Aure LLC · Confidential / Pre-Review

Privacy Policy

Aure LLC Last updated: [DATE] Effective date: [DATE]

1. Who we are and how to reach us

Aure LLC (“Aure”, “we”, “us”, or “our”) provides a mobile application and related services (collectively, the “Service”) that offer a private, AI-guided space for people processing the experience of relationship betrayal.

• Legal entity: Aure LLC, a [Florida limited liability company] • Registered address: 9349 Collins Avenue, Unit #705, Surfside, Florida 33154, United States • Contact for privacy matters: info@aurelife.com
• EU/UK Representative: [TO BE APPOINTED — required under GDPR Art. 27 / UK GDPR. See Section 18.] • Brazil Data Protection Officer (Encarregado): [TO BE APPOINTED — required under LGPD Art. 41]

This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and what choices you have. It applies to all users of the Service worldwide, except where superseded by region-specific addenda (see Section 17).

We are committed to processing your information lawfully, transparently, and with the heightened care this category of product demands. Where this Policy describes a choice or a right, we mean it; if you cannot exercise it through the in-app controls, contact us using the address above.

2. The nature of the Service — read this first

Aure is not a medical service, not a mental health service, and not a crisis intervention service. Aure does not provide medical, psychological, psychiatric, therapeutic, or diagnostic advice. Aure is a lifestyle and emotional-support companion application.

The information you share with Aure is sensitive by nature. It may include details about your emotions, your relationships, your sexual orientation, your partner, and — in some moments — your safety. We have designed this Policy and our internal practices around the assumption that what you share matters and deserves the highest standard of care. That standard, however, is a privacy standard, not a medical-confidentiality standard, and you should not rely on Aure as a substitute for licensed professional support.

If you are experiencing a crisis or are at risk of harming yourself or others, please contact emergency services in your country or a qualified professional. The Service includes safety features (described in Section 9) but those features are not, and cannot be, a replacement for human professional care.

3. The personal information we collect

We collect personal information in three ways: information you give us, information generated by your use of the Service, and information we receive from third parties.

3.1 Information you give us during onboarding

When you create an account, we ask you to provide:

• Gender identity (e.g., Woman, Man, Other) • Age (numeric) • Sexual orientation (e.g., Heterosexual, Bisexual, Lesbian/Gay, Other) • Years with your partner (numeric range) • Preferred language • City (optional)
• Email address or phone number (depending on sign-in method chosen)

We collect these because they are essential to matching you with appropriate content, with peers in similar phases, and with moderated groups suited to your situation. We collect the minimum necessary; we do not ask for your real name, photograph, address, occupation, income, or partner’s identifying information at any point during onboarding.

You may sign in using Apple, Google, or a phone number. If you choose Apple or Google sign-in, we receive a unique identifier and the email address you choose to share (Apple lets you hide your real email via its Hide My Email service; we support that). We do not receive your contacts, social graph, calendar, or other data from these providers.

3.2 Information generated by your use of the Service

As you use the Service, we generate and store the following:

• Conversations with Aurè (our AI assistant): the full text of your conversations, including messages sent and received, timestamps, and any audio input you provide if you choose voice features. • Group posts and replies: anything you post in moderated group circles, anonymized to other members but visible to moderators and to us (see Section 6.3 — this is important). • 1:1 peer chat content: messages exchanged with a matched peer, where applicable. • Inferred state data: internal classifications generated by our AI about your current phase (Survival, Stabilization, Coaching), your readiness for group or peer features, and the presence or absence of crisis indicators. • Emergency contact information that you provide conversationally, if and when you choose to share it (Section 9.3). • Usage telemetry: screens viewed, features used, session duration, and aggregate engagement patterns. • Device & technical data: device model, operating system version, app version, language settings, time zone, IP address (truncated for storage; see Section 7), and crash diagnostics.

3.3 Information we receive from third parties

• Payment processors (if you subscribe): Apple App Store and Google Play handle payments. We receive confirmation of subscription status and the obfuscated identifier the platform provides; we do not receive your credit card number, bank account, or full billing address. • Crash and analytics providers: see Section 6 for the list and what they receive. • Service providers handling crisis hotline routing: when you trigger our SOS module, we may use a third-party geolocation service to identify an appropriate regional hotline (Section 9.2).

3.4 What we do not collect

To make this concrete: we do not collect or ask for your full legal name; your home address; your photograph; your social media accounts; your contacts; your location continuously in the background; your partner’s name, photograph, or any identifying information; the names of any third parties you discuss; or biometric data.

