

1. Controller

2. Overview

Aurora provides consulting and assessment, client-side ERP project leadership, and bespoke process automation and integration. Actual processing of personal data depends on the engagement and solution used. Not every engagement includes AI, a dashboard, hosting or ongoing operation by Aurora. Section 5 describes only expressly commissioned CapacityOS services. Section 5a applies to other consulting and implementation projects; the respective sections apply to the website, business contacts and billing.

• the website helloaurora.ai (Section 3),
• business contact, contracting, and billing (Section 4), and
• the operation of expressly commissioned workflow modules through Aurora CapacityOS for our customers (Section 5).
• other consulting and implementation projects (Section 5a).

We process personal data in compliance with the EU General Data Protection Regulation (GDPR/DSGVO), the German Federal Data Protection Act (BDSG), the German Digital Services Act (DDG), and the Telecommunications Digital Services Data Protection Act (TDDDG).

3. Visiting helloaurora.ai

3.1 Hosting & server logs

The website is hosted by Vercel Inc. (compute in Frankfurt, Germany region; global content delivery network for static assets). When you visit, the hosting infrastructure processes the technical data your browser transmits (IP address, browser type, requested page, timestamp) to deliver the site and protect it against abuse. These logs are short-lived and used for security and operations only. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in operating a secure website.

On the start page we additionally use Vercel Web Analytics, a cookie-free page-view measurement by the same hosting provider. It counts visits, page paths, and referrer sources in aggregated form only: no cookies, no cross-site tracking, and no persistent visitor identifier (an anonymised session hash is discarded within 24 hours). We use these aggregate numbers to understand which pages are read. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in measuring aggregate site usage without tracking individuals.

3.2 Fonts

Legal pages use fonts self-hosted on our own domain. The AI process consulting page additionally loads fonts through Bunny Fonts, provided by BunnyWay d.o.o., Slovenia. The AI Check and the knowledge and blog pages also load fonts through this service. According to the provider, the service does not set cookies or store identifiable visitor logs. Legal basis: Art. 6(1)(f) GDPR.

3.3 Cookies & consent

The website itself sets no third-party tracking cookies and uses no cookie-based analytics — page-view measurement happens cookie-free via our hosting provider (see 3.1). Your language choice is stored locally in your browser (localStorage). This technically necessary setting works without consent (§ 25(2) TDDDG). Because the website does not use optional analytics or marketing cookies, it does not display a cookie-consent banner.

3.4 Example videos (YouTube, click-to-load)

Example recordings on the website are embedded via YouTube's extended privacy mode (youtube-nocookie.com) and load only after you press play. Until you click, no request is sent to YouTube/Google. When you press play, YouTube (Google Ireland Ltd. / Google LLC) receives your IP address and device information under Google's own privacy policy, and may transfer data to the United States (EU-US Data Privacy Framework). Legal basis: Art. 6(1)(a) GDPR — consent expressed by starting the player.

3.5 Booking a consultation (Calendly)

The "Book a call" buttons link to our scheduling page at Calendly LLC (USA; EU-US Data Privacy Framework and SCCs). If you book there, Calendly processes the name, email address, and time slot you enter, and shares them with us to hold the meeting. You may alternatively email info@helloaurora.ai to schedule without Calendly. Legal basis: Art. 6(1)(b) GDPR — pre-contractual steps at your request.

3.6 AI Check

The self-assessment at /ki-check runs entirely in your browser. Your answers are not transmitted to Aurora or any third party.

3.7 Contact by email

If you email us, we process your address and message content to answer you. Legal basis: Art. 6(1)(b) GDPR (pre-)contractual communication, or Art. 6(1)(f) GDPR for general enquiries.

4. Contracting & Billing

ChaseList. Our software product ChaseList has its own privacy policy at chaselist.helloaurora.ai/privacy; this policy does not cover ChaseList.

