Privacy Policy

Controller

• Controller: Auroraweb Collective Ltd, company no. 17239668.
• Registered office: F04 1st Floor Knightrider House, Knightrider Street, Maidstone ME15 6LU, United Kingdom.
• Contact: team@auroraweb.co.

Data we process

• Quote requests: name, email, phone, company, project need, budget, message and submission time.
• Newsletter: email address, subscription status, subscription and unsubscribe time, unsubscribe token.
• Invoicing: billing and payment data handled by Stripe, plus payment status returned to Aurora.
• Language preference: selected or detected language stored in local browser storage.
• Analytics after consent: anonymous visitor ID, session ID, page views, clicks, form events, scroll depth, web vitals, errors, referrer, UTM data, device, browser, operating system, country and daily salted IP hash (first-party analytics).
• Google Analytics 4 after consent: page views, events, device and browser data, approximate geography, referrer and UTM data; Google may set _ga, _ga_* and _gid cookies.
• Marketing after consent: Meta Pixel events such as page views and contact requests.

Purposes

• Handling quote requests and customer communication.
• Sending newsletters where you subscribed.
• Managing invoicing and related administration.
• Operating the website, maintaining security and preventing spam or abuse.
• Measuring website usage and advertising performance where you consent.

Legal bases

• Contract or pre-contract steps: quote requests and invoicing.
• Consent: newsletter, non-essential analytics (first-party and Google Analytics 4) and Meta Pixel.
• Legitimate interests: security, abuse prevention and basic business administration.
• Legal obligation: keeping invoicing and accounting records.

Cookies and local storage

Necessary storage keeps your language and consent choice. Analytics and marketing storage are off by default and start only after active consent.

You can change your consent at any time from the cookie settings link in the footer.

• aurora-consent-v1 (local storage): consent choice, necessary, no expiry.
• aw_aid, aw_sess, aw_ft (local storage): first-party analytics, after analytics consent.
• _ga, _ga_*, _gid (cookies): Google Analytics 4, after analytics consent, typically 24 hours to 2 years.

Recipients and providers

• Hosting, email, CRM and admin systems needed to run the website and manage customer communication.
• Stripe for invoicing and payment flows.
• Google Ireland Limited / Google LLC for Google Analytics 4 measurement, only after analytics consent; data may be processed in the United States under Google's data processing terms and standard contractual clauses.
• Meta for Pixel and advertising measurement, only after marketing consent.
• An external geolocation provider may be used for country or language detection.

Retention

• Raw analytics events (first-party): up to 90 days, after which aggregated reports may remain.
• Google Analytics 4 data: per GA4 property settings (default 2 months at user level, up to 14 months at event level).
• Quote requests and customer communication: as long as needed for the business relationship and possible legal claims.
• Newsletter data: while subscribed, and minimal proof of unsubscribe after opt-out.
• Billing and payment records: according to applicable statutory retention periods.

Your rights

• You may request access, correction, deletion, restriction, portability and objection.
• Consent can be withdrawn at any time without affecting earlier lawful processing.
• You may complain to the competent data protection authority.

Note

This policy is a practical summary based on how the website works. It should be reviewed by a qualified legal professional before it is relied on as legal advice.