Privacy Policy

Applies to: AuraBooth, Aura Sync, and all related services

Effective Date: July 8, 2026 | Version 2.0

Aura Ecosystem ("we", "us", "our") operates AI-powered photo transformation software for events and photographic experiences. This Privacy Policy explains what data we collect, how we use it, how long we keep it, and what rights you have over it.

This policy applies to two groups of people:

Operators: photographers, photo booth operators, and event professionals who subscribe to and deploy our software.
Guests: individuals whose photos are captured and processed at events where our software is in use.

Where a section applies to only one group, we say so clearly.

1. What Data We Collect

From Operators

Account information: name, business name, email address, and billing details provided at registration.
Usage data: subscription tier, device count, feature usage, session logs, and device/platform information.
Uploaded content: photos, overlays, logos, and other event assets you upload to the platform.

From Guests

Photos: images captured at events using AuraBooth or Aura Sync.
Contact details: email address or phone number, if you choose to receive your transformed photo by digital delivery. This is optional and collected only at the point of delivery.
AI processing data: facial geometry data is used temporarily during the transformation process to apply the selected artistic style. This data is not stored after the transformation is complete and is not used to build a persistent biometric profile.

2. How We Use Your Data

For Operators

To provide, maintain, and improve the Services.
To process subscription payments and manage your account.
To send service-related communications (receipts, updates, security notices).
To respond to support requests.

For Guests

To generate your AI-styled photo transformation.
To deliver your photo to the endpoint you requested (email, SMS, or QR link).
To display your photo in a temporary event gallery, if that feature is enabled by the operator.

We do not use guest photos for advertising, model training, or any purpose beyond delivering the event experience. If we ever want to feature a guest photo in Aura Ecosystem's own marketing (for example, on this website), we will only do so with your separate, explicit, opt-in consent — this is never a default or automatic use of your photo.

3. Legal Basis for Processing

Where data protection law requires us to identify a legal basis for processing, we rely on the following:

Performance of a contract: for processing operator account and subscription data.
Legitimate interests: for delivering the photo transformation experience to guests within the event context.
Consent: where guests voluntarily provide contact details for photo delivery, or opt in to marketing use of their photo.

Operators processing guest data using our platform act as the data controller for that data. Aura Ecosystem acts as a data processor on their behalf. Operators are responsible for ensuring they have a valid legal basis for capturing guest images at their events.

4. Data Retention

Operator data

Account and billing records are retained for the duration of your subscription and for seven (7) years afterward, as required for financial and legal record-keeping purposes.

Guest photos and delivery data

Guest photos and any associated contact details are retained for a default period of ninety (90) days after the event date, unless the operator requests a shorter retention period or applicable law requires longer retention. After the retention period, photos and contact data are permanently and irreversibly deleted from our servers. Guests may request earlier deletion at any time (see Section 7).

AI processing data

Facial geometry data used during the transformation process is discarded immediately after the transformation is complete. It is never stored beyond the duration of a single processing request.

5. Data Sharing and Third Parties

We do not sell your data. We share data only in the following circumstances:

Cloud infrastructure: we use Supabase for secure cloud storage and infrastructure. This provider processes data on our behalf under contractual data protection obligations.
AI processing providers: we use Fal.ai and similar third-party AI infrastructure providers to perform image transformation (background removal, style transfer, and face swap). Images are sent to these providers solely to generate the requested output for your event and are not retained or reused by them beyond that processing request.
Operators: if you are a guest, the operator who deployed the software at your event has access to event outputs (your transformed photo) as part of their subscription.
Legal requirements: we may disclose data if required to do so by law, court order, or regulatory authority.

Any third-party providers we work with are required to maintain security standards equivalent to our own and are prohibited from using your data for their own purposes.

6. International Data Transfers

Our infrastructure is hosted on cloud platforms that may process data across multiple regions. Where data is transferred across borders, we take appropriate steps to ensure it receives equivalent protection, including through standard contractual clauses or equivalent safeguards recognised under applicable law.

7. Your Rights

Depending on your location and applicable law, you may have the following rights regarding your personal data:

Right to access: request a copy of the data we hold about you.
Right to correction: request that inaccurate data be corrected.
Right to erasure: request that your data be deleted ahead of the standard retention period.
Right to restriction: ask us to limit how we process your data in certain circumstances.
Right to data portability: receive your data in a portable format (where applicable).
Right to object: object to processing based on legitimate interests.

To exercise any of these rights, contact us at hello@auraboothapp.com. We will respond within thirty (30) days. We may ask you to verify your identity before acting on a request.

If you are a guest and your request relates to an image captured at a specific event, please include the event date and operator name (if known) to help us locate your data.

8. Security

We take the security of your data seriously. Our platform uses industry-standard encryption in transit and at rest, access controls, and regular security reviews. We use Supabase as our infrastructure provider, which maintains its own security certifications and compliance programmes.

No system is completely immune to security risks. In the event of a data breach that is likely to affect your rights, we will notify affected parties as required by applicable law.

9. Children

Our services are not directed at children under the age of 13. Operators are responsible for ensuring that appropriate consent is obtained before processing images of minors at their events. If you believe a child's data has been processed without appropriate consent, contact us at hello@auraboothapp.com and we will investigate and delete the relevant data promptly.

10. Cookies and Tracking

Our web platform and operator dashboard may use cookies and similar tracking technologies to maintain sessions, measure usage, and improve the service. We do not use tracking technologies for behavioural advertising.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify operators by email or in-app notification at least thirty (30) days before they take effect. The effective date at the top of this document will always reflect the most current version. Continued use of the Services after the effective date of an updated policy constitutes acceptance.

12. Contact

If you have questions about this policy or want to exercise your rights, contact us at:
hello@auraboothapp.com