Part A: Privacy#
The short version#
- We process your firm's data to run Aurian for you, under a Data Processing Addendum that every customer signs.
- Your clients', investors' and buyers' data lives in your firm's own tenant and is used only for their portal and messages.
- We never use one firm's data to train or inform another firm's Aurian, and we never sell personal data.
- Data is hosted in the European Union (Ireland).
- You can export everything and leave. Portals stay live for 30 days after so you can tell your clients.
- If you have a concern, email hello@aurian.app. We will acknowledge it within 30 days and tell you what we are doing about it.
1. Who we are and our role#
Aurian AI Ltd, company number 17353375, registered office Merewood, High Street, Wallcrouch, Wadhurst, East Sussex TN5 7JT. ICO registration: application submitted; the registration number will be shown here when issued. Contact: hello@aurian.app.
We act in two roles:
- Controller for the personal data described in sections 2, 3 and 4 (website visitors, users of the Service, and partners). This policy explains that processing.
- Processor for the data your firm puts into the Service (section 5). Your firm is the controller and decides why and how that data is used. We process it only on your firm's instructions under the Data Processing Addendum.
We have not appointed a Data Protection Officer because we are not required to. Our privacy lead is Nichole Farrow, reachable at hello@aurian.app.
2. Website visitors#
What we collect. When you book a demo, apply to partner, download a resource or contact us: your name, firm, role, email, phone if you give it, what you tell us about your firm, and a referral code if a partner or customer sent you. When you browse: standard server logs (IP address, browser type, pages visited, time of visit) and, subject to the Privacy and Cookies Notice, statistical analytics data.
Why and on what basis.
| Purpose | Lawful basis |
|---|---|
| Replying to you, running a demo, assessing a partner application | Steps at your request before entering a contract; our legitimate interest in promoting the business |
| Crediting the partner or customer who referred you | Your consent to the referral cookie, or the referrer you name when you book a demo; then our legitimate interest in running the referral programme and our contract with the partner |
| Understanding how the Site is used and improving it | Our legitimate interest in running the Site, counting visits only if you choose Accept in the cookie banner |
| Keeping the Site secure and preventing fraud | Our legitimate interest in security, and a recognised legitimate interest where it concerns crime prevention |
| Sending you information about Aurian by email | Your consent where the law requires it; otherwise our legitimate interest in marketing to businesses. You can opt out at any time from any email or by emailing hello@aurian.app |
How long. Enquiries and demo records: 24 months from our last contact with you. Server logs: no longer than 90 days. Partner applications that are declined: 12 months.
3. People who use the Service#
What we collect. When your firm subscribes: the names, emails, roles and phone numbers of the people your firm gives access to; login, device and security data; billing contacts, invoices and payment records (card details are held by our payment provider, Stripe, not by us); support messages and call notes; and logs of how the Service is used, for example which drafts were approved as written and how quickly enquiries were answered.
Why and on what basis.
| Purpose | Lawful basis |
|---|---|
| Providing and securing the Service, authenticating users, billing and support | Performance of our contract with your firm |
| Measuring the value the Service delivers to your firm and reporting it to your firm | Performance of the contract; our legitimate interest in demonstrating the Service |
| Improving the product using aggregated, anonymised usage patterns | Our legitimate interest in improving the Service. We never use one firm's content to improve the Service for another |
| Sending service messages (renewal reminders, security notices, changes to terms) | Performance of the contract and legal obligation |
| Sending product news and feature announcements to account holders | Our legitimate interest in keeping customers informed; you can opt out at any time |
| Keeping accounting records | Legal obligation |
How long. Account data: the life of your firm's subscription plus 60 days for export, then deleted. Billing and invoice records: six years after the end of the financial year they relate to, for tax purposes. Usage and audit logs: 12 months. Support messages: 24 months after the ticket is closed.
