Privacy policy

Version: 27 September 2026 · applies to aurexus.io

This policy describes what data we process when running aurexus.io. It distinguishes two cases, because the legal position differs: we process your own account data as the controller. Data we process for you — from your Meta ad accounts, your lead forms, your online store and your Creative Center — we process as a processor on your instructions. Our Data Processing Agreement applies to it.

1. Controller

A representative in the Union under Art. 27 GDPR is being appointed and will be named here and in the legal notice.

2. Your account with us

Here we are the controller. We process:

• Registration: email address, name, your password only as a hash (bcrypt), time zone and language, and the version of the Terms of Service you accepted, with a timestamp.
• Sign-in: sign-in codes we send by email. We store them only as a check value, never in plain text. For your last ten sign-ins we store the IP address, the time and a short device description (such as “Chrome on macOS”), so you and your account owner can spot unfamiliar sign-ins. We do not derive a location from it.
• Team: if the account owner invites members, we process their email address, name, role and permissions.
• Support: your requests including your email address and our replies. An AI assistant may suggest replies; it receives your message, your first name, your language and your plan, but no data from your ad accounts.
• Payment and invoices: billing address, any VAT identification number, booked services, amounts, payment times and a customer ID of our payment provider. We never see your card details — you enter them directly with Stripe.
• Logs: changes you or your team trigger in ad accounts (who, what, when, prior state), and interventions by our administrators (action, time, affected account).
• Server logs: when you open our pages, the server processes the IP address, time and requested address. These entries sit in the server's system log and are overwritten automatically once the space reserved for it is full.

3. Data we process on your behalf

You are the controller for this data. We process it only to provide the features you have booked.

3.1 Meta ad accounts

• An access token from the official Facebook Login. It is stored encrypted in the database (Fernet/AES) and never passed to third parties.
• Your Facebook user ID and the name stored there, to identify the connection
• Ad accounts: ID, name, currency, time zone, status, portfolio
• Campaign structure: campaigns, ad sets and ads with names, budgets, status, settings and ad content
• Daily metrics: spend, impressions, reach, clicks, conversions, revenue and the values derived from them

We do not read messages, friend lists or private profile data. Access is limited to the permissions you grant one by one in the login dialog.

3.2 Leads from Meta forms (Lead Center)

• Name, email address, phone number and every answer a person entered in your lead form
• Origin: campaign, ad set, ad, form, platform (Facebook or Instagram) and time
• Who in your team may see which forms

You can download leads as a file. If you set up a CRM forwarding, we send new leads to the address you enter; you are responsible for that destination. The AI Copilot receives no names, email addresses or phone numbers of leads, only figures and structure.

3.3 Online store (e-commerce, beta)

If you connect a Shopify or WooCommerce store, we use the access you set up for us to fetch orders read-only — every five minutes, and once a night for the last 30 days. For each order we store:

• Order ID and order number, order and update time
• Order total, refunded amounts and currency, flags for cancellation and test orders
• The UTM parameters of the store visit in which the purchase was made, and the campaign, ad set and ad derived from them

We do not store names, email addresses, postal addresses or payment details of your store's customers. WooCommerce includes such details in its response; we do not read or keep them. Your store credentials are stored encrypted. If you disconnect the store, we delete all of its order data immediately.

3.4 Creative Center

We store images you upload (such as product photos), the generated creatives and your descriptions. To generate a creative, we send your description and the reference images you select to our image provider (section 4); we make reference images available to it through an address that is valid for 15 minutes. Do not upload images showing identifiable people unless you have a legal basis for passing them on.

4. AI providers

Copilot and support assistant. Your question and the information needed to answer it (campaign names, budgets, metrics; for the support assistant, the items listed in section 2) go to one of the following providers — no access tokens, no lead contact details:

• Anthropic PBC, 548 Market St, San Francisco, CA 94104, USA
• OpenRouter, Inc., 353 Sacramento St, San Francisco, CA 94111, USA — routing layer, depending on the model used. If the Copilot searches the web, OpenRouter passes the search terms to a search service.
• Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA — provider of the Gemini models to which OpenRouter currently routes our requests

These providers process data in the USA on the basis of EU Standard Contractual Clauses under Art. 46(2)(c) GDPR. Your Copilot conversations stay stored in your account until you delete them.

Image generation. Creatives in the Creative Center are generated by PoYo AI (poyo.ai, contact: support@poyo.ai). The provider does not publish a company address or registered seat, so we cannot guarantee where the processing takes place. Only your description and the reference images you select for a creative are sent, and only when you start a generation.

5. Recipients and service providers

• Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland — retrieval of your ad data and leads via the Marketing API, solely with the token you granted
• DigitalOcean, LLC, 105 Edgeview Drive, Suite 425, Broomfield, CO 80021, USA — server operation and backups, data centre in Frankfurt am Main, Germany
• Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, CA 94080, USA — payment processing, invoices, subscriptions and discount codes. We transmit your email address, name, billing address, any VAT identification number and the booked services.
• Plus Five Five, Inc. (“Resend”), 2261 Market Street #5039, San Francisco, CA 94114, USA — sending our emails (confirmations, sign-in codes, invoices, task notifications, support). We transmit your email address and the content of the message.
• The AI providers listed in section 4
• Your store system and your CRM: from Shopify or WooCommerce we only retrieve. We send leads to your CRM only if you set up the forwarding yourself.

