Privacy notice

Last updated: 18 September 2026 · Version 2026-09-18

1. Controller and contact

Aurastudy is independently managed by the following data controller:

2. Data we process

• Technical data: IP address, user agent, request time, security and service logs generated when Aurastudy is reached.
• Account data: email address, internal user identifier, authentication events, interface language, settings and registration timestamps.
• User content: folder and map titles, text, formulas, connections, layout, inline images and other content intentionally saved in a map.
• Device-only data: maps used without an account, settings, recent colours, onboarding state and aggregate placement preferences remain in the browser's storage unless the user chooses to create an account and migrate them.
• Usage measurement, only with consent: a pseudonymous identifier generated by the measurement tool, a small set of named events (for example: landing page viewed, editor opened, first map created, PDF exported) and, alongside them, interface language, device class, whether an account is in use, and campaign parameters restricted to a fixed vocabulary. No text, formulas, images, titles or identifiers of your maps are ever collected for measurement, and page addresses are stripped of any identifier before being sent.
• Link to your computer: if you request the link by email from a phone, the address you enter is used to send that single message. To prevent abuse of the form, the address and the sending IP are stored only as irreversible cryptographic digests, which cannot be turned back into the original values.
• Problem reports: if you use the “Report a problem” form, what is sent is the description you write, the kind of problem, the page in a form stripped of identifiers, the window size, the browser, the most recent technical errors and a trace of your last actions in which letter keys appear as “text” and never as the character you pressed. If you leave it attached, a photo of the screen taken when you opened the form is sent too, and only if you tick the box, a copy of the open map without its images. Both attachments are optional and shown in the form before sending. To limit abuse, the sending IP is stored only as an irreversible cryptographic digest.
• Maps shared through a link: if you create a share link, that map becomes readable by anyone holding the address, and stays so until you turn the link off. Shared from an account, the link shows the map already saved and no extra copy is made; shared without an account, a copy of the content is hosted on the service's systems — the only way to show it to someone else — and is removed when the link goes off. To prevent abuse of link creation, the IP of whoever creates one without an account is stored only as an irreversible cryptographic digest.

Aurastudy does not use advertising, marketing profiling, behavioural analytics, automatic click capture or session recording. It does not intentionally request special-category data. Do not enter confidential information, special-category data, or personal data about third parties unless you have a lawful reason to do so.

3. Purposes and legal bases

• Provide the editor, account, synchronisation and requested support: performance of the Terms (Article 6(1)(b) GDPR).
• Send the link to open Aurastudy on a computer, at your request: performance of a pre-contractual request (Article 6(1)(b) GDPR).
• Make a map readable to whoever opens a share link: performance of the Terms at your request (Article 6(1)(b) GDPR). Sharing always starts from an action of yours and stops when you turn the link off.
• Protect the service, prevent abuse and diagnose failures, including the problem reports you choose to send and the anti-abuse limits on the link form, the report form and share-link creation: the controller's legitimate interest in operating a secure service (Article 6(1)(f) GDPR).
• Measure how the service is used and improve it: your consent (Article 6(1)(a) GDPR). Nothing is collected before consent, refusing costs no functionality, and you may withdraw at any time from the settings panel or the footer of the public page. Withdrawal stops collection from that moment on.
• Comply with binding legal obligations and handle legal claims: Articles 6(1)(c) and 6(1)(f) GDPR, as applicable.

Privacy notice acknowledgement is not used as consent to the processing necessary to provide a Aurastudy account, and it is separate from the measurement consent described above.

4. Providers and recipients

• Supabase, Inc. provides authentication, the database and authentication-event logs. The project database is located in Central EU (Frankfurt). Supabase and its authorised subprocessors may process limited technical data where necessary to provide the service.
• Brevo delivers account confirmation, magic-link, password-recovery and link-to-your-computer emails. It processes recipient addresses and transactional delivery events for this purpose. Brevo states that its databases are hosted in the European Union.
• Vercel Inc. provides hosting, content delivery, server-side execution and technical logs. Server-side execution runs in the European Union (Frankfurt); Vercel may process data in the United States and in the countries where its subprocessors operate.
• PostHog provides usage measurement on its European Union infrastructure, and only after consent. It receives the events and properties listed in section 2. Automatic click capture, session recording and surveys are disabled in the client.

Providers may access data only as necessary to deliver, secure and support their services or when required by law. Aurastudy does not sell personal data. The dormant Mathpix image-recognition feature is disabled and no image is currently sent to Mathpix.

5. International transfers

The database is configured in Frankfurt and measurement uses the provider's European Union infrastructure. Some hosting, support and subprocessor activities can involve countries outside the EEA. Where required, these transfers are covered by an adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses and the providers' applicable data processing agreements.

6. Retention

• Account data and saved content are retained while the account exists and are removed from active application systems when the account is deleted.
• Short-lived security, delivery and infrastructure logs are retained according to the providers' current technical retention periods.
• Residual copies can remain temporarily in rotating backups until their normal expiry and are not used for ordinary product activity.
• Device-only data remains until it is removed through browser settings or the site data is cleared.
• Measurement events are retained for the period configured in the measurement project and no longer than needed to observe the trends they were collected for. The digests used for the anti-abuse limit are kept only for the duration of the limit.
• Problem reports, with any attachments, are kept while they are useful to reproduce and fix the defect, and are deleted once they are not.
• A share link stays live until you turn it off; one created without an account turns itself off after seven days, and the hosted copy is removed at that moment.

7. Your rights

You may request access, rectification, erasure, restriction, portability and, where applicable, object to processing. You can export and delete your account from the account page. You can also contact the controller at the address above. Requests are handled without undue delay and normally within one month.

Where processing is based on consent, you may withdraw it at any time without giving a reason; withdrawal does not affect processing already carried out.

You may lodge a complaint with the Italian Data Protection Authority or another competent supervisory authority.

8. Children

Aurastudy accounts are reserved for people aged at least 16. People under 16 must not create an account. Using the editor without an account keeps map content on the device — unless you create a share link for it, which needs a hosted copy in order to work — although ordinary technical connection data is still processed.

9. Security and changes

Aurastudy uses encrypted connections, owner-based database access controls and data minimisation. No online service can promise absolute security. Material changes to this notice will be shown in the product and identified by a new version date.