Legal
Privacy Policy
Last updated: 2026-08-29 — GDPR Compliant
1. Who We Are
auraOrNot ("we", "us") is the controller of your personal data for the purposes of the General Data Protection Regulation (GDPR) and applicable national law.
2. Data We Collect
| Category | Data | Purpose | Legal Basis |
|---|---|---|---|
| Account | Email (encrypted), username, birth year, country at registration and selected profile country | Authentication, age verification, country-based discovery | Contract (Art. 6(1)(b)) |
| Content | Images you upload and YouTube, Instagram or TikTok video links | Platform operation | Contract (Art. 6(1)(b)) |
| Activity | Votes, battle participation, ELO scores | Platform features | Contract (Art. 6(1)(b)) |
| Technical | IP address and country at registration, IP address and country of the most recent login, strictly necessary session cookies | Security, fraud prevention, account audit | Legitimate interest (Art. 6(1)(f)) |
3. Encryption
Your email address is encrypted at rest using AES-256-GCM. We store only a SHA-256 hash of your email for uniqueness checks. Passwords are hashed using bcrypt (cost factor 12). We never store plaintext sensitive data.
4. AI Training (Optional)
If you explicitly opt in during registration or via Settings → Privacy, your uploaded content and related Platform activity data may be used to train, validate, evaluate and improve AI systems, and to support product or marketing analysis. This is processed on the basis of your explicit consent (UK GDPR Article 6(1)(a) and, where biometric data is involved, Article 9(2)(a)). You may withdraw consent at any time. Withdrawal stops future use; technically impractical removal from already-trained model parameters is disclosed clearly in our Terms, consistent with ICO guidance on AI and erasure.
5. Your Rights (GDPR Articles 15–22)
- Access — Download all your data via Settings → Export Data.
- Rectification — Edit your profile at any time.
- Erasure — Delete your account in Settings. All personal data is removed within 30 days; anonymised aggregate statistics may be retained.
- Portability — Your data export (JSON) is machine-readable.
- Objection / Restriction — Contact us to restrict processing.
- Withdraw consent — Deregister at any time; this does not affect lawfulness of prior processing.
6. Content Reports (Right to Erasure for Third-Party Content)
If you believe content on our Platform features you without your consent, submit an anonymous content report. We review all such reports and aim to act within 72 hours.
7. International Transfers
Data may be processed by Cloudinary (US) or AWS (EU region). Cloudinary is compliant with the EU-US Data Privacy Framework. AWS EU (eu-west-1) is within the EEA.
8. Cookies
We display a technical-cookie notice and use strictly necessary httpOnly session cookies for authentication and security. The acknowledgement preference is stored locally in your browser. No advertising, analytics, or third-party tracking cookies are set.
9. Data Retention
Account data is retained while your account exists. A deletion request disables the account and hides its content while encrypted email, media, audit metadata and request time are retained for reports, legal obligations and account-holder contact until an authorised administrator permanently purges it. Anonymised aggregate statistics may be retained indefinitely. Ban records may be retained to prevent re-registration.
10. Supervisory Authority
You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or with your national data protection authority (e.g. AEPD in Spain, CNIL in France).