Privacy Policy
Effective 13 October 2026. This policy explains what Aurora Prestige Limited collects when you use Aurora Prestige, why, how long we keep it, and the choices you have. We keep it short and specific on purpose.
We never hold your card, bank or identity numbers. Card numbers, bank account details, dates of birth and Social Security numbers are collected by Stripe inside the app and stored only by Stripe. Aurora Prestige never receives, sees or stores them. We keep a Stripe reference, whether a payment worked, the amount, and the card's brand and last four digits for your receipt.
What we collect. Account details: your name, email, phone number and password (stored hashed), or the profile Apple, Google or Facebook shares with us when you sign in that way. Chauffeur details: company name, licence, insurance, registration and permit documents, vehicle type, model, colour, plate and photos. Ride details: pickup and drop-off addresses, times, vehicle class, passenger count, special requests, fare, payment status, whether the pickup PIN was used, and the GPS trail of the journey. For airport rides: the flight number, date, airports and times, never a booking code or ticket number. Tables Aurora books for you: the restaurant, party size, time and the name the table is under. Your chats with Aurora and what she remembers about you (see below). Trusted contacts you add: their name and email or mobile number. If you join the waitlist for your area: that area, rounded to about a kilometre. Ratings and reviews. Messages between a client and chauffeur. Reports you make or that are made about you, with any photos attached. Device details needed to run the app, and a notification token if you allow phone notifications.
Location. If you allow it, we use your device location to show you on the map, suggest a pickup point and estimate journey time. During a ride we record the chauffeur's GPS trail as part of the ride record; outside a ride a chauffeur's live position is stored only while they are online with sharing on, and switching it off deletes the last stored position. A client can share a live trip link with anyone; that link stops working shortly after the ride ends.
Why we use it. To create and secure your account, to connect clients with the chauffeurs they add, to run and record rides, to take payment and issue receipts, to look into reports and keep people safe, to send the emails and notices the Service relies on, and to prevent abuse. We do not sell personal data and we do not share it with advertisers.
Who can see what. Chauffeurs see the name, phone and pickup details of clients who booked with them, and their own ratings as an average — never which client gave which rating. Clients see a chauffeur's public profile, vehicle, rates, average rating and public reviews. A review you choose to publish shows your first name and last initial. The person you report is never told who reported them. Trusted contacts a client names are told when a ride is booked (when, where from and to, and the chauffeur's name, car and plate) and get the live trip link when it starts, and nothing else. A restaurant Aurora calls for you hears your name, and your number only if they ask. If you dispute a card charge with your bank, we share that ride's record with Stripe and your bank to answer it. Our administrators can see what they need to run the service and answer reports; everything they do is logged with their name and reason.
Aurora and AI. Aurora runs on outside AI services, and she only starts once you allow it; you can change that any time in Account. When you talk or type to her, your words (and your voice, when you speak) go to OpenAI to be understood and answered; we keep the words, never recordings. A photo you show her is read once, by OpenAI or, as a backup, Google's Gemini, and never stored; we keep only a one-line description. Some quick checks, like how urgent a report is or what is worth remembering, run on TypeSafe, with email addresses, phone numbers and long numbers taken out first. We use these services under their business terms and send each only what the task needs — never your card, bank or identity numbers. For a report, that is the report, the ride record and first names, never emails or phone numbers. Aurora never decides anything about your account. In the iPhone app, listening for "Hey Aurora" is done by the phone's own speech recognition (Apple); that audio never reaches us and we keep none of it.
What Aurora remembers. We keep your chats with Aurora for 30 days, then fold them into a short summary so she can pick up where you left off. She also remembers what you tell her you like, and habits from your rides, until you delete them. Only you can see this: not chauffeurs, and not our team. See it, or delete it all, in Account under What Aurora knows. To make Aurora better, we also keep a record of how each conversation went (which request it was, how long it took, whether it worked); when a request didn't work, we keep its words, with names, numbers, email addresses and street addresses taken out. Those records are deleted after 30 days, and at once if you close your account.
Restaurant calls. When Aurora phones a restaurant for you, the call runs through ElevenLabs (her voice, on an Anthropic AI model) and Twilio (the phone line). The call is not recorded. ElevenLabs keeps a written transcript for 30 days. We keep the restaurant, party size, time, the name the table is under and a one-line summary.
Service providers. Hosting, database and email: Microsoft Azure in the United States, using the open-source Supabase platform. Payments and chauffeur payouts: Stripe. Maps, address search and routes: Google Maps Platform. Speed limits during navigation: HERE. Flight times: AeroDataBox and FlightAware. The city and county of each pickup and drop-off, for our own figures: the US Census Bureau, sent a rounded point and nothing else. Aurora: OpenAI, Google (Gemini) and TypeSafe; her restaurant calls: ElevenLabs, on an Anthropic model, and Twilio. Texts, once they are switched on: Mobile Text Alerts or Twilio. Phone notifications: Apple and Google. Sign-in: Apple, Google and Facebook, only if you choose them. Each receives only the data needed to do its job.
How long we keep things. Rides, receipts, payment records and sealed ride records: 7 years, because tax and insurance require it. GPS trails and messages: 2 years. Reports and their evidence: 3 years after they close. Chats with Aurora: 30 days, then a short summary until you delete it. Notification records: 90 days. Ratings and reviews: while the account exists. A place on an area waitlist: until you leave it. If we remove an account for safety or fraud we keep a sealed file about that removal for 7 years, encrypted, which only an owner can open, and we keep a one-way fingerprint of the email and phone number so the same person cannot sign up again. Everything else is deleted or anonymised within 30 days of your account closing.
Closing your account. Close it yourself from Account → Delete my account, or email us. It happens straight away. Your profile, photos, documents and what Aurora remembers about you are deleted, and your name, email and phone are wiped from our records. Your rides stay in the books without your details attached, as the law requires, and messages you sent are deleted on the usual 2-year schedule. If a report about you is open, we still finish looking into it.
Your choices. Update your profile at any time from the Account tab. Remove a chauffeur or client link whenever you like. Add or remove trusted contacts in Account. Allow or stop Aurora's AI services in Account, and see or delete what she remembers. Control location and notification permissions in your device settings. To get a copy of your data or ask us to delete it, email auroraprestigevip@gmail.com and we will act within 30 days.
Children. Aurora Prestige is not for anyone under 18 and we do not knowingly collect data from children.
Text messages. We hold your mobile number to text you when your chauffeur arrives (only if you switch that on in Account), to send a sign-in code when you ask for one, and, if a client names you as a trusted contact by your number, to tell you about their ride. Message frequency varies. Message and data rates may apply. Reply STOP to opt out, HELP for help. We never text marketing, and we never share your number or text consent with anyone for marketing.
Security. Data is encrypted in transit; access is restricted by per-person rules inside the database itself; passwords are never stored in plain text; administrators sign in with an authenticator code and every action they take is logged. Ride records are sealed with a fingerprint so a change after the fact would be detected. The whole database and all uploaded files are backed up nightly. No system is perfect; if we learn of a breach that affects you we will tell you.
Changes. If we change this policy in a material way we will let you know in the app before the change takes effect.
Contact. Privacy questions or requests: auroraprestigevip@gmail.com.