Privacy Notice
Last updated: 8 July 2026
1. Who we are
This notice explains how Ross & Sons Digital LTD ("we", "us", "our"), a company registered in the United Kingdom trading as Auralendar, processes personal data about visitors and users of Auralendar (the "Service"). We are the data controller for the personal data described here.
2. What we collect and why
| Category | Examples | Purpose | Legal basis (UK GDPR) |
|---|---|---|---|
| Account data | Name, email address, hashed password or OAuth identifier | Create and secure your account, sign you in | Contract performance |
| Profile & preferences | Display name, chosen tone, interests, location string | Personalise your daily inspiration | Contract performance |
| Calendar content | Events you create; Google Calendar events you sync | Provide the calendar features you use | Contract performance |
| Google integration tokens | OAuth access & refresh tokens if you connect Google Calendar | Read/write events on the calendar you select | Consent (revocable at any time) |
| Entitlements & billing metadata | Trial start date, plan status, Paddle customer/transaction IDs | Grant access to paid features | Contract performance |
| Technical & usage data | IP address, device/browser, error logs, basic usage events | Security, fraud prevention, debugging, improving the Service | Legitimate interests |
| Support messages | Emails you send us | Respond to your enquiry | Legitimate interests |
Payment card details are collected directly by Paddle (see below) — we never see or store your full card number.
3. Who we share it with
- Paddle.com Market Ltd — our Merchant of Record. Paddle handles checkout, payment processing, tax compliance, invoicing, subscription management, and refund handling. See Paddle's privacy notice.
- Supabase / hosting & database providers — store your account, preferences, events, and entitlement records on our behalf.
- Google LLC — only if you connect Google Calendar, so we can read and write events on the calendar you select. You can revoke access at any time in your Google account settings.
- AI providers — the text of the inspiration prompt (your interests, tone, and event title if any) is sent to a large language model to generate a response. We do not send your email address or other direct identifiers with the prompt.
- Professional advisers (legal, accounting) and competent authorities where required by law.
4. International transfers
Some of our providers process data outside the UK/EEA (for example in the United States). Where they do, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision.
5. Retention
We keep account, profile, and calendar data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within 30 days, except where we are legally required to keep certain records (for example, billing records retained by Paddle for tax purposes).
6. Your rights
Under the UK GDPR and equivalent laws you have the right to:
- Access the personal data we hold about you
- Ask us to correct inaccurate data
- Ask us to delete your data ("right to erasure")
- Restrict or object to certain processing
- Receive your data in a portable format
- Withdraw consent (for example, disconnect Google Calendar) at any time
- Complain to the UK Information Commissioner's Office (ICO) at ico.org.uk
To exercise any of these rights, email us at Rossandsonsdigital@gmail.com. We will respond within one month.
7. Security
We use appropriate technical and organisational measures to protect your personal data, including encryption in transit (HTTPS), encrypted storage, role-based access controls, and database Row-Level Security. No system is perfectly secure — please use a strong, unique password.
8. Cookies and similar technologies
Auralendar uses only essential cookies and local storage needed to keep you signed in and remember your session. We do not use advertising or third-party analytics cookies. Paddle may set cookies during checkout to process your payment; see Paddle's privacy notice for details.
9. Children
Auralendar is not intended for children under 16 (or the age of digital consent in your country). We do not knowingly collect personal data from children.
10. Changes to this notice
We may update this notice from time to time. Material changes will be highlighted in the Service or by email.
11. Contact
Ross & Sons Digital LTD — email Rossandsonsdigital@gmail.com.