1. Who We Are

Aurelia House Limited ("Aurelia House," "we," "us," or "our") operates the Aurelia House platform, accessible at aureliahouse.com and aurelia-house-web.fly.dev (collectively, "the Platform"). We are incorporated under the laws of the Republic of Kenya.

For questions regarding this Privacy Policy or your personal data, contact us at: legal@aureliahouse.com.

2. What Data We Collect

We collect the following categories of personal data:

Identity Data: Your name, email address, and account credentials.
Transactional Data: Order history, payment references, and gift recipient email addresses you provide.
Usage Data: Pages visited, features used, and interactions with our curation tools (such as the Mini-Oracle and Pathway Selector). This data is pseudonymised.
Communication Data: Messages exchanged via Secure Sync (our encrypted P2P messaging feature). These messages are end-to-end encrypted and are not accessible to us except to facilitate delivery.
Preference Data: Your sensory preferences, pathway affinity scores, and archetype signatures generated through our platform, which we term your "Resonance Profile."
Device & Technical Data: IP address, browser type, device identifiers, and session tokens (stored via cookies).
Payment Data: We do not store full payment card numbers. Payment processing is handled by third-party providers (M-Pesa, Stripe). We retain only confirmation references.

3. How We Use Your Data

We use your personal data to:

Operate and deliver the Platform's core services, including order processing and gift fulfillment.
Personalise your experience through your Resonance Profile and curated recommendations.
Communicate with you regarding your account, orders, or material changes to this Policy.
Comply with legal and regulatory obligations, including anti-money laundering (AML) and know-your-customer (KYC) requirements where applicable.
Detect and prevent fraud, unauthorized access, and abuse of the Platform.
Conduct internal analytics to improve service quality. Analytics data is aggregated and does not identify you individually in reports.

We do not sell your personal data to third parties. We do not use your data to train public AI models.

4. Legal Basis for Processing

We process your personal data on the following legal bases:

Contract performance: Processing necessary to fulfill your orders and provide platform services.
Legitimate interests: Fraud prevention, platform security, and internal analytics.
Consent: For optional personalisation features and marketing communications. You may withdraw consent at any time by visiting your account settings or emailing us.
Legal obligation: Where required by law in Kenya or applicable international regulations.

5. Data Sharing & Third Parties

We share data only with:

Service providers who support Platform operations (hosting, payment processing, email delivery, analytics). These providers are contractually bound to protect your data.
Artisan vendors on our marketplace, limited to the information necessary to fulfill your order (e.g., recipient details for gift delivery).
Law enforcement or regulatory bodies where required by a valid legal request or court order.

We do not transfer your data outside of jurisdictions with adequate data protection standards without appropriate safeguards in place.

6. Cookies & Tracking

We use cookies and similar technologies for session management, security, and usage analytics. When you first visit the Platform, you will be presented with a cookie consent notice and may choose to accept or decline non-essential cookies. You may also manage your cookie preferences through your browser settings.

7. Data Retention

We retain your personal data for as long as your account is active, plus a period of 7 years to comply with statutory obligations (e.g., financial record-keeping). Where data is no longer required, it is securely deleted or anonymised. You may request earlier deletion subject to our legal retention obligations (see Section 8).

8. Your Rights

Depending on your jurisdiction, you have the right to:

Access the personal data we hold about you.
Correct inaccurate or incomplete data.
Delete your data (the "right to be forgotten"), subject to our legal obligations.
Restrict or object to certain processing activities.
Data portability — receive your data in a structured, machine-readable format.
Withdraw consent for any processing based solely on consent.

To exercise any of these rights, contact us at legal@aureliahouse.com. We will respond within 30 days. You also have the right to lodge a complaint with your relevant supervisory authority.

9. Data Security

We implement commercially reasonable technical and organisational measures to protect your data, including TLS encryption in transit, access controls, and regular security reviews. However, no system is entirely immune to breach. In the event of a material data breach affecting your rights, we will notify you and the relevant authority in accordance with applicable law.

10. Children's Privacy

The Aurelia House Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy periodically. Where changes are material, we will notify you by email or a prominent notice on the Platform before the changes take effect. Your continued use of the Platform after the effective date constitutes your acceptance of the revised Policy.

12. Contact

Aurelia House Limited
Nairobi, Kenya
legal@aureliahouse.com