Privacy

Who we are

Aurore is an employee-engagement product for companies. It covers surveys, results, 1:1s, performance reviews, praise and feedback, time off, imports, and an audit log. The app is at app.getaurore.com. This website is getaurore.com.

Aurore is operated by Sebastian Sanio, in Montreal, Quebec, Canada. In this policy, “Aurore”, “we”, and “us” mean Sebastian Sanio. “Customer” means the company that opens an account. “Employee” means a person whose information the customer puts into the account, including admins.

Questions about privacy go to hello@getaurore.com.

Controller and processor

The customer decides why employee information is used. For that information, the customer is the controller under the GDPR and similar laws, and the organization responsible for the personal information under PIPEDA and Quebec’s Law 25. Aurore is the processor, and the service provider. We handle that information on the customer’s instructions, to provide the product.

We are the controller for information we collect for our own purposes: admin account details, billing contacts, security records of our own systems, and messages sent to us from this website or to hello@getaurore.com.

A data processing agreement for the processor role is available on request. Until a customer signs it, this policy and the terms describe the same split of roles.

Information we collect

We collect what the product needs to run the customer’s account. We do not sell personal information. We do not ask for payment card numbers in the product.

• Account data. Name, work email, company name, role, language, and the identifiers our sign-in service uses. We also keep the fact that an account was created and when someone signs in.
• Employee directory. Name, work email, role, team, manager, and any other field the customer enters or imports.
• Survey responses. Answers and comments. They are stored without a link to the person who sent them.
• 1:1s. The two participants, the date, the agenda, shared notes, and action items.
• Reviews. The cycle, the self review, and the manager review.
• Praise and feedback. Praise the company can see, private feedback, and a request for a colleague’s view.
• Time off. Types, yearly allowances, requests, decisions, and who is out.
• Audit log. Who changed people, settings, surveys, reviews, and time off, and when. The log does not keep survey answers, 1:1 notes, or private writing.
• Messages. What you send to hello@getaurore.com, including a request for a demo.

Survey anonymity

Survey links are single use. The response is not stored against a person, and a result is not a list of who said what.

Scores and comments stay hidden unless the group is large enough. The minimum is 5. A customer can set it higher. It cannot be set lower. A group under the line shows nothing, not a rounded hint.

This is a control in the product. It is not a promise that a comment in a very small company can never be guessed from its wording. Customers should not ask a question that only one person can answer.

1:1s, reviews, praise, private feedback, and time off are not anonymous. Each is shown only to the people the product allows: the two people in a 1:1, the people in a review, the company for public praise, the sender and the recipient for private feedback unless the sender shares it, and the people who handle a time-off request.

Purposes and legal bases

Employee information is used to run surveys, results, 1:1s, reviews, praise, feedback, time off, imports, and the audit log. The customer chooses those purposes. Where the GDPR applies to us as processor, our basis is the contract with the customer. The customer’s basis for its employees is the customer’s to set. It is often the employment relationship or a legitimate interest in running the team. Where a law requires consent, the customer is the one who must obtain it.

We create the company account, send a verification code, and keep the session so the customer can sign in. The basis is the contract. We use security logs to protect the service, investigate incidents, and keep one customer’s data apart from another’s. The basis is legitimate interests, and a legal duty where the law imposes one.

We read and reply to mail sent to hello@getaurore.com. The basis is legitimate interests, and steps before a contract when someone is asking to become a customer.

The price of the service is $3 USD per employee per month. When billing starts, we will use the account and the employee count to invoice the customer. The basis is the contract, and a legal duty to keep tax records.

We may use aggregated counts that do not identify a person, such as the fact that a survey was submitted, to keep the service reliable. We do not use employee content to advertise, and we do not use it to train models for other customers.

We may later offer optional features that call Amazon Bedrock. They do not process customer content today. If we offer them, the customer will choose to turn them on, and we will describe them in the product first. We will not permit customer content sent to those features to be used to train foundation models for anyone else.