4. Partners#
If you are a referral, affiliate, reseller or territory partner: your name, firm, contact details, bank details for commission payments, the firms you introduce and their status, and your agreement with us. We use this to run the partner programme, pay commission, and send you status updates about firms you referred. Lawful basis: performance of the contract with you. Retention: the life of the partnership plus six years for tax records.
5. Your firm's data in the Service#
Your enquiries, clients, quotes, projects, messages, voice notes, photographs, documents, invoices, and everything else your firm enters or the Service produces for it, is your firm's data. Your firm is the controller and we process it on your firm's instructions under the Data Processing Addendum, which sets out the security measures we keep, the sub-processors we use, and what happens to the data when your firm leaves.
If you are a client, investor, lender, buyer, contractor or supplier of a firm that uses Aurian: that firm is responsible for telling you how it uses your data, and for responding to your requests about it. We process your data only to provide the portal and messages the firm has set up for you. If you contact us, we will pass your request to the firm and help it respond. You can still contact the ICO directly at any time.
6. Artificial intelligence#
The Service uses AI models to transcribe voice notes, read photographs, and draft replies, quotes, schedules and documents. Every draft is shown to a person at the firm for approval before anything is sent or committed. No decision with legal or similarly significant effects on you is made by the Service alone.
Our AI providers are listed in the sub-processor list in Annex 2 of the DPA. We use them only under terms that prohibit them from using your data to train their models, and with the shortest data retention option they offer. We never use one firm's data to improve the Service for another firm. Our Trust Centre (aurian.app/trust) explains which features use AI and how.
7. Who we share data with#
- Sub-processors for hosting, database and storage, AI, email and billing, listed at aurian.app/dpa, each bound by a written contract.
- Services your firm connects (Google, Microsoft, Xero, Slack, Telegram), on your firm's instructions.
- Professional advisers such as accountants, insurers and lawyers, under confidentiality.
- Authorities where the law requires or permits, for example HMRC or a court.
- A buyer of our business, if Aurian is acquired, under the same terms; customers will be told and every contract term, including cohort locks, binds the successor.
We do not sell personal data and we do not share it with third parties for their own marketing.
8. Where data is kept and international transfers#
Customer data is hosted in the European Union (Ireland). Some sub-processors process data outside the UK. Where they do, we rely on UK adequacy regulations, the ICO's International Data Transfer Agreement or Addendum, or another lawful mechanism, and we check that the protection is not materially lower than in the UK. Details are in the Data Processing Addendum.
9. Security#
We keep technical and organisational measures appropriate to the data we hold, including database-level tenant isolation with its own automated test suite, encryption in transit and at rest, role-based access, multi-factor authentication, audit logging and daily encrypted backups. Our Trust Centre (aurian.app/trust) describes them. No system is perfectly secure; if we become aware of a breach affecting your data we will tell affected firms within 72 hours and the ICO where required.
10. Your rights#
Under UK GDPR you can ask us to: give you a copy of your personal data (we will carry out a reasonable and proportionate search); correct it; delete it; restrict or object to how we use it; give it to you or another provider in a portable format; and not be subject to a solely automated decision with legal or similarly significant effects. Where we rely on consent, you can withdraw it at any time.
Email hello@aurian.app. We will respond within one month, which we may extend by two further months for complex requests, and we will tell you if so. We may ask you to confirm your identity. If your request concerns data held in a firm's tenant, we will pass it to that firm and help it respond, because that firm is the controller.
11. Complaints#
If you are unhappy with how we have used your personal data, you have the right to complain to us. Email hello@aurian.app with the subject "Privacy complaint", or write to us at the address above. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome and any steps we have taken without undue delay. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113 at any time, though we would welcome the chance to address your concern first.
12. Cookies#
Part B of this notice lists every cookie we use, what it does, how long it lasts, and how to opt out of the non-essential ones.
13. Children#
The Site and the Service are for businesses. We do not knowingly collect personal data from anyone under 18. If you believe we have, email hello@aurian.app and we will delete it.
