Aurato Privacy Policy

Effective date: 21 October 2026

1. About This Policy

Aurato is operated by 830 Lab Limited (“we”, “us” or “our”). This policy explains how personal data is handled through the Aurato mobile app and related services (the “Service”).

For privacy enquiries, access or correction requests, or deletion assistance, contact support@aurato.ai.

This policy describes data practices. It does not replace any separate permission required for a particular use or disclosure of your data.

2. Information We Process

Accounts and Sign-In

Aurato supports guest accounts associated with a device-related identifier. This identifier may come from information available through your device platform or be generated by the app, and is stored on the device to support account continuity.

If you sign in with or link Google, we receive and process the Google account identifier and available profile information, including your email address, Google profile display name and profile image URL. The Google profile display name is supplied by Google and is not treated by Aurato as a verified legal name. We also keep an Aurato account identifier, language preference, account timestamps and sign-in or account-linking records. We do not receive your Google password.

Birth Profiles and Relationships

We process the details you submit for yourself or another person, including a display name, nickname or other label you choose to enter, gender, birth date and time, whether the birth time is unknown, birthplace, relationship category and any relationship label you enter. You do not need to enter your real or legal name in a birth profile, and the profile label is not verified as your legal identity. We also store relevant display preferences, including whether birth date and time should be shown in the interface.

We calculate and store information derived from these details, including birth-chart components, Five Elements profiles, interpretation results and compatibility information. These are cultural and interpretive outputs, rather than verified factual assessments of a person's character or future.

Questions, Reports and Activity

We process and store questions you submit, selected topics, generated answers, reports, compatibility results and feedback about readings. We also keep records needed to operate features such as daily fortune readings, fortune draws, relationship readings, calendar access, in-app messages, credits and feature unlocks.

Questions and results may reveal information about relationships, emotions, health or finances. Avoid including unnecessary sensitive information, identity documents, payment credentials or private details about other people.

Purchases and Balances

We use Apple App Store or Google Play purchase information and RevenueCat to verify purchases and manage Aura Points and other digital entitlements. Relevant records include your Aurato account identifier, product and transaction identifiers, purchase platform, purchase date, transaction status, points granted, usage and refund or reversal records. RevenueCat is configured with your Aurato account identifier to associate purchases with your account. Its SDK also processes technical information relevant to providing the purchase service, such as device type and operating system, and store transaction evidence such as receipts or purchase tokens.

For purchases through the stores, payment credentials are handled by the relevant platform. The Aurato purchase flows described here do not request your full payment card number. Store and purchase-processing providers also process information under their own applicable privacy notices.

Technical Data and Local Storage

Our servers and service providers receive network information necessary to handle requests, including IP addresses. Aurato requests also include app version and platform information. Operational records may include timestamps, account or record identifiers, processing status, errors and service performance information used to operate, secure and troubleshoot the Service.

The app uses secure device storage for login tokens and its guest identifier, and local preferences or caches for settings and certain API responses. These are different storage mechanisms; not all locally cached content is held in secure token storage. Uninstalling the app does not delete server-held data, and some platform secure-storage items may persist after an uninstall.

3. Purposes of Processing

We process relevant information to:

• Create, authenticate and maintain accounts, including guest access and Google linking;
• Calculate birth profiles, personalise requested readings and produce compatibility results;
• Generate and save AI-assisted reports and answers;
• Deliver fortune, calendar, draw, messaging and other app features;
• Verify purchases, maintain balances and entitlements, and process refunds or transaction corrections;
• Remember settings, cache results and schedule local reminders;
• Respond to feedback and support or privacy requests;
• Investigate errors, prevent misuse and protect the Service; and
• Comply with applicable legal requirements and resolve disputes.

Information needed for a requested feature is required to provide that feature. You may choose not to submit optional information or not to use the relevant feature. For example, refusing to provide birth details prevents personalised birth-chart analysis but does not require you to disclose unrelated information.

4. Third-Party AI Processing

Aurato uses third-party AI service providers to generate parts of its personalised readings and answers. Relevant information is sent from our backend to these providers for this processing. Creating a profile or requesting a report can initiate AI generation; AI processing is not limited to the free-text question feature.

The data sent varies by feature:

• Personal and energy reports: derived birth-chart components, Five Elements information, interpretive attributes, language and relevant gender information;
• Annual and longer-period readings: the display name or nickname entered for the profile, gender, derived birth-chart information, relevant ages or year ranges and language;
• Question features: question text and topic for relevance checks; and, for personalised answers, the display name or nickname entered for the profile, question text, derived chart information, relevant daily-chart information and language; and
• Compatibility readings: the display names or nicknames entered for the profiles, relevant gender and derived chart information for the people involved, relationship context, calculated compatibility indicators and other interpretive context needed to generate the wording.

Not every feature sends every field above. Although many inputs are derived from birth details rather than supplied as a raw birth timestamp, they can still be personal data. Any names or personal details you choose to include inside a question are also part of that question. Using a nickname does not by itself make the associated account, birth details or question anonymous.

AI service providers process inputs and outputs under the arrangements applicable to the service used, including applicable provisions concerning retention, safety monitoring, human review and use for service or model improvement. We do not promise that AI requests are anonymous, that providers never retain inputs or outputs, or that no human review is possible. You may contact support@aurato.ai for information about the AI provider and processing arrangements relevant to your data.

Separate disclosure and explicit permission are required before sharing personal data with a third-party AI service where required by applicable law or platform rules. This policy alone is not a substitute for that permission. If you do not want information processed by third-party AI service providers, do not submit it to AI-enabled features; contact us if you need help understanding which features involve AI or wish to request deletion of information already submitted.