If you happen to mention any of the above in a conversation with our AI or in a group post, that information will be processed as part of your conversational content (Section 3.2) — but we do not actively solicit it and we ask you, in-product, to avoid sharing identifying details about third parties.

4. Special categories of personal data (Article 9 GDPR / sensitive personal information)

Some of the information we process is treated under European, UK, and California law as special category or sensitive data and is subject to additional protections. This includes:

• Data revealing sexual orientation (collected at onboarding) • Data concerning health, including mental health — strictly speaking, Aure is not a health service, but we recognize that information about emotional states, distress, and crisis indicators is treated as health-adjacent data by regulators and we apply the heightened standard regardless

Legal basis under GDPR Art. 9 / UK GDPR Art. 9: Your explicit consent, given at the moment of onboarding and renewable in your privacy settings.

Under California’s CPRA (Sensitive Personal Information): You have the right to limit our use of this sensitive personal information to what is strictly necessary to deliver the Service. See Section 12.2 for how to exercise this right.

Under Brazil’s LGPD (dados pessoais sensíveis, Art. 11): Your specific, distinct consent is collected before processing, and you may revoke that consent at any time.

If you withdraw consent for the processing of special category data, we will be unable to continue providing core features of the Service that depend on this data (matching, group assignment, AI personalization). We will explain this clearly at the moment of withdrawal and you will retain the right to delete your account and all associated data (Section 12.1.c).

5. Why we process your information (purposes and legal bases)

We process your personal information for the purposes described below. Under GDPR/UK GDPR/LGPD, every act of processing requires a lawful basis; we have set these out alongside each purpose.

5.1 We do not train AI models on your conversations

This is important and we make it a binding commitment. As of the effective date of this Policy, we do not use your conversations with Aurè, your group posts,

your peer chat messages, or any sensitive content you share with the Service to train, fine-tune, or otherwise improve any AI model, whether ours or a third party’s.

If, in the future, we wish to use such content for model training, we will: 1. Update this Policy with at least 30 days’ notice; 2. Obtain your explicit, separate, opt-in consent through an in-app prompt; and 3. Allow you to continue using all core features of the Service whether you give that consent or not.

Anonymized aggregate metrics (e.g., “how many users reached the Stabilization phase last month”) may be used for service improvement at any time, because such metrics do not constitute personal data once properly aggregated.

5.2 We do not sell your information

We do not sell your personal information in the ordinary sense of that word. We also do not “sell” or “share” your personal information as those terms are defined under the California CPRA, which captures certain forms of cross-context behavioral advertising and data brokerage. We do not engage in any of those activities.

5.3 No advertising

The Service does not display third-party advertising. We do not use your information to target you with ads, on or off our Service.

6. Who we share your information with

We share personal information only as described below. We never sell your data and we never share it with advertisers.

6.1 Service providers (data processors)

We use third-party service providers to operate the Service. Each is bound by a written data processing agreement that restricts their use of your information to providing services to us. Our current providers fall into the following categories:

• Cloud infrastructure: [e.g., Amazon Web Services / Google Cloud Platform — TO BE CONFIRMED] for hosting and storage, with data primarily processed in [REGION]. • AI model provider: [e.g., Anthropic, OpenAI, or self-hosted — TO BE CONFIRMED]. Your conversations are sent to this provider in order to generate AI responses. This provider is contractually prohibited from using your data to train their models, retain it beyond what is needed to return a response, or use it for any purpose other than serving Aure. [Specific provider zero-retention terms to be cited here once provider is selected.] • Crash and performance monitoring: [e.g., Sentry — TO BE CONFIRMED], which receives device technical data and crash traces but not the content of your conversations.
• Analytics: [e.g., a privacy-respecting provider such as PostHog or Plausible self-hosted — TO BE CONFIRMED], which receives anonymized usage events. • Payment processing: Apple App Store and Google Play, governed by their own privacy policies. • Email and transactional notifications: [e.g., Postmark or SES — TO BE CONFIRMED], which receives the email address and content of transactional messages. • Customer support tooling: [e.g., Help Scout — TO BE CONFIRMED], if you contact our support team.

Before we add any new service provider that processes personal data, we conduct a vendor review and update this list in a public sub-page at aurelife.com/privacy/subprocessors.

6.2 The AI assistant (“Aurè”)

When you converse with Aurè, the content of your messages is transmitted to our AI model provider (Section 6.1) so that a response can be generated. The provider acts as a data processor on our behalf. The provider may temporarily process your message in memory but is contractually required to delete it after the response is returned and is prohibited from training models on it.

