Status: DRAFT — FOR LEGAL REVIEW
Version: 0.2
Date: 2026-10-18
Owner: Data Protection Officer (to be appointed)
Jurisdiction: Canada (operating company); EU users served under the DSA and GDPR; market neutral
Applicable law: Personal Information Protection and Electronic Documents Act (PIPEDA); for EU users, Regulation (EU) 2016/679 (GDPR) and Directive 2002/58/EC (ePrivacy)
Reviewed by counsel: [pending]
Next review: Prior to platform launch, then annually
This document is a draft prepared for review by qualified Canadian and EU legal counsel. It is intended to become the public-facing privacy notice Aurora serves under PIPEDA and, for EU users, GDPR Articles 13 and 14. All procedures and disclosures are subject to revision based on legal advice and the final structure of [Registered company name].
1. Who We Are (Controller Identity)
The controller of your personal data is:
[Registered company name]
[Registered address]
[Province], Canada
Business number: [Business number]
Tax registration number: [to be filled in]
Data Protection Officer (DPO):
[Name of DPO — to be appointed]
Email: [email protected] (stub — to be provisioned before launch)
Postal: Attn. DPO, [Registered company name], [Registered address], [Province], Canada
Aurora is established in Canada. For users in the European Union, Aurora will appoint a representative in the EU under GDPR Art. 27, which may be the same entity as Aurora's EU legal representative under DSA Art. 13: [to be appointed].
Aurora operates auroramembers.com and associated subdomains (the "Platform").
2. Scope
This Privacy Policy applies to personal data Aurora processes about:
- Providers — independent adult companions using the Platform to publish their profile (their advertisement), screen members, and communicate with them.
- Members (also called clients) — adults using the Platform to browse providers, send messages where the feature is available, and keep a screening profile.
- Agency managers and provider-delegates (Phase 2+).
- Visitors — unauthenticated users browsing public pages.
- Aurora staff and contractors — in the context of employment / engagement data. A separate employee privacy notice covers the full HR scope; this policy covers only staff data insofar as it overlaps with Platform operations.
- Third parties whose data is incidentally processed (e.g., individuals named in user reports, law-enforcement contacts).
Messaging on Aurora is end-to-end encrypted (E2EE). Aurora stores only ciphertext for message content; plaintext message bodies are not personal data we process as controller (we process the associated metadata only — see Section 4).
3. Data We Collect — By User Type
All fields marked PII correspond to the @pii-tagged columns in our data inventory (docs/data-inventory.md) and are encrypted at rest with per-tenant envelope keys.
3.1 Providers
| Category | Examples | Source |
|---|---|---|
| Identity and contact (PII) | Full legal name, date of birth, nationality, email, mobile number, postal country | Directly from user at signup; from Didit during KYC |
| Identification documents (special category — Art. 9) | Passport/ID scan, liveness video, biometric face template | Didit (processor) — retained by Didit for 1 month; Aurora keeps only the decision, date and a hash of the document number |
| KYC verification results | Pass/fail, method, date, document type, issuing country, expiry, one-way hash of document number | Didit (processor) |
| Profile content | Display name, bio, languages, services offered, rates, tour schedule, photos, videos | Directly from user |
| Location (PII) | City, working area, coarse geocoordinates (H3 cell resolution ≥ 8) | Directly from user |
| Communications metadata | Message thread IDs, timestamps, participants, delivery status (NOT content) | Platform usage |
| Screening and member notes | Private notes the provider keeps on members they've met | Directly from user |
| Shared blocklist entries (opt-in) | Reports of members flagged by the provider | Directly from user |
| Billing data (PII) | Billing country; Bitcoin invoice and payment reference for listing-plan purchases | Directly from user / Aurora's own payment server |
| Transaction records | Listing-plan invoices and payment confirmations (prepaid 30-day periods; nothing renews) | Aurora's own payment server (BTCPay Server) |
| Device and log data | IP at registration, user-agent, approximate geolocation, session timestamps | Automatic |
| Trust & safety signals | Moderation events, report history, automated classifier outputs | Platform operations |
3.2 Members
| Category | Examples | Source |
|---|---|---|
| Identity and contact (PII) | Pseudonymous display name, email, mobile number, date of birth (for age verification) | Directly from user |
| Identification documents (special category — Art. 9) (Gold tier only) | Gov ID + liveness video + biometric template | Didit (processor) — retained by Didit for 1 month; Aurora keeps only the decision, date and a hash of the document number |
| Screening submissions | References, employer-verification data, screening form responses (shared per-provider with consent) | Directly from user |
| Communications metadata | Thread IDs, timestamps, participants (NOT E2EE content) | Platform usage |
| Plan records | Plan tier, prepaid period start and end dates | Platform usage |
| Payment data (PII) | Billing country; Bitcoin invoice and payment reference (transaction identifier or Lightning payment hash) | Aurora's own payment server (BTCPay Server) |
| Device and log data | IP at registration and session, user-agent, approximate geolocation | Automatic |
| Trust & safety signals | Trust score inputs, moderation events, reports | Platform operations |
3.3 Staff and Contractors (Platform-adjacent only)
| Category | Examples |
|---|---|
| Identification | Name, role, criminal record check outcome |
| Access data | SSO identifiers, access logs to admin tooling, moderation queue actions |
| Training records | AML and moderation training completion |
A separate HR privacy notice covers full employment data.