5. Location Assistance, Permissions and Notifications

You can select a birthplace manually. If you choose the app's automatic location assistance, the app contacts GeoJS to estimate a location from your IP address. GeoJS receives the network request, including your IP address, and returns approximate location information. This is IP-based assistance, not access to your device's precise GPS location. Manual selection is available without using this lookup.

The app requests camera access for scanning compatibility QR codes and photo-library saving permission where needed to save a QR image. These features do not require general access to your contacts or a continuous location feed.

Daily fortune and wealth reminders are scheduled locally on your device. You can control them in the app's notification settings and your device's system settings. Notification previews may be visible on a locked device depending on your system settings.

6. Other People's Data and QR Sharing

Only submit another person's birth information where you have the necessary consent or other lawful authority. This applies to saved relationship profiles, compatibility readings and any onward AI processing needed for those features. Do not publicly share another person's results without appropriate permission.

An Aurato compatibility QR code contains encoded birth information, including gender, birth date and time, the unknown-time flag, the birth-date display preference and birthplace if supplied. The QR payload does not include the sharer's profile display name or nickname. It is designed to be decoded by another Aurato installation. A preference to hide the birth date in the interface does not remove that information from the QR payload.

Only share a QR code with people you trust. Encoding or encryption of the QR does not make it anonymous or prevent a recipient using Aurato from processing its contents. Images or results that you save or share through your device may be handled by your photo-storage, backup or sharing service. Copies held by recipients may remain outside our control.

7. Providers and Other Disclosures

We disclose relevant information to providers involved in operating the Service, including:

When you open the feedback form from Settings, the link pre-fills your Aurato user identifier so we can associate feedback with your account. The identifier is included in the form link sent to Google. The form also receives whatever you choose to submit. Check the fields before submitting and avoid unnecessary sensitive information.

Provider policies include Google's Privacy Policy, RevenueCat's Privacy Policy, Apple's Privacy Policy and GeoJS's Privacy Policy. A provider's policy supplements, rather than removes, our responsibilities for data we disclose.

We may disclose relevant data when required by law, to respond to a valid legal request, or where reasonably necessary to address fraud, protect security or establish, exercise or defend legal claims. Relevant data may also be transferred during a business restructuring, merger or transfer, subject to applicable legal protections and notice requirements.

8. International Processing

Our providers may process information outside your place of residence. Service providers may use facilities in more than one country. Privacy protections may differ between jurisdictions. Where applicable law requires safeguards for an international transfer, those safeguards must be applied. Contact us for information about the processing arrangements relevant to your data.

9. Retention and Deletion

We keep account information, saved profiles, questions and reports to provide ongoing access and associated features. Transaction, credit and entitlement records are kept to reconcile balances, prevent duplicate grants, handle refunds and resolve purchase issues. Authentication and operational records support account administration, security and troubleshooting.

Removing another person's profile through the current profile-removal feature archives it from the active profile list. It does not by itself permanently erase the underlying database record or associated history. Contact us if you want to request erasure rather than removal from the active list.

We assess retention according to the purpose of the information, whether it remains needed to provide the Service, legal or accounting requirements, security needs and unresolved disputes. We do not promise automatic deletion after a fixed number of days. Information no longer needed should be deleted or irreversibly anonymised, subject to applicable law. Copies held in backups or by providers may be subject to separate retention processes.

You may request account or personal-data deletion by emailing support@aurato.ai. We may need proportionate verification to locate the correct account and protect it. We will explain the scope of the request, any information that must lawfully be retained and the applicable handling timeframe. We do not treat logging out, uninstalling the app or hiding a profile as a request to erase all associated data.

Account deletion and store refunds are separate processes. Deletion can affect access to saved reports and paid entitlements; please raise unresolved purchase issues when contacting us.

10. Your Rights and Choices

You may contact us to request access to or correction of personal data we hold, seek deletion, ask about disclosures, or make a privacy complaint. We will handle requests under applicable law, including applicable deadlines, and explain any lawful limitation or permitted fee.

Where processing relies on consent, you may withdraw it by contacting us or using any available feature-specific control. Withdrawal does not reverse processing already lawfully completed and may affect features that depend on that processing. You can revoke device permissions through system settings and avoid the optional IP lookup or external feedback form.

Additional rights, such as objection, restriction or portability, may apply depending on your jurisdiction. You may complain to the relevant regulator, including Hong Kong's Office of the Privacy Commissioner for Personal Data where applicable.

11. Security

We use reasonable technical and organisational measures to protect personal data. The mobile production configuration uses HTTPS for app API requests, login tokens use secure device storage, and authenticated backend features use access controls. No system is completely secure, and these measures do not mean that all data is end-to-end encrypted or that every local cache is encrypted.

Protect your device and account, and be cautious when saving or sharing personal reports or QR codes.

12. Age Restriction

Under our Terms, you must be at least 13 years old, or meet any higher minimum age required by applicable law, to use the Service. The Service is not intended for children under 13. Where applicable law requires parental or guardian permission for a minor's use of the Service or processing of personal data, that permission must be obtained.

If you believe a child under the applicable minimum age has provided personal data, or a minor has provided data without permission required by law, contact support@aurato.ai so that we can investigate and take appropriate action, including deletion where required.

13. Policy Updates

We may update this policy as the Service or its data practices change. We will update the effective date and give appropriate notice of material changes. Where a new use requires separate consent, a policy update alone will not replace that consent.

14. Contact

830 Lab Limited
support@aurato.ai

Please contact us with any privacy enquiry or request relating to Aurato.