Aurè’s responses are generated by a language model. They are not the statements of a human professional and may contain errors, including factual errors or context errors. Do not rely on them for medical, legal, financial, or safety decisions.

6.3 Group moderators (the “anonymity” disclosure)

The Service includes moderated group circles. When you post in a group, your post appears to other group members under a pseudonymous handle (e.g., “Maya_W”) but is not anonymous to us or to the moderators. Specifically:

• Human moderators read every group post. Posts are reviewed before being shown to other members (“pre-publish moderation”) and may be edited or rejected at the moderator’s discretion under the Community Guidelines. • Moderators can see the underlying account associated with each post, including your onboarding-provided attributes (gender, age, orientation, stage), to the extent needed to make moderation decisions. • We retain a record of all group posts, including rejected ones, for safety and audit purposes (Section 8).

We use the word “anonymous” in the product UI to describe the experience between members, not the relationship between you and the platform. We want this to be unambiguous.

6.4 Matched peers (1:1 connections)

When you enter a 1:1 peer connection with another member, the other member can see: - Your pseudonymous handle - The general phase you are in (Survival / Stabilization / Coaching) - The messages you choose to send them

The other member cannot see your real identity, your email address, your phone number, your exact age, your city, or any other onboarding data unless you choose to share it in conversation. We strongly recommend that you do not share personally identifying information with peers, and we provide in-app guidance to this effect.

6.5 Safety and emergency situations

If we determine, in good faith, that there is an imminent risk of serious harm to you or another person, we may share limited information with emergency services or a designated emergency contact you have provided, to the extent strictly necessary to address the risk. We will not provide your full conversational history; we will share only what is reasonably necessary to facilitate emergency response.

6.6 Legal compliance and dispute resolution

We may disclose your information to comply with a valid subpoena, court order, regulatory request, or other legal obligation. We evaluate each request for facial validity and proper jurisdiction and, where lawfully permitted, we will notify you before disclosing. We will not voluntarily disclose your data without legal compulsion.

6.7 Corporate transactions

If Aure LLC is acquired, merged, or sells substantially all of its assets, your information may be transferred to the acquiring entity, subject to the same protections set out in this Policy or as updated under Section 19.

7. International transfers of personal data

Aure LLC is located in the United States. By using the Service, your personal information will be transferred to and processed in the United States and potentially in other countries where our service providers operate.

For users in the European Economic Area, the United Kingdom, and Switzerland, we rely on Standard Contractual Clauses (the European Commission’s 2021 SCCs and the UK Addendum) and, where applicable, additional safeguards including encryption in transit and at rest, pseudonymization where feasible, and contractual restrictions on processor access. A copy of the SCCs we use, with confidential commercial terms redacted, is available on request to info@aurelife.com.

For users in Brazil, transfers occur under the LGPD’s international transfer mechanisms (Art. 33), specifically based on contractual clauses approved by the ANPD where applicable, your specific consent for transfers of sensitive data, and our binding commitment to maintain LGPD-equivalent protections.

Truncated IP addresses are used for analytics. Full IP addresses are retained only as long as needed for security purposes (typically 30 days for fraud and abuse detection logs).

8. How long we keep your information

We retain personal information only as long as necessary for the purposes described in this Policy.

You may request deletion of your account at any time (Section 12). On deletion, all personal data tied to your account is erased except where retention is required by law (e.g., financial records) or for the establishment, exercise, or defense of legal claims, in which case the data is moved to a restricted-access store and the retention period for that data is documented.

9. The Safety Flow

The Service includes a Crisis Flow designed to support users who appear to be in distress. This section explains how it works because it materially affects what we do with your information.

9.1 Detection

Our AI continuously evaluates the content of your conversations, group posts, and peer chats for indicators of crisis (e.g., expressions of suicidal ideation, intent to harm, or acute danger). This evaluation happens automatically. If a trigger fires, the app surfaces a Red Flag Question and, depending on your response, may show the SOS Module — a full-screen view with safety options.

9.2 Geo-detected hotlines

If you choose to “Call a hotline,” the app uses your device’s coarse location (country and, where relevant, region) to identify an appropriate national or regional crisis line. We do not store this coarse-location lookup beyond the duration of the lookup itself. We do not connect the call ourselves; tapping the option opens your device’s dialer.

9.3 Trusted contact

You may, conversationally with Aurè, choose to designate a trusted contact (typically a friend or family member). This person’s name and contact details (phone or email) are stored encrypted at rest and used only if you trigger the “Reach Trusted Contact” option from the SOS Module. We do not contact this person without your action.

