Auracompia — Privacy Policy

Effective Date: August 29, 2026  |  Last Updated: October 19, 2026

Privacy Policy

Service: Auracompia (the "Platform", "we", "us", "our") Data Controller: AURACOMPIA TECHNOLOGY LIMITED Registered Address: Unit 05, 12/F, The Cloud, No. 111 Tung Chau Street, Tai Kok Tsui, Kowloon, Hong Kong Contact Email: info@auracompia.com Effective Date: August 29, 2026 Last Updated: October 19, 2026

The English version of this Privacy Policy is the authoritative text. Any translated version is provided for convenience only.

1. Introduction

Auracompia provides AI companion services — letting you create an AI companion (a conversational persona with a generated avatar and voice, referred to throughout this Policy as a "companion") through face-based avatar cloning, voice cloning, and real-time conversational interaction. Because these features involve personal data — including certain data that is sensitive under applicable law — we are committed to handling your information transparently and lawfully.

This Privacy Policy explains what personal data we collect, why we collect it, the legal basis for processing, how we store, share, and protect it, how long we retain it, and the rights you have. It applies to the Auracompia mobile application (Android), the web (H5) client, and the associated backend services.

By using the Platform, you acknowledge that you have read this Privacy Policy. Where we require your consent (in particular for sensitive/biometric data), we will ask for it explicitly and separately, and you may withdraw it at any time as described below.

2. Who we are (Data Controller)

The data controller for the personal data described in this Policy is AURACOMPIA TECHNOLOGY LIMITED, a company registered in Hong Kong, at the address given above.

You can exercise your data rights or ask questions by contacting us at info@auracompia.com.

[EU Representative — reserved] We do not currently offer the Platform to, or direct processing at, people in the European Union. If we later make the Platform available in the EU/EEA or the UK, we will designate a written representative in the EU/UK under GDPR Article 27 / UK GDPR and publish its name and address here before such availability.

3. The data we collect

3.1 Information you provide to us

3.2 Information we collect automatically

We do not collect precise geolocation, and we do not sell your personal data.

4. Purpose and legal basis for processing

We process personal data only where we have a lawful basis. The table below summarizes the main purposes.

Purpose Data involved Legal basis
Provide account registration, login, and identity verification Email, hashed password, Google profile Performance of a contract (GDPR Art. 6(1)(b))
Generate your avatar and cloned voice Face photos, voice recordings Explicit consent (Art. 9(2)(a)); withdrawable at any time
Deliver AI conversation and persona behavior Conversation content, persona config Performance of a contract (Art. 6(1)(b))
Deliver push notifications Device push token Performance of a contract / legitimate interest
Billing, credits/orders, and customer support Account, transaction and usage data Contract, and legal obligation where applicable
Prevent fraud, abuse, and ensure account & service security Device, IP, logs Legitimate interest (Art. 6(1)(f))
Improve the service and models using de-identified / aggregated data Usage and de-identified conversation data Legitimate interest, with safeguards (see Section 4.1)

4.1 Model improvement and de-identification

Where we use data to improve the service or AI quality, we first de-identify or anonymize it so that it can no longer be linked to your identity. Where this Policy refers to "de-identify" or "anonymize", both mean that the data has been processed so that it can no longer be linked to you. We do not use your raw face images or voice recordings for general model training without separate, explicit consent. Anonymized data falls outside the definition of personal data under applicable law.

4.2 Automated decision-making

The Platform generates conversational replies using AI models. These replies are not legal, medical, financial, or other professional advice, and they do not produce legal or similarly significant automated decisions about you within the meaning of GDPR Article 22.

5. Sensitive and biometric data — additional protections

Because face images and voiceprints are sensitive:

We do not use your face photos or voice recordings to identify you, and we do not compare them against other individuals' material.

  1. Separate, explicit consent. We obtain a distinct, opt-in consent before you upload a photo or a voice recording. Consent is never pre-ticked. Scope of authorization: your consent is a one-time authorization covering (a) the collection of the material to generate the specific companion you request, and (b) the processing and storage of that material for as long as that companion exists. Withdrawal — object and effect: you may withdraw this consent at any time — by deleting the corresponding companion in the app, or by contacting us at info@auracompia.com. Withdrawal applies to the ongoing processing and storage from the moment it is exercised: it stops further processing and triggers deletion of the related material (see Section 5.4 and Section 6.4); it does not affect the lawfulness of processing carried out before the withdrawal, and collection already completed is not reversed. Consent version: if we materially change our biometric processing practices, we will ask you for consent again (the in-app consent version will be upgraded) rather than relying on notices alone. This biometric consent is not required for, and does not cover, features that do not process face or voice data — such as AI-generated avatars from a text prompt, preset voices, text-designed voices, chat with companions (including in-conversation message relay), and My Library (knowledge base).
  2. Limited use. Such data is used only to generate the avatar/voice you requested and to power your own conversations.
  3. Third-party faces and voices. If you upload material depicting or recording another natural person, you are solely responsible for obtaining that person's lawful, separate, explicit consent, and you represent to us that you have done so.
  4. Deletion at your control. When you delete a companion (or an individual avatar or voice clone), the associated uploaded material — the photos and audio recordings you provided — together with the generated avatar/voice assets are removed from our storage. Deletion also cascades to any copies of that companion that were shared with other users (see Section 7.1), so the removed material is taken down along with those copies. Text conversation records — whether created by you or by the recipient of a shared copy — are not part of the biometric material described in this Section and are governed by Section 6.4; they remain viewable by the user who created the conversation records.
  5. No sale or unrelated sharing. We do not sell biometric data or share it for unrelated purposes.
  6. Risk mitigation for high-risk processing. Because face and voice data are sensitive, we apply additional technical and organizational safeguards to this processing.
  7. Additional U.S. state-law rights. If you reside in a jurisdiction with specific biometric laws (e.g., Illinois BIPA), you have the right to request information about our biometric retention and disclosure practices and to request deletion, by contacting us at info@auracompia.com.

