Privacy Policy

Controller

• Controller: Auroraweb Collective Ltd, company no. 17239668.
• Registered office: F04 1st Floor Knightrider House, Knightrider Street, Maidstone ME15 6LU, United Kingdom.
• Contact: team@auroraweb.co.

Data we process

• Quote requests: name, email, phone, company, project need, budget, message, submission time and source, page or campaign details where supplied.
• Newsletter: email address, pending or confirmed subscription status, confirmation and unsubscribe times, unsubscribe token, verification code hash and expiry, and attempt count. We do not store the readable code.
• Invoicing: billing and payment data handled by Stripe, plus payment status returned to Aurora.
• Language preference: selected or detected language stored in local browser storage.
• Analytics after consent: pseudonymous visitor ID, session ID, page views, clicks, form events, scroll depth, web vitals, errors, referrer, UTM data, device, browser, operating system, country and daily salted IP hash (first-party analytics).
• Google Analytics 4 after consent: page views, events, device and browser data, approximate geography, referrer and UTM data; Google may set _ga and _ga_* cookies.
• Marketing after consent: Meta Pixel events such as page views and contact requests.
• Article contact forms: your chosen email address or phone number, article title and address, language, submission identifier and time, and referral or campaign details where supplied.
• AI assistant: messages, replies, language and current page are processed to answer your questions. If you submit a chat inquiry, we save your email, phone number, conversation transcript and AI-generated project summary, and email these to our team.
• Security: IP addresses and submission times are used for rate limiting and duplicate-submission prevention. These are separate from consent-based analytics.

Purposes

• Handling quote requests and customer communication.
• Sending newsletters where you subscribed.
• Managing invoicing and related administration.
• Operating the website, maintaining security and preventing spam or abuse.
• Measuring website usage and advertising performance where you consent.
• Answering questions through the AI assistant and following up on article and chat inquiries.

Legal bases

• Contract or pre-contract steps: quote requests and invoicing.
• Consent: newsletter, non-essential analytics (first-party and Google Analytics 4) and Meta Pixel.
• Legitimate interests: security, abuse prevention and basic business administration.
• Legal obligation: keeping invoicing and accounting records.
• Contract or pre-contract steps: responding to project questions and contact requests, including through the AI assistant. Legitimate interests: responding to general business questions.

Cookies and local storage

Necessary storage keeps your language and consent choice. Analytics and marketing storage are off by default and start only after active consent.

You can change your consent at any time from the cookie settings link in the footer.

• aurora-consent-v1 (local storage): consent choice and decision time; no automatic expiry.
• aurora-lang and aurora-lang-explicit: language settings in cookies and local storage. The automatic language cookie lasts 30 days; explicit language cookies last one year. Local storage has no automatic expiry.
• aw_aid and aw_ft (local storage): pseudonymous visitor identifier and first-touch attribution after analytics consent, with no automatic expiry. aw_sess is refreshed during activity and starts a new session after 30 minutes of inactivity; the stored entry has no automatic expiry.
• aw_lp (session storage): analytics landing page for the current browser tab. aw_ga_debug (session storage): diagnostic flag when analytics debugging is enabled. Session storage lasts for the tab session.
• _ga and _ga_* (cookies): Google Analytics 4 after analytics consent, normally two years unless settings change.
• _fbp and _fbc (cookies): Meta browser and advertising-click identifiers where set after marketing consent.
• You can remove browser storage through your browser settings. Withdrawing consent removes the main first-party analytics identifiers and known analytics or marketing cookies.

Recipients and providers

• Hosting, email, CRM and admin systems needed to run the website and manage customer communication.
• Stripe for invoicing and payment flows.
• Google Ireland Limited / Google LLC for Google Analytics 4 measurement, only after analytics consent; data may be processed in the United States under Google's data processing terms and standard contractual clauses.
• Meta for Pixel and advertising measurement, only after marketing consent.
• ip-api.com receives your IP address when a country lookup is needed for language selection or to enrich consent-based analytics.
• AI responses and summaries: OpenRouter and its selected model providers, or Google AI, depending on the configured service. Conversation content is sent to the provider when you use the assistant, independently of analytics or marketing consent. Avoid entering sensitive information or secrets.

Retention

• Raw analytics events (first-party): the system deletes daily records older than 90 days once an aggregated report exists; aggregated reports may remain.
• Google Analytics 4: user- and event-level retention depends on the property configuration (standard properties offer 2 or 14 months); aggregated reports may remain longer.
• Quote requests and customer communication: as long as needed for the business relationship and possible legal claims.
• Newsletter data: while confirmation is pending or the subscription is active, with minimal proof of unsubscribe after opt-out. Verification codes become invalid after 10 minutes.
• Billing and payment records: according to applicable statutory retention periods.
• Chat inquiries, including saved transcripts and summaries, and article contact requests follow the same retention criteria as other inquiries. AI providers apply their own retention terms to the content they receive.

Your rights

• You may request access, correction, deletion, restriction, portability and objection.
• Consent can be withdrawn at any time without affecting earlier lawful processing.
• To exercise your rights, contact team@auroraweb.co. Rights apply subject to the conditions in applicable law. You can unsubscribe from newsletters using the link in the email.
• You may complain to the UK Information Commissioner’s Office (ico.org.uk) or your local data protection authority.

About this policy

This policy covers the public website, including its AI assistant and contact forms. Required contact fields let us respond to your request; without them we may be unable to follow up. Changes to our services or data practices will be reflected here with an updated revision date.