AureoLegal informationPrivacy Policy
DRAFT — details still require confirmation. This updated draft describes the checked-in implementation. Before adopting it as the final notice, we must confirm the controllers’ postal address and allocation of responsibilities, legal bases (especially analytics and diagnostics), employer reporting arrangements, production retention jobs, provider locations and any international-transfer safeguards. This draft does not establish that optional analytics consent has been implemented.
Who is responsible
Aureo is a personal financial planning service developed by its founders, Sasha Tarocco and Davide Barbato. No company has been incorporated. The founders are identified as the proposed controllers for this draft; their respective responsibilities and contact address remain to be confirmed. Contact: support@aureoapp.com.
Scope and age
This notice covers the Aureo app, backend, support and browser dashboards where applicable. Aureo’s current stated eligibility is age 16 and over. The final eligibility and contractual-capacity rules require confirmation; this age statement does not establish consent for a particular processing activity.
Information processed and why
- Accounts and profiles: Supabase Authentication account identifiers, email and provider-linked metadata used for sign-in; profile name, birthday or age band and an optional private profile photo. These support access, personalization and account administration.
- Financial planning: the financial information you enter, including assets and growth assumptions, recurring and one-off incomes and expenses, liquidity balances and corrections, budgets, goals, notes, monthly records, actuals, scenarios and financial settings. The service uses these to calculate summaries, forecasts, estimated goal timelines and planning insights. It also records coach-foundation progress.
- Company access: premium entitlement status, company association and invitation/redemption records. Employer invitations may link your account to an employee roster and populate your name and age band from that roster.
- Notifications: preferences, marketing opt-in/out and change history, in-app messages, delivery and interaction records. For enabled push notifications, the backend processes an installation identifier, Apple Push Notification service (APNs) token, app identifier and environment, locale, time zone, app version/build, system authorization status and registration/deactivation timestamps.
- Feedback and support: report category and message, optional reply email and diagnostic logs, app/build, operating system, device model, locale and handling status. We use them to investigate issues, respond to requests and improve the service. Submitted text and logs may contain personal information; include only what is needed.
- Product analytics: event names/times, session and installation identifiers, hashed installation linkage, account linkage after sign-in, app version/build, platform, locale and limited typed properties such as screen, onboarding step, authentication provider/success and session duration. The event contract excludes financial amounts, financial records, arbitrary free text and contact details from event properties. Account and pseudonymous identifiers are still personal data.
- Integrity and security: Apple App Attest key identifiers, verification environment, counters and revocation state, short-lived challenges/tokens and rate-limiting records. These protect the service and analytics from abuse. Browser dashboards also use authentication and request-protection information described in the Cookie Policy.
- Production crash diagnostics: Firebase Crashlytics reports and selected unexpected technical failures, with app/build, locale, a pseudonymous diagnostics identifier and limited technical breadcrumbs. The app’s diagnostics design excludes financial amounts/records, authentication tokens, email, request/response bodies, feedback text and raw backend error messages from the information supplied to Crashlytics.
Account details and the records needed for a calculation are necessary for the corresponding features. Profile photos, feedback, a reply email and diagnostic attachments are optional; omitting them does not prevent use of core financial planning. Missing financial inputs can make forecasts incomplete.
Company dashboards and peer comparisons
An employer or sponsoring organization can provide an employee roster containing name, invitation code, department, seniority, salary band, age band, gender and activation status. Authorized company users can access their organization’s roster and stored company/segment reports, including adoption statistics, financial scores, spending/saving ratios, emergency-fund indicators and goal summaries where available. Individual app financial records are distinct from those dashboard reports. Small groups can allow inferences; this draft makes no guarantee that all reports are anonymous. The source of reports, minimum group sizes and the employer’s privacy responsibilities must be confirmed before the final notice is adopted.
Coach benchmarks compare savings, recurring income and lifestyle expenses with other Aureo users in a similar age group, with a broader user pool when the age-group sample is insufficient. This produces comparative metrics rather than showing another user’s records.
