Data Processing Agreement

DPA — Last updated: April 24, 2026

1. Parties & Scope

This Data Processing Agreement ("DPA") is entered into between Aurora AI Solutions Studio UG (haftungsbeschränkt), a German company ("Aurora," "Controller," "we"), and our users and customers ("Data Subjects," "you"). It governs how Aurora processes personal data in the course of providing its products in compliance with the EU General Data Protection Regulation (GDPR/DSGVO), the German Federal Data Protection Act (BDSG), and applicable national data protection laws.

This DPA is supplementary to and should be read in conjunction with our Privacy Policy and Terms of Service. It becomes effective the moment you accept the Terms of Service of the relevant Aurora product and remains in force for the duration of the service relationship.

2. Products Covered

This DPA applies to all Aurora products. Because each product has a different processing footprint (different sub-processors, data categories, and retention rules), product-specific details are consolidated under Section 4 below. General obligations that apply across all products live in Sections 5–13.

• ContentPulse — AI content repurposing studio. contentpulse.helloaurora.ai
• ClientPulse — client relationship signal platform. (in development)

3. Definitions

For the purposes of this DPA, the following terms shall have the meanings set forth below:

• Controller: Aurora AI Solutions Studio UG, the entity that determines the purposes and means of personal data processing.
• Processor (Sub-Processor): Any entity that processes personal data on behalf of the Controller (e.g., Supabase, Anthropic, Vercel, Sentry, Inngest, Deepgram, AssemblyAI, Stripe).
• Data Subject: Any individual to whom personal data relates — including Aurora users, and individuals whose data is processed through an Aurora product (e.g., audience members, meeting participants, customer contacts).
• Personal Data: Any information relating to an identified or identifiable natural person, including but not limited to name, email, IP address, content data, usage logs, and metadata.
• Processing: Any operation performed on personal data — collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, transmission, erasure, or destruction.
• Special Categories of Data: Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data for identification, health data, or data concerning sex life or sexual orientation.

4. Product-Specific Processing

5. International Data Transfers

Transfer mechanisms.

• EU-to-US transfers: Personal data transferred to sub-processors located in the United States are governed by Standard Contractual Clauses (SCCs) as approved by the European Commission, and — where the sub-processor participates — the EU-US Data Privacy Framework (DPF).
• EU data residency: User account data, generated content, and backups for ContentPulse and ClientPulse are stored in Supabase's EU Frankfurt region and served from Vercel's Frankfurt compute region, ensuring data remains within the European Economic Area where possible.
• The Controller has conducted Transfer Impact Assessments (TIAs) and Data Protection Impact Assessments (DPIAs) for international transfers and maintains appropriate safeguards as required by Art. 46 GDPR.

Supplementary safeguards.

• Encryption of data in transit (TLS) and at rest.
• Contractual obligations on sub-processors to maintain GDPR-equivalent protections.
• Regular audit and compliance assessments of sub-processors.
• Ability to request data return or deletion upon contract termination.

6. Security Measures

The Controller implements technical and organisational measures appropriate to the risk, including:

• Encryption: TLS/HTTPS in transit; industry-standard encryption at rest.
• Access controls: role-based access (RBAC), principle of least privilege, multi-factor authentication for administrative access.
• Row-Level Security (RLS): database-level access policies so users can only access their own data.
• Authentication: bcrypt-hashed passwords via Supabase Auth, session management, optional 2FA.
• Audit logging: access to sensitive data is logged and retained for security and compliance purposes.
• Vulnerability management: regular security audits, dependency scanning, timely patching.
• Backups: encrypted backups performed regularly.
• Personnel: all persons handling personal data receive data-protection and security training.

While we implement industry-standard security measures, no system is entirely secure. The Controller cannot guarantee absolute security and is not liable for unauthorised third-party access resulting from causes beyond its reasonable control.

7. Data Subject Rights

The Controller shall provide reasonable assistance to Data Subjects in exercising their rights under the GDPR:

• Right to access (Art. 15): we will provide a copy of your personal data in a portable, machine-readable format within 30 days.
• Right to rectification (Art. 16): correct inaccurate data via the product dashboard or by contacting support.
• Right to erasure (Art. 17): we will delete account data within 30 days, subject to legal retention obligations (e.g. 7-year HGB retention for billing records).
• Right to restrict processing (Art. 18): request suspension of processing pending resolution of a dispute.
• Right to data portability (Art. 20): receive your data in a structured, commonly-used, machine-readable format (CSV, JSON).
• Right to object (Art. 21): object to processing for direct marketing or other non-essential purposes.
• Right to lodge a complaint: you may complain to your local data-protection authority — see §12.

To exercise any of these rights, contact privacy@helloaurora.ai. We will respond within 30 days or as required by law.

8. Data-Breach Notification

• The Controller will notify affected Data Subjects without undue delay and no later than 72 hours after becoming aware of a personal-data breach, as required by Art. 33 GDPR.
• Notifications include details of the breach, likely consequences, and measures taken to mitigate harm.
• Relevant supervisory authorities will be notified as required by law.
• Sub-processors are contractually required to notify the Controller within 24 hours of discovering a breach affecting personal data.

9. Audit Rights

• Supervisory authorities may audit the Controller's data-processing activities as part of their statutory duties.
• The Controller periodically audits sub-processors to ensure compliance with data-protection obligations, and may request evidence of compliance from sub-processors.
• Data Subjects may request information about how their data is being processed by writing to privacy@helloaurora.ai.

10. Term & Termination

• This DPA is effective on acceptance of the relevant product Terms of Service and remains in effect for the duration of the service relationship.
• On account deletion or service termination, the Controller shall cease processing personal data, except where legally required to retain.
• The Controller will delete or return personal data within 60 days of termination at the Data Subject's request, unless longer retention is legally required.
• Sub-processors will be instructed to delete or securely destroy personal data per the Controller's instructions.
• Obligations related to data security, breach notification, and legal compliance survive termination.

11. Amendments

The Controller may amend this DPA to reflect changes in data-protection law, business practice, or sub-processors. Material changes (e.g. addition of a sub-processor, change of region) will be communicated with at least 30 days' prior notice. Users may object to a change by writing to privacy@helloaurora.ai within 14 days of notification.

12. Right to Lodge a Complaint

You may lodge a complaint with a supervisory authority. The competent authority for Aurora is:

13. Governing Law

This DPA is governed by the laws of the Federal Republic of Germany and the GDPR (EU) 2016/679. Disputes concerning data processing or data-subject rights are subject to German law and the jurisdiction of German courts. Data Subjects may also lodge complaints with the supervisory authority in their own jurisdiction.