9.4 What we don’t do

• We do not transmit your conversations to crisis hotlines or law enforcement automatically. • We do not retain a long-term “risk score” file on you. • We do not share crisis-flow data with insurers, employers, government agencies (other than in response to lawful legal process), or any commercial third party.

9.5 Limits of the Safety Flow

The Crisis Flow is not an emergency response system. It is a set of in-app affordances to help you find appropriate human resources. If you are in immediate danger, please contact local emergency services.

10. Security

We apply administrative, physical, and technical safeguards designed to protect your information, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256 or equivalent)
• Pseudonymization of conversational content from operational systems where feasible • Strict role-based access controls; access to user content by Aure staff is limited to a small number of authorized personnel and is logged • Annual third-party security review and regular vulnerability scanning [TO BE CONFIRMED — implement before scale] • Incident response plan; in the event of a personal data breach, we will notify affected users and the relevant supervisory authorities within the timeframes required by applicable law (typically 72 hours for GDPR notifiable breaches)

No system is perfectly secure. We commit to working honestly with you and with regulators if something goes wrong.

11. Children

The Service is intended for users 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you are under 18, please do not use the Service. If we become aware that we have collected personal information from someone under 18, we will delete it without delay. Parents or guardians who believe their child has provided us with personal information may contact us at info@aurelife.com.

This age requirement is stricter than the legal minimum in many jurisdictions because the nature of the Service — emotional content surrounding adult intimate relationships — is not appropriate for minors.

12. Your rights and choices

You have rights over your personal information. The specific rights available to you depend on your region; the bulk of them apply globally because we have chosen to extend GDPR-style rights to all users regardless of location.

12.1 Rights available globally

• a. Access — get a copy of the information we hold about you. Available in-app under Settings → Privacy → Download my data.
• b. Rectification — correct inaccurate information. Available in-app under Settings → Profile.
• c. Deletion — delete your account and associated personal information. Available in-app under Settings → Privacy → Delete account. Deletion is final and the Service will not retain a backup of your account beyond the periods stated in Section 8.
• d. Portability — receive a copy of the data you have given us in a structured, commonly used, machine-readable format. Available alongside Download my data.
• e. Withdraw consent — withdraw any consent you have given (including for processing of special category data) at any time. Available in Settings → Privacy → Consents.
• f. Object — object to processing based on legitimate interests. Contact info@aurelife.com explaining the basis of your objection; we will respond within 30 days.
• g. Complain to a supervisory authority — if you believe we have not handled your information appropriately, you may complain to your local data protection regulator. We would, however, appreciate the chance to address the issue first.

12.2 California (CCPA / CPRA) — additional rights

If you are a California resident, you have:

• The right to know the categories and specific pieces of personal information we have collected, the sources, the purposes of collection, and the categories of third parties with whom we share it. • The right to correct inaccurate personal information. • The right to delete personal information. • The right to opt out of “sale” or “sharing” of personal information (note: we do not sell or share personal information as those terms are defined under California law, but you have this right available regardless). • The right to limit the use and disclosure of sensitive personal information to what is strictly necessary to deliver the Service. Aure’s onboarding data and conversational content qualify as sensitive personal information; we already limit its use to the purposes described in this Policy, and you can confirm or further restrict this in Settings → Privacy. • The right to non-discrimination for exercising your privacy rights.

To exercise any of these rights, use the in-app controls or contact info@aurelife.com. We do not require an account to make a verifiable request, but we will need to verify your identity to a reasonable degree of certainty before acting on a request involving sensitive information.

12.3 European Union, United Kingdom, and Switzerland — additional rights

In addition to the rights in Section 12.1, you have the right to restrict processing in certain circumstances (e.g., while we verify the accuracy of contested data) and the right to lodge a complaint with the data protection authority in your country of residence.

You can find your local supervisory authority via the European Data Protection Board (EDPB) website or, for the UK, the Information Commissioner’s Office (ICO).

12.4 Brazil (LGPD) — additional rights

Under LGPD, in addition to the rights in Section 12.1, you have the right to: - Confirmation of the existence of processing - Anonymization, blocking, or elimination of unnecessary or excessive data - Information about the public and private entities with which we share data - Information about the possibility of refusing consent and the consequences of doing so - Revocation of consent at any time

The Brazilian National Data Protection Authority (ANPD) is the supervisory authority for LGPD complaints.

12.5 Other jurisdictions

We extend the substance of the rights in Section 12.1 to all users globally. If a specific right is required under your local law and is not addressed above, please contact us at info@aurelife.com and we will work with you to honor it.