Proposed legal bases — review pending
| Purpose | Proposed basis / open issue |
|---|---|
| Account access, core planning, requested support and account administration | Contract necessity, only for processing objectively necessary to provide the requested service. Employer processing and peer comparisons need their own assessment. |
| Security, fraud prevention and essential technical operations | Legitimate interests, subject to a documented necessity and balancing assessment. |
| Applicable legal obligations and rights requests | Compliance with a specific applicable legal obligation, where one exists. |
| Optional product analytics | Basis not confirmed. Default-on collection with an opt-out is not consent. The final approach requires a GDPR and device-storage/access assessment and any necessary changes to collection controls. |
| Crash diagnostics and optional diagnostic logs | Basis requires assessment of necessity, proportionality and device access; consent must be obtained if required. |
| Marketing notifications | Separate opt-in controls exist and marketing is off by default. The applicable legal basis and the adequacy of the consent/withdrawal mechanism require confirmation. |
Controls, cookies and device storage
Product analytics is currently enabled by default. You can disable it under Privacy & Security in the app. The app’s opt-out flow stops collection, clears queued events and local analytics identifiers and requests backend deletion; re-enabling starts a new identifier. Supported production devices use App Attest verification; failed or unavailable verification disables analytics rather than using an insecure fallback.
Monthly/goal notification preferences are enabled by default, while marketing is disabled until enabled separately. Push registration requires an appropriate system authorization state. You can manage notifications in Aureo and system settings. Permission to display notifications is distinct from a legal basis for every use of notification-related data.
The native app uses tokens and local device storage; browser dashboards use cookies and browser storage for access and request protection. Static legal pages do not add an analytics tracker in their page source. These differences and browser controls are explained in the Cookie Policy.
Recipients, infrastructure and transfers
The checked-in implementation uses Supabase for authentication, database and private file storage; Vercel for backend hosting; Google Firebase Crashlytics for production diagnostics; and Apple APNs for push delivery. Authentication may involve the sign-in provider you choose. Authorized operators and support personnel process data for the relevant operational purposes; company users access the company information described above.
Repository documentation describes Ireland (EU West) for core Supabase and Vercel infrastructure. This is a stated configuration, not a verification of all current production processing locations. Provider support, subprocessors, diagnostics and delivery may involve processing outside the EEA. Actual destinations, contracts and applicable safeguards, such as adequacy decisions or standard contractual clauses where appropriate, require verification and completion in the final notice.
Retention and deletion
Core account information is generally needed while providing the account service. The checked-in retention configuration targets 90 days for accepted analytics events, 30 days for optional feedback diagnostic logs and deletion of resolved/closed feedback reports 24 months after resolution. These periods describe configured or intended cleanup; this draft does not verify deployed jobs or guarantee that each scheduled run succeeds. Notification expiry limits delivery eligibility and is not a stated deletion period. Separate retention for security records, provider diagnostics, backups and unresolved support reports requires confirmation.
Account deletion removes account-linked financial/profile data, feedback, notification data, the private profile photo and authentication identity through the implemented deletion flow. Employer roster records and organization invitation credentials can remain with the app-account association removed, and company reports can remain. Provider copies/backups and any records retained under applicable obligations require separate assessment. Complete deletion of installation-linked guest analytics still requires verification; this draft does not promise immediate erasure of every copy.
Your rights and requests
Where applicable under the GDPR, you can request access, rectification, erasure, restriction, portability and objection to processing, and withdraw consent where processing relies on it. Withdrawal does not affect the lawfulness of earlier processing. Rights have legal conditions and exceptions. We normally respond to rights requests within one month; where a lawful extension is needed, we will explain it within that period. Contact support@aureoapp.com; proportionate identity verification may be needed.
The app offers account export and deletion. The built-in export includes account records and an optional profile photo but excludes security-sensitive values such as raw APNs tokens and some integrity identifiers; employer roster and company-code records are outside that export. You can request access to other personal information through the contact above. For information controlled by your employer, its own privacy contact may also be relevant.
You may lodge a complaint with a competent data protection authority, including Italy’s Garante per la protezione dei dati personali.
Updates
We will revise this draft when the outstanding facts and legal assessment are completed. Changes to processing and to this notice should be communicated through appropriate service channels.