Privacy Policy

Last updated: 3 May 2026

This Privacy Policy explains how Nervous Group LLP ("we", "us", "our") collects and processes your personal data when you use the Aura service at https://aura4you.io. We are the data controller for the personal data described below within the meaning of the UK General Data Protection Regulation and the Data Protection Act 2018.

Registered office: 27 Old Gloucester Street, London WC1N 3AX, United Kingdom. Partnership number OC455606.

For privacy questions, requests or complaints write to privacy@aura4you.io.

1. Personal data we collect

  • Account data — email address, display name, sign-in identifier (you, or your sign-in provider).
  • Profile data — language preference, gender preference, communication style (you).
  • Usage data — chat messages, character interactions, virtual gifts, in-app actions, timestamps (automatically generated).
  • Payment data — transaction amount, currency, package selected, status, billing country (our payment processors).
  • Technical data — IP address, browser type, device identifiers, approximate location (automatically generated).
  • Cookies and similar — session cookies and authentication tokens (automatically generated).

We do not intentionally collect special-category data (health, ethnicity, sexual orientation, religion, biometric or genetic data). Please do not share special-category data through the Service.

We do not collect payment-card numbers or full bank-account details. Card payments are handled by our PCI-DSS-compliant payment processor; we receive only a token reference and the metadata listed above.

2. Why we use your data and our legal basis

  • Provide the Service, run conversations, persist memories — contract performance, Art. 6(1)(b) UK GDPR.
  • Process Token purchases and deliver receipts — contract performance, Art. 6(1)(b).
  • Detect fraud, abuse and policy violations — legitimate interest, Art. 6(1)(f).
  • Comply with legal obligations including age verification, tax and AML — legal obligation, Art. 6(1)(c).
  • Improve the Service through aggregated, non-identifying analytics — legitimate interest, Art. 6(1)(f).
  • Send transactional emails (security, account, billing) — contract performance, Art. 6(1)(b).
  • Send optional product updates — consent, Art. 6(1)(a), withdrawable at any time.

3. Who we share data with

  • Service providers acting as data processors on our instructions: cloud hosting (Supabase, hosted in the EU/UK), AI inference providers, payment processors (Stripe and our cryptocurrency payment provider), transactional-email providers and error-tracking providers.
  • Public authorities where we are required to disclose data by law, court order or to protect our rights or the safety of others.
  • Successors in the event of a merger, acquisition, reorganisation or insolvency. In that case we will give you reasonable notice and a chance to object before personal data transfers.

We do not sell your personal data and we do not share it with advertisers.

4. International transfers

Some of our service providers operate outside the United Kingdom. When personal data is transferred outside the UK we rely on appropriate safeguards, including adequacy regulations, the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or another mechanism permitted by Article 46 UK GDPR. You can request a copy of the safeguards by writing to privacy@aura4you.io.

5. How long we keep your data

  • Account data — while your account is active, then up to 30 days after deletion.
  • Chat messages and AI memories — while your account is active; deleted on account deletion or when you press "Erase All Data".
  • Transaction records — 7 years (HMRC and AML retention).
  • Moderation events — 24 months from creation.
  • Technical logs — 90 days.

You can erase your chat history, memories and unlocked media at any time from the Profile page. Account deletion can be requested at privacy@aura4you.io.

6. Your rights

Under the UK GDPR you have the right to:

  • access the personal data we hold about you;
  • rectify inaccurate or incomplete data;
  • erase your personal data ("right to be forgotten") subject to legal retention requirements;
  • restrict or object to processing in certain circumstances;
  • receive your data in a portable format;
  • withdraw consent at any time, where processing is based on consent;
  • complain to the UK supervisory authority, the Information Commissioner's Office (https://ico.org.uk).

To exercise any of these rights write to privacy@aura4you.io. We will respond within one month.

7. Cookies

We use only strictly necessary cookies — session and authentication tokens that are required to deliver the Service. We do not use advertising or analytics cookies that would require consent under PECR.

8. Children

The Service is not directed to anyone under 18 and we do not knowingly collect data from minors. If you believe a minor has provided us with personal data, contact privacy@aura4you.io and we will delete the data and the associated account.

9. Security

We use technical and organisational measures appropriate to the nature of the data: encrypted transport (HTTPS), encryption at rest for sensitive credentials, role-based access control, audit logging and least-privilege service-role access on the database. No system is perfectly secure; if a breach affects your data we will notify you and the ICO as required by Articles 33–34 UK GDPR.

10. Changes

We may update this Privacy Policy from time to time. The "Last updated" date above reflects the most recent change. Material changes will be notified through the Service or by email.

11. Contact

Privacy queries: privacy@aura4you.io. General contact: support@aura4you.io. Postal address: Nervous Group LLP, 27 Old Gloucester Street, London WC1N 3AX, United Kingdom.

Last updated 2026-05-03