6. How we store, transfer, and protect data

6.1 Where data is stored

Your personal data is hosted on cloud infrastructure located in Singapore (Alibaba Cloud International, region ap-southeast-1), operated on our behalf under confidentiality and security obligations.

6.2 Cross-border transfers

The data controller is established in Hong Kong and our infrastructure is in Singapore. If you access the Platform from another region (for example, the EU/EEA, UK, or Switzerland), your personal data will be processed outside your home region. Where a cross-border transfer mechanism is required by applicable law, we rely on appropriate safeguards, such as contractual clauses that meet the required standard.

6.3 Security measures

We apply industry-accepted safeguards, including encryption of data in transit (HTTPS/TLS), salted hashing of passwords, access controls, network isolation, and security auditing, designed to prevent unauthorized access, alteration, disclosure, or loss. No method of transmission or storage is perfectly secure; if a personal-data breach occurs that is notifiable, we will notify the affected users and the competent supervisory authority within the timeframes required by applicable law (for example, without undue delay and, under the GDPR, notification to the authority within 72 hours where feasible).

6.4 Retention

We keep personal data only for as long as necessary to provide the service and for the purposes in this Policy. Specifically: - Face/voice material is retained in cloud storage only while the corresponding companion (or avatar/voice clone) exists. When you delete it, the associated uploaded photos and recordings and the generated assets are removed. This removal extends to copies created through sharing (see Section 7.1). - Conversation records are deleted when your account is deactivated. - If a companion (or its shared copies) is removed as described in Section 7.1, text conversation records remain retained and viewable by the user who created the conversation records; such records are not part of the removed avatar/voice material. Raw conversation text is kept for a limited period (currently 7 days) and is then replaced by a summary, which is retained while the account remains active. - When retention is no longer justified, we delete or irreversibly anonymize the data.

7. Sharing and disclosure

We do not sell your personal data. We share it only in the following limited ways:

7.1 Sharing of your companion and cascade deletion

When you share a companion, each recipient receives an independent copy of that companion as it exists at the time of sharing. Changes you later make to your own companion do not affect copies that were already shared. If you later delete the original companion or deactivate your account, the deletion cascades to every shared copy: the avatar, voice, and persona assets of those copies are removed from our storage and the copies can no longer be used for new conversations. Text conversation records remain retained and viewable by the user who created the conversation records (see Sections 5.4 and 6.4). A companion received through sharing cannot be re-shared by the recipient. We cannot remotely delete screenshots or cached files saved on a recipient's own device.

8. Your rights

Subject to applicable law (and, for EEA/UK/Swiss residents, to GDPR/UK GDPR), you may exercise the following rights by contacting info@auracompia.com:

We will respond to verified requests within one (1) month, which may be extended by two further months for complex or numerous requests, in line with GDPR. We may need to verify your identity before acting. If you are an EEA/UK/Swiss resident and consider our processing unlawful, you have the right to lodge a complaint with your local supervisory authority.

8.1 California residents (CCPA/CPRA)

We do not "sell" or "share" personal information as those terms are defined under the CCPA/CPRA, and we do not knowingly process personal information of individuals under 16 without the consent required by law. California residents have the right to know, access, delete, and correct personal information, and to opt out of sale/sharing (which we do not conduct). We will not discriminate against you for exercising these rights. To submit a request, email info@auracompia.com. Authorized agents must provide written authorization.

9. Children's privacy

The Platform is intended for users 18 years of age and older and is not directed at children. We do not knowingly collect personal data from children. If we learn that a child has provided us personal data, we will delete it as soon as reasonably possible. If you are a parent or guardian who believes a child has provided us data, contact us at info@auracompia.com.

10. Account deactivation and deletion

You can delete your account in-app via Me > Settings > Account & Security > Delete Account. Account deletion (referred to as "deactivation" elsewhere in this Policy and in the app's internal terminology) describes the same irreversible action. Deletion takes effect immediately: we promptly anonymize your personal data (email, password hash, nickname, profile photo, and linked identifiers are cleared or replaced with non-reversible values) and stop processing it for active purposes. Your uploaded avatar and voice material are removed in accordance with Section 6.4, your conversation records are deleted, and your contact list, friend relationships, pending friend requests, and relayed messages are deleted. If you create an account again later, it will be a new, separate account; deleted data cannot be recovered. Some records may be retained only in de-identified/aggregated or legally-required form.

11. Third-party services and links

The Platform may contain links to or integrations with third-party services (e.g., Google Sign-In, Firebase, payment providers). Those third parties operate under their own privacy policies, and we encourage you to review them. This Policy does not cover their practices.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. For material changes — such as changes to the purposes or methods of processing, the categories of data, the parties we share data with, or how you exercise your rights — we will notify you through an in-app notice, pop-up, or push notification, and update the "Last Updated" date above.

13. Contact us

For privacy questions, data-rights requests, or concerns, please contact:

This address is also our contact point for all privacy and data-protection requests.