Privacy Policy

We use personal information to:

• Operate, maintain, and secure the Platform and its features.
• Process virtual-currency purchases, route gifts, calculate creator earnings, run cashouts, and issue tax documents where required.
• Authenticate users, prevent duplicate accounts, and fight fraud, chargeback abuse, self-gifting, bot-driven viewing, and payout manipulation.
• Moderate content, investigate reports, enforce our Terms of Service and Community Guidelines, and cooperate with law enforcement when we are legally required to do so.
• Personalize what you see (feed ranking, stream discovery, recommendations) based on your interactions and preferences.
• Communicate with you about the Platform — transactional emails, push notifications, service announcements, and, with your consent, marketing messages.
• Measure and improve the Platform, including developing new features, debugging, and running A/B experiments.
• Comply with legal and regulatory obligations (tax, AML, child safety, subpoenas, court orders, payment-network rules) and enforce our agreements.

If you are in the European Economic Area, the United Kingdom, or Switzerland, the legal bases on which we rely to process your personal information include:

• Performance of a contract — to deliver the Platform features you ask for, process your purchases, and pay out your earnings.
• Legitimate interests — running a secure, fraud-resistant service, measuring performance, and preventing abuse. We balance these interests against your rights.
• Consent — for marketing communications, some analytics cookies, and any feature that requires it (for example, precise location, camera/microphone access).
• Legal obligation — for tax, AML, law-enforcement response, and child-safety reporting.

Aura is headquartered in the United States and our primary production database runs in Tokyo. When you use the Platform, your personal information may be transferred to and processed in the United States, Japan, or any country where our service providers operate. Where the law requires, we rely on transfer mechanisms such as the European Commission's Standard Contractual Clauses (and the UK addendum), supplemented by technical and organizational safeguards.

We keep personal information only as long as it is needed for the purposes described above, after which we delete or de-identify it. Our default retention periods are:

• Account profile and login data: for as long as your account is active, plus up to 30 days after deletion to complete wind-down (longer if needed for safety holds or legal claims).
• Direct messages: until you or the other participant deletes them, or up to 30 days after account deletion.
• Livestream recordings: up to 90 days, unless retained longer for safety investigations.
• Virtual-currency transactions, payouts, and tax records: at least 7 years to comply with tax and financial-record laws.
• Creator verification documents: retained as long as required by AML and tax regulations, typically 7 years.
• Moderation and abuse records: retained as long as necessary to enforce Terms violations and prevent re-registration of banned users, typically 3 years.
• Crash logs and technical logs: 30–90 days.

Some data may be retained for longer in a legal hold, in backup media that roll off on a schedule, or in aggregated, de-identified form that cannot reasonably be linked back to you.

You have the following rights, subject to local law. Some rights (such as deletion) can be exercised directly in-app; others are handled through written request.

• Access and portability — request a copy of the personal information we hold about you.
• Correction — update information that is inaccurate or incomplete.
• Deletion — ask us to delete your personal information (subject to legal-retention obligations).
• Objection and restriction — object to certain processing (for example, direct marketing) or ask us to restrict processing while we investigate a request.
• Withdrawal of consent — where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Complaint — you can lodge a complaint with your local data-protection authority.

To exercise a right, email privacy@auralive.tv from the address on your account. For account deletion you can also use the in-app “Delete account” flow.

The Platform is only for people 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn that a user is under 18, we will disable the account and delete their information. If you believe a minor has created an account, please report it to safety@auralive.tv.

We use encryption in transit (HTTPS/TLS) and at rest for our primary database and storage. Access to personal information by Aura staff is limited to employees who need it for their role and is audited. Despite these measures, no system is perfectly secure. If we become aware of a security incident that materially affects your information, we will notify affected users and authorities as required by law.

The Platform may contain links to third-party websites and services (for example, external profiles a creator chooses to link, app-store listings, payment processors' pages). Those sites have their own privacy practices and we are not responsible for them. We encourage you to review the privacy policies of any third-party service you use.

We will update this Policy from time to time. The “Last updated” date at the top reflects the current version. If we make material changes, we will notify you in-app, by email, or through a prominent notice before the changes take effect. Your continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

For questions about this Policy or to exercise a privacy right, contact privacy@auralive.tv. For safety or child-protection reports, contact safety@auralive.tv. For legal notices and service of process, contact legal@auralive.tv.