Privacy Policy

Scope

This Privacy Policy applies to workspace users, invited team members, and authorized client portal users of the Auroranexis platform. Our services are offered exclusively to business customers (entrepreneurs within the meaning of § 14 BGB). This policy describes processing under the GDPR and applicable German data protection law.

Categories of data processed

We process: account and profile data (name, email, role, organization); operational data you enter (clients, reports, risks, incidents, knowledge, automation configurations); usage, audit, and security logs; billing and subscription identifiers processed via Mollie; connector and integration tokens (stored encrypted); support communications; and, where enabled, inputs/outputs for AI-assisted features.

Purposes and legal bases

Processing occurs to provide the SaaS contract (Art. 6(1)(b) GDPR), for billing and account administration (Art. 6(1)(b) and (1)(f) GDPR), for security and fraud prevention (Art. 6(1)(f) GDPR), for compliance with legal obligations (Art. 6(1)(c) GDPR), and — where applicable — based on your consent for optional analytics or marketing (Art. 6(1)(a) GDPR). Where you act as controller for your clients' data, we process on your instructions as processor (see our DPA).

Retention

We retain personal data for the duration of the subscription and as required for support, billing records, security logs, and legal retention obligations. Deletion or return of customer data follows contract termination and your offboarding instructions, subject to statutory retention periods.

Sub-processors and transfers

We use sub-processors listed on our Sub-processors page (including Supabase, Vercel, Mollie, Resend, and optional AI providers when enabled). Transfers outside the EEA, if any, rely on appropriate safeguards such as Standard Contractual Clauses. Material sub-processor changes are communicated to workspace administrators with reasonable notice.

Your rights