6. Affiliate program

If you apply as an affiliate, we process as the controller the details from your application (channels, reach, niche, country, message, formats, legal form, company, VAT identification number, small-business status), your commitments including the accepted version of the Affiliate Terms, and your code and its ID at Stripe. The purpose is deciding on your admission and settling your commissions (Art. 6(1)(b) GDPR).

Referral links set no cookie and store nothing on the device. The code is only in the address. We count a visit as a daily number, without IP address and without device data. If someone creates an account through a link or code, we note on that account which affiliate referred it. Affiliates see only numbers (visits, registrations, paying customers), never names or addresses.

7. Cookies, browser storage and audience measurement

Strictly necessary (§ 25(2) TDDDG, the German telecommunications data protection act): a cookie holding your choice on audience measurement, and entries in your browser's storage for your sign-in, your language and view settings. If you allow notifications, your browser creates them itself; no third party is involved.

Audience measurement on our public pages, to understand which ad led to a sign-up:

• Meta Pixel — Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland
• TikTok Pixel — TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London EC1A 9HP, United Kingdom
• Google tag — Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
• OpenAI Pixel (ChatGPT Ads) — OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Sets the cookies __oppref (30 days) and __obref (365 days); also processed by the US parent company under the Standard Contractual Clauses (Art. 46(2)(c) GDPR).

These tools set cookies and transmit, among other things, your IP address, pages visited and events triggered (such as a registration). The providers may combine this with an account you hold with them. We load them only after you have consented (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can change or withdraw your choice at any time: Cookie settings.

Additionally server-side (Conversions API): If you have consented, we also report your sign-up and purchases (every credit purchase and every subscription start or resumption, each with amount and currency) directly from our server to the same recipients as the pixels: Meta Platforms Ireland and OpenAI Ireland. We transmit your email address only as a SHA-256 hash (never in plain text), your IP address, your browser identifier (user agent), the values of the cookies _fbp and _fbc (Meta) or __oppref and __obref (OpenAI), and the page address without parameters. This way a report is not lost when an ad blocker stops the pixel. What counts is your choice at registration or when you start a purchase; without consent, no such report is sent. For purchases we store these details with our payment provider Stripe when you start a purchase, because we only report once the payment is confirmed. Renewals of a subscription are not reported.

Status of this version: the Meta Pixel and the OpenAI Pixel are active, both also server-side, and so is the Google tag (Google Analytics, browser only). TikTok is prepared but not active; no data is sent to TikTok.

8. Legal bases

• Art. 6(1)(b) GDPR (contract): account, sign-in, team, support, payment, affiliate program and the booked features
• Art. 6(1)(f) GDPR (legitimate interest): operational security, abuse prevention, sign-in, change and server logs, backups
• Art. 6(1)(a) GDPR (consent): audience measurement (section 7)
• Art. 6(1)(c) GDPR (legal obligation): retention of invoices
• Art. 28 GDPR: processing on your behalf (section 3) under our Data Processing Agreement, which is part of the Terms of Service

9. Transfers to third countries

Aurex Global LLC is based in the United States and is therefore itself a recipient in a third country. The basis is the contract concluded with you (Art. 6(1)(b) GDPR), supplemented for processing on your behalf by the Standard Contractual Clauses in the Data Processing Agreement. The data is stored on servers in a data centre in Frankfurt am Main, Germany. EU Standard Contractual Clauses are in place for the US providers in sections 4 and 5; for the image provider, see section 4.

10. Retention and deletion

• Disconnecting Meta (Settings → Connections): the access token is deleted immediately. Ad accounts, metrics and leads stay in your account until you request their deletion or have your account deleted.
• Deletion via Facebook: if you remove the app in your Facebook settings and request deletion, we automatically delete the connection, token, ad account data, leads, CRM deliveries, Copilot conversations and store orders of the affected ad accounts. You receive a confirmation page.
• Disconnecting a store: all order data of that store is deleted immediately.
• Creatives and Copilot conversations remain until you delete them.
• Sign-in log: only the last ten sign-ins; older ones drop out automatically.
• Backups: daily, kept for 14 days on the server in the data centre in Frankfurt am Main, Germany, then deleted automatically.
• Your account: we carry out full deletion within 30 days of your request to support@aurex.llc. Invoices are kept for ten years (§ 147 AO, the German Fiscal Code); deleted data disappears from backups after 14 days.

11. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR). An email to support@aurex.llc is enough. If your request concerns data we process on behalf of a customer (for example as a lead), we forward it to that customer.

12. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement.

13. Changes

We update this policy when our processing changes. The version published here is authoritative.