Privacy Policy

We collect information that identifies or relates to you through your direct interactions, file uploads, and automatic device collection.

• Account & Contact Information: Includes your name, email address, authentication credentials, profile preferences, and communication history when you reach out for support.
• Financial and Transaction Data (User-Managed): Includes transaction entries, account names, currency preferences, balances, categories, and financial goals that you manually enter or upload via statement files (such as CSV or spreadsheet exports). Aurora Finance does not use bank API aggregators to connect directly to your bank accounts, and we never collect, view, or store your online banking login credentials or PINs.
• Automatic & Device Information: Includes your IP address, device identifiers (hardware model, operating system version), browser type, preferred language, and app interaction logs necessary to secure and operate the Services.
• Derived Insights & AI Features: When you use our budgeting insights or optional AI assistant features, we process your inputs to provide contextual summaries, categorization suggestions, or pacing calculations. We do not sell your data or use your private financial records to train public third-party AI models.

We use your personal and financial data strictly for legitimate operational, product, and legal purposes:

• Service Delivery: Managing your account, operating your multi-currency ledgers, tracking budgets, and calculating currency-isolated net worth and pacing metrics.
• File Import Processing: Parsing and organizing transaction data from files (such as CSV or exported statements) that you voluntarily upload.
• Subscription & Account Management: Verifying subscription status across our mobile and web platforms and delivering customer assistance.
• Security & Fraud Prevention: Protecting against unauthorized access, monitoring system integrity, and preventing abuse of our Services.
• Legal Compliance: Complying with applicable statutory, accounting, and regulatory obligations under the laws of Hong Kong and other relevant jurisdictions.

We do not sell, rent, or trade your personal or financial data. We share information only with trusted third parties necessary to provide and secure our Services:

• Cloud Infrastructure: Amazon Web Services (AWS) data centers located in Singapore, utilized for encrypted hosting, database storage, and backup infrastructure.
• Payment Processors: Apple (App Store In-App Purchases), Google (Google Play Billing), and Stripe, Inc., who process subscription payments and renewals. Payment card numbers are collected directly by these processors and are never received or stored on our servers.
• Transactional & Communication Services: Specialized partners providing transactional email delivery (such as verification emails and alerts) under strict confidentiality agreements.
• Legal & Regulatory Authorities: To comply with valid court orders, subpoenas, or legal processes issued by competent governmental authorities having jurisdiction.

All user data is stored and processed on secure cloud infrastructure hosted in Amazon Web Services (AWS) data centers in Singapore. We employ robust administrative, technical, and physical security measures to safeguard your information. Data is encrypted in transit using Transport Layer Security (TLS 1.3) and encrypted at rest using AES-256 encryption. Access to production environments is strictly restricted based on the principle of least privilege. We retain your personal data for as long as your account is active or as necessary to fulfill the purposes described in this policy, after which your data is deleted or anonymized upon request or account termination.

Aurora Finance operates from Hong Kong with cloud infrastructure based in Singapore, serving users globally. When your personal data is transferred across borders, we ensure that appropriate safeguards are in place in accordance with the Hong Kong Personal Data (Privacy) Ordinance (PDPO) and comparable international standards (such as Singapore's Personal Data Protection Act and standard contractual clauses). These measures ensure your information remains protected to an equivalent standard regardless of where it is processed.

Depending on your jurisdiction, you have specific rights regarding your personal data:

• Access & Portability: Request a copy of the personal data we hold about you or export your financial ledger records.
• Correction: Request correction of inaccurate or incomplete personal information in your account.
• Deletion: Request the permanent deletion of your account and associated financial data, subject to lawful retention requirements.
• Withdrawal of Consent: Revoke permissions or withdraw consent for optional processing activities at any time.

• Hong Kong: We comply with the Personal Data (Privacy) Ordinance (PDPO, Cap. 486) and its six Data Protection Principles (DPPs), ensuring transparent collection, purpose limitation, data accuracy, secure storage, and your rights to data access and correction.
• Singapore: For personal data stored and processed within our Singapore infrastructure, we adhere to the protection, retention, and transfer limitation principles under the Singapore Personal Data Protection Act (PDPA).
• European Economic Area (EEA) & UK: If you are located in the EEA or United Kingdom, we process your personal data under lawful grounds established by the General Data Protection Regulation (GDPR / UK GDPR), and you may exercise your rights to access, rectification, erasure, and data portability or contact your local supervisory authority.
• Global Users: We apply uniform high standards of confidentiality and data security to all users globally, ensuring you retain sovereignty over your financial records.

For questions regarding this Privacy Policy, data protection requests, or to exercise your rights, please contact us: