Privacy Policy
Last updated: 2 November 2026 · Version 2026-11-02
Applies to specdox.com, Aurora-operated SpecDox accounts and related support. Customer content processed on instruction is covered by the DPA.
1. Controller and contact
ACL Aurora Core Labs LTD (Aurora), Strovolou, 77, 2018 Strovolos, Nicosia, Cyprus, is controller for website enquiries, account administration, our business records and service security. Contact hello@auroratech.ai or https://specdox.com/contact for privacy requests.
2. Data and sources
We receive contact names, email addresses and messages you submit; account identifiers, workspace memberships and subscription entitlements; and technical request, usage and security information needed to operate and protect the service. Paddle provides purchase and subscription information needed to match your order and entitlement, such as transaction references, plan and status. Payment details are supplied to Paddle through its checkout. Documents, code, prompts and integration credentials may be processed by the hosted product according to customer instructions. Avoid sending unnecessary personal data or live secrets in support messages.
3. Purposes and lawful bases
We use account and order information to perform a contract or take requested pre-contractual steps; security and ordinary business correspondence rely on legitimate interests in operating and protecting the service and responding to requests. Statutory record keeping relies on legal obligations. Optional website analytics relies on consent. Marketing, if offered, requires its own applicable permission and is not authorised by creating an account or contacting support. Required account information is necessary to authenticate and deliver access; optional analytics is not required to use the website.
4. Roles and recipients
Aurora personnel and providers receive only information needed for their functions. Paddle acts as merchant of record and independent controller for purchase, payment, tax, fraud and transaction processing under its own privacy notice. Google receives optional website analytics only after consent. Customer-enabled GitLab, AI and other integrations receive the data their workflows send. Providers processing hosted content on our behalf belong in the deployment-specific DPA schedule. We may disclose data where legally required. We do not sell customer content or use it to train general-purpose AI models.
5. Retention
We retain account records while needed to deliver access, support and account administration. Enquiries are kept while handled and afterwards where needed for follow-up, disputes or legal records. Transaction records follow applicable tax and legal obligations; security records are kept while needed for investigation and protection. Information no longer needed is deleted or anonymised, subject to lawful holds. Hosted customer content return, deletion and backup periods must be recorded in the applicable DPA schedule; self-hosted retention is controlled by the operator.
6. International transfers
Where data is transferred outside the EEA, the applicable transfer must be covered by an adequacy decision or appropriate safeguards, such as EU Standard Contractual Clauses with any necessary supplementary measures. Ask us for the safeguards applicable to your deployment and a copy where available. Paddle and customer-selected independent services describe their own transfers in their notices.
7. Your rights
Subject to legal conditions, you may request access, rectification, erasure, restriction, portability or object to processing based on legitimate interests. Withdraw optional consent at any time without affecting prior lawful processing. Contact us; we may request proportionate identity verification and normally respond within one month, with lawful extensions explained. You may complain to the Commissioner for Personal Data Protection in Cyprus or your competent supervisory authority. Requests concerning customer-controlled workspace content should go to that customer; we assist as processor.
8. Cookies and local storage
The Cookie Policy explains optional Google Analytics and necessary application storage. Analytics stays disabled until accepted, and Cookie settings in the footer lets you change your choice. The website consent choice lasts up to one year. The application uses local storage for sign-in and preferences; sign out on shared devices. Website analytics consent is not consent for AI processing or marketing.
9. Self-hosted and AI processing
In a self-hosted installation, the operator controls repositories, storage, credentials, access and backups. Connecting Aurora licensing, support or external services creates the data flows described for those services. When an AI integration is enabled, relevant prompts, conversation, document and code context may leave the installation for the configured provider. Review the configuration and applicable provider terms before sending personal or confidential data. We do not rely on the website analytics consent for these workflows.
10. Updates
We update this policy when processing changes and communicate material changes as required. The version date identifies the current notice. Questions and rights requests may be sent directly to hello@auroratech.ai.
Purchase support: Paddle · Paddle Buyer Terms · Paddle Refund Policy · Paddle Privacy Notice
Aurora: hello@auroratech.ai