4. Purposes and Legal Bases (GDPR Art. 6 and Art. 9)
We only process personal data where we have a lawful basis under GDPR Art. 6, and for special category data under an additional condition in Art. 9(2).
| # | Purpose | Data categories | Art. 6 basis | Art. 9 basis (where applicable) |
|---|---|---|---|---|
| 1 | Account creation and authentication | Identity, contact, device | Art. 6(1)(b) — contract | — |
| 2 | Identity verification and age verification (KYC) | ID documents, liveness, biometric template | Art. 6(1)(b) — contract; Art. 6(1)(c) — legal obligation (age-verification law where applicable); Art. 6(1)(f) — legitimate interest in keeping minors and impersonators off the Platform | Art. 9(2)(a) — explicit consent to the biometric liveness check; Art. 9(2)(g) — substantial public interest (protection of minors), basis to be confirmed by counsel |
| 3 | Operating the Platform (profiles, search, availability, messaging metadata, screening profiles) | Profile content, metadata, device | Art. 6(1)(b) — contract | — |
| 4 | Receiving payment for listing and member plans | Billing data, transaction records | Art. 6(1)(b) — contract; Art. 6(1)(c) — legal obligation (bookkeeping and tax law) | — |
| 5 | Fraud prevention, AML monitoring, sanctions and PEP screening | Identity, transaction, device, screening results | Art. 6(1)(c) — legal obligation (sanctions law); Art. 6(1)(f) — legitimate interest | Art. 9(2)(g) — substantial public interest |
| 6 | Content moderation and Trust & Safety (DSA Art. 14–24 obligations) | Profile content, reports, classifier outputs, moderation events | Art. 6(1)(c) — legal obligation (DSA); Art. 6(1)(f) — legitimate interest in a safe platform | Art. 9(2)(g) where special-category data is incidentally involved in reports |
| 7 | CSAM detection (PhotoDNA hash-matching on all media uploads) | Media content, perceptual hashes | Art. 6(1)(c) — legal obligation; Art. 6(1)(f) — vital interests of children | Art. 9(2)(g) — substantial public interest (child protection) |
| 8 | Communicating service notices and policy changes | Contact data | Art. 6(1)(b) — contract; Art. 6(1)(c) — legal obligation | — |
| 9 | Marketing communications about Aurora's own services to existing users | Contact data, usage profile | Art. 6(1)(f) — legitimate interest, with opt-out (ePrivacy and applicable anti-spam law) | — |
| 10 | Analytics for product improvement (aggregated, first-party only) | Device, usage | Art. 6(1)(a) — consent (ePrivacy cookie consent for any non-strictly-necessary cookie) | — |
| 11 | Defending legal claims, responding to law-enforcement requests | Any relevant category | Art. 6(1)(c) — legal obligation; Art. 6(1)(f) — legitimate interest; Art. 9(2)(f) — establishment, exercise, or defence of legal claims | Art. 9(2)(f) |
| 12 | Cooperating with regulatory authorities (the Office of the Privacy Commissioner of Canada, EU supervisory authorities, Digital Services Coordinators) | Any relevant category | Art. 6(1)(c) | Art. 9(2)(g) |
4.1 Special Category Data (Art. 9)
Aurora processes the following special category data:
- Biometric data — face templates generated during Didit liveness checks. Used only to confirm the document holder is a live person matching the document. Didit (Didit Identity Spain S.L., Barcelona) is the processor; Aurora receives only the verification outcome. Didit retains the template for 1 month under the DPA with Aurora, then deletes it.
- ID documents — passports, national IDs, driver's licenses are scanned for KYC. Raw images are never held by Aurora; Didit retains them for 1 month under the DPA, then deletes them. Aurora stores only the decision, the date and a one-way hash of the document number.