12.6 Response times

We respond to verifiable rights requests within 30 days (extendable to 60 days for complex requests, with notification). California requires response to verifiable consumer requests within 45 days. There is no fee for the first request in any 12-month period; we may charge a reasonable fee for repeated or manifestly unfounded requests.

13. Cookies and similar technologies

The Service is primarily a mobile application and does not use traditional web cookies. Within the app, we use device-level identifiers and local storage to operate features and remember your preferences.

If you visit our website at aurelife.com, we use a minimal set of strictly necessary cookies (for the site to function) and, with your consent, anonymized analytics cookies. We do not use advertising cookies or third-party tracking pixels. Our cookie policy is available at aurelife.com/cookies.

14. Do Not Track

Our website does not respond to “Do Not Track” browser signals at this time. We do not engage in cross-context behavioral tracking that would be affected by such signals.

15. Automated decision-making

The AI assistant, Aurè, generates personalized responses and the AI system infers your current phase (Survival, Stabilization, Coaching). These are not decisions with legal or similarly significant effects within the meaning of GDPR Art. 22. Phase inference affects which content and group options the Service shows you; it does not affect your legal rights, your access to essential services outside the Service, or your eligibility for anything other than features of the Service itself.

If you disagree with how the system has classified your phase, you can: - Continue using the Service regardless (no phase is gated by a hard wall) - Request that a human review the classification by contacting info@aurelife.com - Provide feedback within the app

16. Geographic availability

The Service is currently offered in the following jurisdictions: [LIST TO BE CONFIRMED — RECOMMENDED LAUNCH SET: United States, Canada, United Kingdom, European Economic Area, Switzerland, Brazil, Mexico, Argentina, Chile, Colombia, Australia, New Zealand, and selected Asian markets pending review.]

The Service is not currently available in: the Russian Federation, the People’s Republic of China, the Islamic Republic of Iran, the Democratic People’s Republic of Korea, the Republic of Cuba, the Syrian Arab Republic, and any other jurisdiction where local law makes offering the Service impracticable or where we are subject to applicable sanctions.

If you access the Service from an unsupported jurisdiction, you do so at your own risk and we may suspend your account.

17. Region-specific addenda

For users in California, the European Union, the United Kingdom, Brazil, and Canada (specifically Quebec under Law 25), region-specific addenda are available at aurelife.com/privacy/regional. These addenda do not reduce the protections in this Policy; they describe the application of local laws and provide local contact details.

18. EU/UK representative; data protection officer

EU Representative under GDPR Art. 27: [TO BE APPOINTED]. We are required to designate a representative in the European Union because we offer services to data subjects in the EEA. The representative’s contact details will be added to this Policy before launch in the EEA.

UK Representative under UK GDPR Art. 27: [TO BE APPOINTED]. Same requirement as for the EU, applied separately following Brexit.

Brazil Data Protection Officer (Encarregado de Dados) under LGPD: [TO BE APPOINTED OR CONFIRMED THAT NOT REQUIRED FOR OUR SIZE].

EU/UK Data Protection Officer: Aure is not currently required to appoint a DPO under GDPR Art. 37, but given the sensitivity of the data we process we may voluntarily appoint one. Contact info@aurelife.com.

19. Changes to this Policy

We may update this Policy from time to time. If we make material changes — changes that affect your rights, the categories of data we collect, the purposes for which we process data, or the parties with whom we share data — we will notify you in-app at least 30 days before the changes take effect and, where required by law, obtain your renewed consent.

Non-material changes (e.g., corrections of typos, updates to contact information, clarifications that do not affect your rights) may be made without advance notice. The

“Last updated” date at the top of this Policy will always reflect the most recent revision.

A historical archive of previous versions is available at aurelife.com/privacy/archive.

20. How to contact us

For any question, request, or concern about this Policy or your personal information:

• Email: info@aurelife.com • Postal mail: Aure LLC, Attn: Privacy Officer, 9349 Collins Avenue, Unit #705, Surfside, Florida 33154, United States • In the EU/EEA: [REPRESENTATIVE CONTACT — TBA] • In the UK: [REPRESENTATIVE CONTACT — TBA] • In Brazil: [DPO/ENCARREGADO CONTACT — TBA]

We aim to respond to all privacy inquiries within 7 business days and to all formal rights requests within the statutory periods set out in Section 12.6.

This Privacy Policy is a draft prepared for review by qualified legal counsel. It is not legal advice. Aure LLC strongly recommends review and customization by an attorney licensed in the State of Florida with experience in international data protection (in particular GDPR, UK GDPR, CCPA/CPRA, and LGPD) before publication.