• Offers and contracts. For enquiries, offers, and engagements we process business contact data (name, role, company, email, phone) and contract data (scope, fees, correspondence). Legal basis: Art. 6(1)(b) GDPR.
• Payments via Stripe. Recurring managed-operations fees may be processed by Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe Inc., USA — EU-US Data Privacy Framework and SCCs). Aurora does not store credit-card or bank-account numbers; we receive billing status, customer reference, and payment timestamps.
• Invoicing and banking. Invoices and quotes are issued via our business-banking provider Qonto (Olinda SAS, France/EU); funds are held with Qonto and, for non-EUR currencies, Wise (EU). These institutions act under their own regulatory responsibilities.
• Retention. Billing and contract records are retained for the statutory periods of German commercial and tax law (up to 10 years, § 147 AO, § 257 HGB). Legal basis: Art. 6(1)(c) GDPR.

5. Expressly Commissioned CapacityOS Process Modules

When Aurora operates workflows for a customer, Aurora processes personal data on that customer's behalf as a processor under a data processing agreement (Auftragsverarbeitung, Art. 28 GDPR) — see our Data Processing Agreement. In brief:

• What is processed: incoming emails and attachments addressed to the agreed workflow mailboxes (e.g. a claims or document-intake address), the customer's reference documents indexed for retrieval, the drafts the workflow prepares, the step-by-step run logs with cited sources, approval decisions, and the standing rules learned from the customer's corrections.
• Who the data concerns: the customer's staff (reviewers) and the customer's own clients and correspondents whose messages and documents flow through the agreed workflow.
• AI processing: message and document content is processed by our model providers — Anthropic (primary) and OpenAI (text embeddings for document retrieval; configured fallback) — under our own agreements with them. Per their API terms, neither provider uses our API data to train their models. See the sub-processor list for details and transfer safeguards.
• Where it runs: the workflow engine runs on servers of Hetzner Online GmbH in Germany; databases (including the document index) are hosted by Supabase in the EU (Frankfurt). Where the engagement uses Aurora-provided workflow mailboxes, these run on Google Workspace (Google Ireland Ltd.); where workflows operate on the customer's own systems (e.g. the customer's Microsoft 365 tenant) or involve no email, they run under the customer's own access grant instead. Model API calls to Anthropic/OpenAI are the only processing step that leaves the EU by design.
• Human approval (Art. 22 GDPR): no client-facing message is sent without explicit approval by a human reviewer designated by the customer. The workflows prepare drafts; they make no solely automated decisions with legal or similarly significant effect.
• AI transparency (EU AI Act Art. 50): messages sent through the workflows carry machine-readable markers identifying them as AI-assisted and human-reviewed.

For data subjects whose messages are processed inside a customer's workflow, the customer is the controller; please direct rights requests to the firm you corresponded with — we support our customers in answering them (Art. 28(3)(e) GDPR).

5a. Consulting and bespoke automation projects

Depending on the agreed scope, project documents may contain personal data, such as business contact details, project participants' names and responsibilities, meeting and decision records, or personal information in testing and migration documents. Implementation projects may also involve the business, transaction or system data needed for the agreed process, where those data are personal. Not every engagement requires access to live ERP data. The scope and purpose of necessary access, data flows, systems, any interfaces, hosting, storage locations and deletion are specified for the engagement. These arrangements are not inferred from the CapacityOS architecture.

Where Aurora processes these data on the client's behalf, the client's documented instructions and the agreed DPA apply. The client is responsible for informing individuals about that processing; Aurora provides the assistance required by the agreement and applicable law. Section 4 applies to Aurora's own business contacts, contract administration and billing.

A consulting or implementation engagement does not, by itself, involve the AI services or infrastructure described for CapacityOS in Section 5. Processing project or client data through those services requires a separately agreed basis that has been assessed for data protection compliance.

6. Recipients & Sub-processors

The complete, canonical list of Aurora's sub-processors — including purpose, location, and transfer safeguards for each — is published at helloaurora.ai/sub-processors and forms part of this policy. We disclose personal data to authorities only where legally required.