Aurora does not process data about health, sexual orientation, political opinions, religious beliefs, trade-union membership, or genetic data as an intended category. Profile content may incidentally reveal such information because the Platform serves the adult services sector; Aurora relies on Art. 9(2)(e) (data manifestly made public by the data subject) where a provider chooses to include such information in their public profile, and on explicit consent (Art. 9(2)(a)) where we surface it elsewhere in the product.
5. Retention
Retention is the minimum necessary for the purpose. Where multiple legal bases apply, the longest applicable period governs.
| Data category | Retention period | Legal basis |
|---|---|---|
| Account identity and contact data | Duration of the account + 30 days post-deletion | Art. 6(1)(b) contract; overrides below |
| KYC verification results (decision, date, document hash) | 5 years after end of business relationship | Art. 6(1)(c) / (f) — record-keeping and preventing banned users from re-registering; period to be confirmed by counsel |
| Raw KYC documents (ID images) | Never held by Aurora; retained by Didit for 1 month under the DPA | GDPR data minimization (Art. 5(1)(c)) |
| Biometric liveness template | Not retained by Aurora; retained by Didit for 1 month under the DPA | Art. 5(1)(c) / processor contract |
| Transaction records (plan invoices and payment confirmations) | 7 years | Canadian tax record-keeping obligations (period to be confirmed by counsel) |
| Sanctions / PEP screening results | 5 years after end of business relationship | Record-keeping obligation (period to be confirmed by counsel) |
| Message metadata (thread IDs, timestamps) | Duration of account + 90 days | Art. 6(1)(f) platform operation |
| Message ciphertext (E2EE) | Until user deletes thread, or auto-expiry per user settings | Art. 6(1)(b) |
| Profile content (photos, bios) | Duration of account; hard-deleted within 30 days of account deletion (CDN cache purged within 7 days) | Art. 6(1)(b) |
Moderation events (moderation_events append-only log) | 5 years | DSA Art. 24 record-keeping obligation; Art. 6(1)(c) |
| DSA notices, decisions, and statements of reasons | 5 years | DSA Art. 24; Art. 6(1)(c) |
| CSAM hash matches and referrals to NCMEC/Cybertip.ca | Indefinite (with restricted access) | Legal obligation + legitimate public interest |
| Device/access logs | 90 days (security logs); 30 days (application logs) | Art. 6(1)(f) security |
| Support tickets | 3 years after closure | Art. 6(1)(f) dispute defense |
| Marketing contact preferences / opt-out record | Until withdrawn + 3 years | Art. 6(1)(c) proof of consent |
Where a user exercises the right to erasure (Art. 17), Aurora honours the request except for data retained under the legal obligations listed above (Art. 17(3)(b)).
6. Recipients and Processors
Aurora shares personal data only where necessary to operate the Platform, comply with law, or defend legal claims. We do not sell personal data.
6.1 Processors (GDPR Art. 28)
All processors are bound by a data processing agreement and are selected for EU data residency where possible.
| Processor | Purpose | Data categories | Location |
|---|---|---|---|
| Didit Identity Spain S.L. (Barcelona, Spain) | KYC, age verification, liveness, biometric matching | ID document images, liveness video, biometric template, name, DOB — retained by Didit for 1 month; Aurora stores only the decision, date and a hash of the document number | EU (Spain) |
| Aurora's own payment server (BTCPay Server, self-hosted) | Receiving Bitcoin payments for listing and member plans; no third-party payment processor is used | Invoice, amount, payment address and payment reference linked to the account | EU (FlokiNET, Finland) |
| Messagebird (NL) | SMS verification, transactional SMS | Mobile number, OTP | EU |
| Postmark EU / Mailgun EU | Transactional and bulk email | Email, message content | EU |
| Bunny.net (Slovenia) | Storage and CDN for media and profile assets | Media content, request metadata | EU (with EU-only pull zone) |
| Meilisearch (self-hosted) | Search index for providers, locations, services | Public profile content | EU (MojoHost / FlokiNET, NL or LU) |
| Sentry EU (Frankfurt) | Error reporting (scrubbed of PII) | Stack traces, request IDs | EU |
| Grafana Cloud EU | Metrics, logs (scrubbed of PII), tracing | Operational telemetry | EU |
| MojoHost / FlokiNET | Origin hosting | All platform data at rest | EU (NL / LU / RO) |
| Cloudflare Enterprise (with adult addendum) | CDN / WAF / DDoS protection | Request metadata, IP | Global edge, EU data localization where offered |
6.2 Other Recipients
- Law enforcement authorities — upon valid legal process (see the Law Enforcement Guidelines).
