Privacy Policy — Aura by Vexoria

1. Introduction

Welcome to Aura. This Privacy Policy explains how Vexoria ("we," "us," or "our") collects, uses, discloses, and safeguards your information when you use our Aura mobile application (the "App"). Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the App.

We reserve the right to make changes to this Privacy Policy at any time and for any reason. We will alert you about any changes by updating the "Last updated" date of this Privacy Policy. You are encouraged to periodically review this Privacy Policy to stay informed of updates.

2. Information we collect

We may collect information about you in a variety of ways. The information we may collect via the App includes:

Account data When you create an account, we collect your name and email address through Sign in with Apple or Google Sign-In. If you use Sign in with Apple's private relay, we receive only the anonymized email address Apple provides. We also store your AI processing consent record, including the date and time it was given.

Photos and project content With your explicit permission, the App accesses photos you select from your device's photo library. Selected photos are uploaded to our secure cloud storage (Supabase) and transmitted to Anthropic's Claude API for aesthetic analysis. We do not access your entire photo library — only the specific images you choose to upload for a curation project.

Alongside your photos, we collect the project context you provide, such as your stated objective, aesthetic direction, and any notes you add.

Device data Information about your mobile device, including device type, operating system version, unique device identifiers, and mobile network information. This data helps us optimize the App's performance and compatibility.

Usage data Information about how you use the App, including features accessed, time spent in the App, and interaction patterns. This helps us improve the user experience and develop new features.

3. How we use your information

We use the information we collect in the following ways:

To provide, maintain, and improve the App's functionality
To process your photos through our AI curation pipeline, which selects, ranks, and orders images and generates aesthetic feedback
To personalize your experience and deliver content relevant to your interests
To communicate with you about updates, new features, and support
To monitor and analyze usage patterns and trends
To detect, prevent, and address technical issues
To comply with legal obligations and protect our rights

We may share your information in the following situations:

Service providers We may share your information with third-party service providers who perform services on our behalf, such as analytics, hosting, and customer support. These providers are contractually obligated to protect your information and use it only for the purposes we specify.

Legal requirements We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

Business transfers If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

AI processing To deliver curation results, we transmit your selected photos and project context to Anthropic, our AI provider. This transfer occurs only after you have given explicit consent within the App. Anthropic processes this data solely to return an analysis to us and does not use it to train its models. See Section 5A for details.

With your consent We may share your information for any other purpose with your explicit consent.

5. Third-party data providers

The App integrates with the following third-party services to provide enhanced functionality:

Provider	What it does	Data involved
Supabase	Authentication, database, and photo storage	Email, user ID, uploaded photos, project data
Anthropic (Claude API)	AI aesthetic analysis of your photos	Uploaded images, project context
Apple (Sign in with Apple)	Account authentication	Name, email or private relay address
Google (Google Sign-In)	Account authentication	Name, email, profile identifier
PostHog	Product analytics	Pseudonymous user ID, in-app events, device and app version
Sentry	Crash and error reporting	Error logs, device information, app version
Expo / EAS	App builds and over-the-air updates	App version, device platform

Each of these providers has their own privacy policies governing how they handle data. We encourage you to review their policies:

Supabase Privacy Policy: https://supabase.com/privacy
Anthropic Privacy Policy: https://www.anthropic.com/legal/privacy
Apple Privacy Policy: https://www.apple.com/privacy/
Google Privacy Policy: https://policies.google.com/privacy
PostHog Privacy Policy: https://posthog.com/privacy
Sentry Privacy Policy: https://sentry.io/privacy/
Expo Privacy Policy: https://expo.dev/privacy

Aura's core function is automated aesthetic curation performed by artificial intelligence. Before your first curation, the App asks for your explicit consent to send your photos to our AI provider. Curation cannot proceed without this consent.

What is sent: the images you select for a project, plus the context you provide (objective, aesthetic direction, notes).

Who receives it: Anthropic, PBC, operating in the United States.

How it is used: solely to generate a curation result that is returned to the App. Anthropic does not use data submitted through its commercial API to train its models.

Retention: photos are stored in our cloud storage for as long as the associated project exists in your account. Deleting a project or your account removes them (see Sections 5B and 7).

Withdrawing consent: you may withdraw your consent at any time by deleting your account. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Automated decision-making: Aura's output is a recommendation. It has no legal or similarly significant effect on you, and you remain free to accept, adjust, or ignore any suggestion the App makes.

5B. Data retention

We retain your data only as long as necessary for the purposes described in this policy:

Photos and project data: retained while the project exists in your account. Deleted permanently when you delete the project or your account.
Account data: retained while your account is active.
Analytics and crash data: retained by our providers for up to 12 months in pseudonymous form.
Consent records: retained for the life of the account and for a limited period afterward, as required to demonstrate compliance.

Deletion requests are processed within 15 days.

6. Data security

We implement appropriate technical and organizational security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption in transit using TLS for all data transmitted between the App, our servers, and third-party providers
Encryption at rest for stored photos and database records
Row-level security policies restricting each user's data to their own account
Authentication through Apple and Google identity providers
Access to production systems limited to authorized personnel

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security.

7. Your rights and choices

Depending on your location, you may have certain rights regarding your personal information:

Access and portability You have the right to request access to the personal information we hold about you and to receive a copy of that information in a portable format.

Correction You have the right to request that we correct any inaccurate or incomplete personal information.

Deletion You have the right to request deletion of your personal information, subject to certain legal exceptions.

Account deletion You can permanently delete your account directly in the App, at any time, without contacting us. Go to Settings → Delete Account. Deleting your account permanently removes your profile, all projects, all uploaded photos, and all curation results from our systems. This action cannot be undone.

Opt-out You can opt out of certain data collection and processing activities through the App's settings or by contacting us directly.

Withdrawal of consent Where processing is based on your consent, you may withdraw it at any time. For AI processing, withdrawal is exercised through account deletion, as the App's core function cannot operate without it.

Objection and restriction Where permitted by applicable law, you may object to or request restriction of certain processing activities.

Photo library access You can revoke the App's access to your photo library at any time through your device's privacy settings. Note that this will limit the App's functionality.

To exercise any of these rights, contact us at contato@vexoria.com.br. We will respond within 15 days.

8. Children's privacy

The App is not intended for individuals under 18 years of age, and is rated accordingly on the App Store. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe a minor has provided us with personal information, contact us at contato@vexoria.com.br and we will delete it promptly.

9. International data transfers

We are based in Brazil, but the infrastructure and service providers we rely on operate primarily in the United States. This means your data — including uploaded photos — is transferred to and processed in the United States and potentially other countries where our providers operate.

These transfers are carried out under contractual safeguards with each provider. Where required, we rely on Standard Contractual Clauses or equivalent mechanisms recognized under the GDPR, and on the international transfer provisions of Brazil's LGPD (Law No. 13.709/2018).

By using the App, you acknowledge that your information will be processed outside your country of residence.

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

We encourage you to review this Privacy Policy periodically for any changes. Your continued use of the App after we post any modifications to the Privacy Policy will constitute your acknowledgment of the modifications and your consent to abide by the modified Privacy Policy.

10A. Legal bases for processing

If you are located in Brazil or the European Economic Area, we process your personal data on the following legal bases:

Performance of a contract: account creation, authentication, and delivery of curation results.
Consent: transmission of your photos to our AI provider for aesthetic analysis.
Legitimate interests: product analytics, crash reporting, security, and fraud prevention — balanced against your rights and limited to pseudonymous data where possible.
Legal obligation: compliance with applicable laws and lawful requests from authorities.