Privacy Policy
Last updated: July 4, 2026
Your trust matters. This policy describes, in plain language, exactly what data AuroraNote handles, why, and the control you keep over it.
1Introduction
AuroraNote (“we,” “our,” or “us”) provides an AI-powered study platform that transforms lectures, notes, and documents into structured learning materials. We are committed to protecting your personal data and respecting your privacy rights. This Privacy Policy explains what we collect, why, how long we keep it, and the choices and rights you have. It applies to all users of our website and services (the “Services”).
2Data Controller & Contact
For the purposes of the EU/UK General Data Protection Regulation (GDPR), AuroraNote acts as the data controller for personal account data, and as a data processor for the content you upload and generate.
For any privacy request or question, contact our Data Protection Officer at auroranotelux@gmail.com.
3Information We Collect
We practise data minimisation: we only collect what is necessary to operate the Services.
- Account data: your email address and an encrypted (hashed) password, managed by our authentication provider (Supabase Auth).
- Uploaded content: the audio, PDF, image, or text files you submit for processing, and the text extracted from them.
- Generated content: the notes, summaries, translations, and flashcards produced from your documents.
- Billing data: if you subscribe to Pro, your subscription status, plan, renewal date, and a Stripe customer reference. We never receive or store your card number — payment details go directly to Stripe.
- Usage counters: monthly counts of processed documents, AI generations, and chat messages, used solely to apply plan limits fairly.
- Technical data: minimal operational logs (timestamps, error codes, rate-limit counters) used to keep the Services secure and reliable. We do not sell or use this for advertising.
4How & Why We Use Your Data
Under GDPR Article 6, we rely on the following legal bases:
- Performance of a contract: to authenticate you, process your uploads, and deliver generated study materials.
- Legitimate interests: to secure the platform, prevent abuse, and maintain service reliability (balanced against your rights).
- Legal obligation: to comply with applicable laws and lawful requests.
We do not sell your content or use it to build advertising profiles.
5AI Processing & Zero-Retention
Our core features rely on third-party AI services. When you request an extraction, summary, translation, flashcard set, transcription, or podcast episode, the relevant content is transmitted over an encrypted connection to our AI sub-processors — Deepgram (speech-to-text), ElevenLabs (voice synthesis), DeepSeek (text generation), and Mistral AI (document OCR) — exclusively to deliver the service you requested, and never for advertising, profiling, or resale.
Zero-Retention Policy. Original multimedia source files (audio and video) are physically and permanently deleted from our servers at the exact moment processing ends — whether it succeeds or fails — and an automated daily sweep removes any orphaned file within 24 hours. Note that for videos, the video track never even leaves your device: only the audio is extracted, locally in your browser, and uploaded. We engage our AI sub-processors under their API and data-processing terms, and send them only the minimum content needed to fulfil your request. Their handling of that content is governed by their own terms, which we link in our sub-processor list. Your data remains yours.
AI output can be imperfect. Please review the Terms of Service for important disclaimers about accuracy.
6Data Retention & Storage
Uploaded source files are stored only temporarily in an isolated, private storage bucket for the duration of active processing, and are automatically deleted immediately after extraction completes.
Extracted text and generated materials are retained in your private workspace until you delete them. Deleting a document from your dashboard, or using “Erase all data” in your account, permanently removes the associated records. Data is stored on EU-region infrastructure (Supabase, Frankfurt/Ireland).
8International Data Transfers
Where data is processed outside the EEA/UK (for example by our AI sub-processor), such transfers are safeguarded by appropriate mechanisms such as the European Commission's Standard Contractual Clauses, together with technical measures like encryption in transit.
9Security
We protect your data with encryption in transit (HTTPS/TLS), hashed credentials, strict Row-Level Security policies, scoped API authentication, rate limiting, and security headers. No system is perfectly secure, but we work continuously to safeguard your information and will notify you and the relevant authorities of any qualifying breach as required by law.
10Your Privacy Rights (GDPR / CCPA)
Depending on your location, you have the right to:
- Access a copy of your personal data.
- Rectify inaccurate data.
- Erase your data (the “right to be forgotten”).
- Restrict or object to certain processing.
- Data portability — export your notes and flashcards.
- Withdraw consent at any time, without affecting prior processing.
You can exercise erasure directly from your account, or contact us at auroranotelux@gmail.com. You also have the right to lodge a complaint with your local data-protection authority.
12Children's Privacy
The Services are not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.
13Changes & Contact
We may update this Policy to reflect changes in our practices or the law. Material changes will be signalled by updating the “Last updated” date above. Questions? Reach us at auroranotelux@gmail.com.