14. Changes#
We post changes here and update the date at the top. For material changes we email account holders at least 30 days before they take effect.
Part B: Cookies#
Written to the Privacy and Electronic Communications Regulations 2003 as amended by the Data (Use and Access) Act 2025 (in force 5 February 2026), which allows statistical, appearance and security cookies to be set without consent provided visitors are told and can opt out.
1. What cookies are#
In this policy the Site means aurian.app and the Service means the Aurian software service. Cookies are small files placed on your device by a website. Similar technologies include local storage and pixels. We use them to keep the Site and the Service working, to remember your choices, and to count visits.
2. Cookies we set without asking#
The law allows these because they are strictly necessary, or because they are low-risk statistical or appearance cookies for which you have an opt-out.
| Cookie or technology | Set by | Purpose | Lasts | Category |
|---|---|---|---|---|
| Session and authentication | Aurian (the Service) | Keeps you signed in and protects your session against forgery | Up to 30 days, then you sign in again | Strictly necessary |
| Cookie choice | Aurian | Remembers whether you chose Accept or Essential only. Kept in your browser's storage, not sent to us | Until you clear your browser storage | Strictly necessary |
| Portal token | Aurian (portals) | Keeps a client, investor or buyer portal open once a link is used | Session | Strictly necessary |
| Security and rate limiting | Vercel | Protects the Site against abuse and automated attacks | Session | Strictly necessary |
| Statistical analytics | Vercel Web Analytics | Counts visits, pages and referrers so we can improve the Site. Runs only if you choose Accept. Sets no cookie and builds no profile: a visitor is a hash of the request, discarded after 24 hours. Not shared with anyone for their own purposes | No cookie. Visitor hash discarded after 24 hours | Statistical, only if you accept |
| Appearance | Aurian | Remembers display preferences such as light or dark mode | 12 months | Appearance, with opt-out |
3. Cookies that need your consent#
| Cookie | Set by | Purpose | Lasts |
|---|---|---|---|
Referral (aurian_ref) | Aurian (the Site) | Records the partner or customer code you arrived through so they are credited if your firm subscribes. Holds the code and the date only, and is never used to track you across other sites | 30 days |
When you arrive through a referral link we ask whether you are happy for the referrer to be credited. If you say no, no cookie is set; you can still name the person who referred you when you book a demo, and they will be credited that way. We do not use advertising, cross-site tracking or social media cookies on the Site. If we introduce any, we will ask for your consent through the cookie banner before setting them and list them here.
4. Opting out#
You can opt out of statistical and appearance cookies at any time from the "Cookie choices" link in the footer of the Site. Your choice is remembered in your browser's storage. You can also block or delete cookies in your browser settings; if you block strictly necessary cookies, parts of the Site and the Service will not work.
5. Cookies inside the Service#
The Service uses only the session, authentication, cookie choice and appearance cookies above, and no separate product analytics provider. Product analytics inside the Service is covered by our contract with your firm and the Privacy and Cookies Notice, and never includes the content of your firm's data.
6. Banner and prompt wording#
Footer link: Cookie choices
First-visit notice (no consent needed for what we set; shown once, dismissible): We use essential cookies to make this site work. If you accept, we also count visits with privacy-friendly analytics that set no cookie. No advertising, no tracking across sites. "Accept" "Essential only"
Referral prompt (shown only when a visitor arrives through a partner or customer link): You were sent here by {partner name}. Can we set a cookie for 30 days so they are credited if your firm subscribes? It holds their code and today's date, nothing else. "Yes, credit them" "No thanks"
Cookie choices panel: Essential (always on). Statistical: on / off. Appearance: on / off. Referral credit: on / off (only shown if a referral cookie exists). Save
7. Changes#
We update this page when the cookies we use change. The date at the top shows when it last changed.
Questions: hello@aurian.app