- Regulators — the Office of the Privacy Commissioner of Canada, EU data protection supervisory authorities, Digital Services Coordinators (via Aurora's EU legal representative under DSA Art. 13: [to be appointed]), tax authorities.
- Trusted flaggers (DSA Art. 22) — only the information necessary to action their notices.
- Professional advisors — external legal counsel, auditors, bound by confidentiality.
- NCMEC / Canadian Centre for Child Protection (Cybertip.ca) — for CSAM referrals (mandatory under Canadian and US federal law).
- Acquirers in the event of a corporate transaction — under confidentiality, users notified per Art. 13/14.
7. International Transfers
Aurora's platform infrastructure is EU-resident. The intention is that user personal data remains within the European Economic Area (EEA). Aurora itself is established in Canada, and its staff access the systems from Canada; Canada benefits from an EU adequacy decision under Art. 45 for commercial organisations subject to PIPEDA (scope to be confirmed by counsel).
Where a transfer to another third country is unavoidable (for example, Cloudflare edge processing outside the EEA, or law-enforcement cooperation with a non-EEA jurisdiction), Aurora relies on:
- An adequacy decision under Art. 45 (where available), or
- Standard Contractual Clauses under Art. 46(2)(c) (Commission Decision (EU) 2021/914), supplemented by technical and organizational measures (encryption in transit and at rest, key management inside the EU), and a transfer impact assessment per the EDPB Recommendations 01/2020.
Aurora does not intentionally transfer personal data to the United States. No processor is selected on a default that entails US processing. A list of current transfers and safeguards is maintained in the data inventory and available on request from the DPO.
8. Your Rights
Under GDPR Articles 15–22 and Article 77, users in the EU have the following rights, regardless of user type (provider, member, staff). Aurora honours the same requests from users elsewhere; users in Canada additionally have the rights of access and correction that PIPEDA gives them.
| Right | Article | What it means on Aurora |
|---|---|---|
| Access | Art. 15 | You can request a copy of the personal data we hold about you, plus metadata about processing. |
| Rectification | Art. 16 | You can correct inaccurate or incomplete data. Most profile fields are editable directly in account settings. |
| Erasure | Art. 17 | You can delete your account. Data retained under legal obligations (AML, DSA, tax, ongoing LE matters) is preserved per Section 5. |
| Restriction | Art. 18 | You can ask us to stop processing while a dispute is resolved. |
| Portability | Art. 20 | You can export your profile data and communications metadata in a machine-readable format (JSON). Self-service export is available in account settings. |
| Objection | Art. 21 | You can object to processing based on legitimate interests (Art. 6(1)(f)) or direct marketing. For direct marketing, objection is absolute. |
| Withdraw consent | Art. 7(3) | Where processing is based on consent (e.g., analytics cookies, optional marketing), you can withdraw it at any time; withdrawal does not affect prior lawful processing. |
| Not be subject to automated decision-making | Art. 22 | See Section 11. |
| Complain to the supervisory authority | Art. 77 | See Section 12. |
8.1 How to Exercise Your Rights
Contact the DPO:
- Email: [email protected]
- Postal: [Registered company name], Attn. DPO, [Registered address], [Province], Canada
- Via the in-platform "Privacy & Data" settings page (planned)
We will respond within 30 days of receiving a verifiable request (Art. 12(3) GDPR), extendable by up to two additional months for complex requests with explanation. There is no fee unless the request is manifestly unfounded or excessive.
To protect your data, we may ask for additional information to verify your identity before acting on a request. We will not use identity-verification data for any other purpose.
9. Cookies and Tracking
Aurora uses cookies and similar technologies. Details — including a per-cookie list — are in the separate Cookie Policy (cookie-policy.md). In summary:
- Strictly necessary cookies (session, CSRF, auth, load-balancer) are set without consent under the ePrivacy Art. 5(3) strictly-necessary exemption.
- Functional cookies (language, theme) may be set on consent.
- Analytics cookies (first-party, aggregated) are set only with consent (ePrivacy Art. 5(3)).
- No advertising cookies are used. Aurora does not run third-party tracking, retargeting, or ad networks.
You can change your cookie preferences at any time via the consent banner or the Cookie Preferences link in the footer.
10. Security
Aurora implements technical and organizational measures appropriate to the risk (Art. 32 GDPR), including:
- Encryption of PII at rest with per-tenant envelope keys (KMS / HashiCorp Vault).