Processors and subprocessors relevant to bespoke consulting and implementation projects are determined from the services actually used and, where required, documented in the project DPA. Providers used for CapacityOS are not automatically involved in other engagements.

7. International Data Transfers

The following information on existing infrastructure and providers concerns the website and CapacityOS services described. For bespoke solutions, the actual intended processing and access locations and any necessary transfer safeguards are assessed and documented for the engagement. This does not constitute a blanket commitment to a particular hosting architecture or processing location for every bespoke solution.

Aurora's infrastructure is EU-based by design (Hetzner Germany, Supabase Frankfurt, Vercel Frankfurt compute, Google Ireland). Transfers to providers in the United States (Anthropic, OpenAI, Stripe, Calendly, YouTube on click, Vercel's global CDN) are safeguarded by the EU-US Data Privacy Framework where the provider is certified, and by the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) with supplementary measures (TLS 1.3 in transit, encryption at rest, data minimisation).

8. Your Rights Under GDPR

• Access (Art. 15): request a copy of the personal data we hold about you.
• Rectification (Art. 16): request correction of inaccurate data.
• Erasure (Art. 17): request deletion, subject to statutory retention duties.
• Restriction (Art. 18): request restricted processing.
• Data portability (Art. 20): receive your data in a structured, machine-readable format.
• Objection (Art. 21): object to processing based on legitimate interest.
• No solely automated decisions (Art. 22): the human approval gate is the operative safeguard — no outbound action is taken without human approval. (The only automatic message is a fixed-text confirmation of receipt containing no case content.)
• Withdraw consent (Art. 7(3)): withdraw any consent (e.g. the video-player consent) at any time with effect for the future.

To exercise these rights, email privacy@helloaurora.ai. We respond within 30 days; if we need longer, we tell you within that period. If your data was processed inside one of our customers' workflows, we will route or support your request as described in Section 5.

9. Retention

• Enquiries: kept as long as needed to handle the matter, then deleted in regular reviews.
• Contract, billing, and tax records: statutory periods (up to 10 years, § 147 AO / § 257 HGB).
• Customer workflow data (emails, documents, drafts, run logs, learned rules): retained for the duration of the engagement as part of the contracted service record; on termination, returned or deleted per the DPA (within 30 days of the request, subject to statutory retention duties).
• Hosting logs: short-lived, per the hosting providers' security-log cycles.
• Personal data in consulting and implementation projects: according to the purpose and role of the processing; for processing on behalf of a client, under the agreed instructions and return or deletion arrangements; for Aurora's own contractual records, under applicable statutory retention requirements.

10. Security

The following platform-specific measures concern CapacityOS process modules operated by Aurora. They do not describe all bespoke solutions or systems operated by a client or its implementation partner.

• All data in transit is encrypted (HTTPS / TLS 1.3); data at rest is encrypted by our hosting providers (AES-256).
• Strict per-customer separation in the workflow engine and databases (row-level security; per-firm isolation verified by automated tests).
• Access on a least-privilege basis; secrets kept in encrypted environment configuration, never in source code.
• Every workflow run is logged step by step; approval decisions are recorded — the audit trail is part of the service itself.
• Continuous automated monitoring and alerting on the production system.

For bespoke consulting and implementation projects, the necessary access, permissions, data transfer and storage arrangements, and responsibilities are agreed for the engagement. Where Aurora acts as a processor, the relevant technical and organisational measures are documented in the DPA. References to UAT, security roles or segregation of duties on our service pages describe consulting topics and examples; they are not a certification or a guarantee of the security of a client's system.

11. Children's Privacy

Our services are directed at businesses and not intended for individuals under 16. We do not knowingly collect personal data from children; if we become aware of such data, we delete it promptly.

12. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The competent authority for Aurora is:

13. Changes to This Policy

We update this policy when our services or legal requirements change. Material changes are communicated to active customers by email. The "Last updated" date above reflects the most recent revision.