- TLS 1.3 for all data in transit.
- End-to-end encryption of message content (the server holds only ciphertext).
- Signed, short-TTL URLs for all media; no public object storage.
- Least-privilege access controls; admin access gated by SSO + 2FA.
- Append-only moderation audit log.
- Annual penetration testing; continuous bug bounty via Intigriti.
- 72-hour breach notification pipeline per Art. 33.
Full details are in the Aurora Security Policy and the Incident Response Plan (incident-response-plan.md).
11. Profiling and Automated Decision-Making (Art. 22)
Aurora uses automated systems that process personal data. Not all qualify as Art. 22 automated decision-making with legal or similarly significant effect, but we describe them all here for transparency.
| System | What it does | Art. 22 significance | Human review |
|---|---|---|---|
| CSAM hash matching (PhotoDNA) | Blocks uploads matching known CSAM hashes | Legally required; automated blocking is upheld before human review confirms, given the zero-tolerance nature and legal duty | Confirmed positives are reviewed by a human moderator before account termination; the initial block is automated |
| NSFW and trafficking classifiers | Flag content for human review | No — classifier output alone is never the basis for a consequential action | Every flagged item is reviewed by a human |
| Sanctions / PEP screening | Flags account for manual EDD | Yes — can delay or block account activation | Compliance Officer reviews all matches; account holder can dispute |
| Member trust score | Algorithmic score visible to providers (not to other members) to help providers decide whether to engage | Potentially — low scores may reduce a member's chances of a reply | Scores never decide anything automatically; providers make the human decision. Users can request an explanation via the DPO |
| Search ranking / recommender (DSA Art. 27) | Orders search results and featured listings | No — informational surfacing, not a decision about the user | — |
Your rights under Art. 22 where automated decision-making has legal or similarly significant effect on you: you can request human intervention, express your point of view, and contest the decision. Contact the DPO.
Main parameters of the recommender system (DSA Art. 27) are described in the Terms of Service and in a dedicated "How ranking works" disclosure page.
12. Complaints
If you believe Aurora is not handling your data properly, we want to hear about it first so we can try to resolve the issue:
- Contact the DPO at [email protected].
You also have the right to lodge a complaint with a supervisory authority:
- Users in Canada: the Office of the Privacy Commissioner of Canada, and any provincial privacy regulator with jurisdiction once [Province] is set.
- Users in the European Union: the data protection supervisory authority of your habitual residence, place of work or the place of the alleged infringement (GDPR Art. 77). Aurora's EU representative ([to be appointed]) is the point of contact for EU supervisory authorities.
- Users elsewhere: the data protection authority of your country of residence, where one exists.
13. Children
Aurora is not intended for anyone under the age of 18 (or 21 where required by the applicable jurisdiction, e.g., certain US states in Phase 4+). We do not knowingly collect personal data from minors.
Age is verified at signup:
- Providers: gov ID + liveness via Didit (hard gate).
- Members (Member and Gold tiers): age verification via Didit or age attestation, plus DOB confirmation and, in the UK, age verification under the Online Safety Act 2023 via an approved provider (Yoti / AgeChecked).
If we learn that we have inadvertently collected personal data from a person under the minimum age, we will delete it without delay and terminate the account, and — where CSAM or child safety concerns arise — report to the relevant authorities.
14. Changes to This Policy
Aurora may update this policy to reflect changes in law, product, or processing. When we make material changes, we will:
- Post the updated policy on the Platform.
- Notify registered users by email and in-platform banner at least 30 days before the change takes effect (unless a shorter period is required by law).
- Keep previous versions archived and accessible for at least 5 years.
The "Version" and "Date" fields at the top of this policy indicate the current revision.
15. Cross-References
- Cookie Policy (
cookie-policy.md) - Acceptable Use Policy (
acceptable-use-policy.md) - Content Moderation Policy (
content-moderation-policy.md) - AML/KYC Policy (
aml-kyc-policy.md) - Law Enforcement Guidelines (
law-enforcement-guidelines.md) - DSA Notice and Action Procedure (
dsa-notice-action.md) - DMCA / EU Copyright Takedown Procedure (
dmca-copyright.md) - Incident Response Plan (
incident-response-plan.md) - Transparency Report (
transparency-report-template.md, published quarterly)
DRAFT — FOR LEGAL REVIEW. This privacy policy must be reviewed and approved by qualified Canadian and EU counsel with PIPEDA, GDPR and DSA expertise before publication. Placeholder fields (DPO name, email stubs, business number, registered address, province, EU representative) must be populated post-incorporation.