A new purpose that the customer did not expect needs a new notice, and consent where the law requires it, before we rely on it.

Subprocessors

We use Amazon Web Services, Inc. to host Aurore. The data sits in the us-east-1 region, in the United States. AWS acts on our instructions and only to provide the infrastructure. We do not authorize AWS to use customer content for its own marketing.

We will update this list before a new subprocessor starts handling customer content, and we will tell account owners when the change is material. The data processing agreement, available on request, is where that notice is also made.

• Amazon Cognito, for sign-in and account authentication.
• Amazon SES, for transactional email such as verification codes.
• Amazon DynamoDB, for application data.
• Amazon S3, for files such as CSV imports, and for this website.
• Amazon CloudFront, for delivery of the app and this website.
• Amazon Bedrock, reserved for future AI features. It does not receive customer content today.

International transfers

Sebastian Sanio operates Aurore from Montreal, Quebec, Canada. The service is hosted in the United States, in AWS us-east-1. Personal information is stored there, including when the customer or the employee is in Canada, the EEA, the United Kingdom, Switzerland, or elsewhere.

We transfer information to the United States because that is where the product runs. The safeguards are the contract with AWS, encryption in transit and at rest, and access limited to operating the service.

Where the GDPR applies, the transfer tool we offer the customer is the European Commission’s standard contractual clauses, in the module that matches the role: processor for employee data, controller for account data we control. A copy is part of the data processing agreement, which is available on request. Customers in the EEA, the United Kingdom, or Switzerland should ask for that agreement before loading employee data, so the clauses are in place for their account.

Under Quebec’s Law 25, a transfer outside Quebec has to be assessed and protected. The destination is the United States, and the reason is hosting. The contract with AWS and the technical measures above are the protection. A customer who wants that assessment in writing can ask at hello@getaurore.com. Under PIPEDA, we remain accountable for information handled by a service provider, including one outside Canada.

Retention and deletion

We keep customer content while the account is open, because the customer has asked us to run the product with it.

When the customer deletes a record, or closes the account, we delete the live copy within 30 days. We will not stretch that period without a legal reason. Encrypted backups are overwritten on their ordinary cycle. We do not restore deleted customer content into an account, except when we are recovering the service from an incident and a backup still holds it.

Survey responses are deleted with the survey or with the account. They are not kept as a profile of a person. The audit log is kept for the life of the account and deleted with it.

We keep invoices and related tax records for as long as Canadian tax law requires. Those records name the customer. They do not contain survey answers, 1:1 notes, or private feedback. Messages to hello@getaurore.com are kept long enough to answer and to keep a short record of what was agreed, then deleted, unless we need them for a dispute.

Security

We protect the service with measures that fit a hosted people product. No host is immune to incidents. These measures reduce the risk. They are not a certification, and this draft does not claim a SOC report or a formal penetration-test program.

The customer protects its own admin access. A shared password, or a departed admin who still has a role, is the customer’s to fix.

• HTTPS for the app and this website.
• Encryption at rest in the AWS services that store the data.
• Sign-in through Amazon Cognito, with a verification code at signup.
• Separation between companies, so one account does not read another’s data.
• Single-use survey links, responses stored without a person attached, and a minimum group size of 5.
• 1:1 notes limited to the two participants. An admin role does not open them.
• An audit log of administrative changes.
• Access to the production environment limited to what it takes to operate Aurore.

Your rights

Which rights apply depends on where the person is, and on who the controller is. Employees should start with their employer, because the employer decides the employee data. We help the customer respond. A person can also write to hello@getaurore.com. We will pass the request on, or answer it when we are the controller. We may need to confirm who is asking before we act.

PIPEDA. You can ask for access to personal information we hold about you, ask for a correction, and challenge our compliance. You can withdraw consent where consent is the basis. We may then be unable to provide the account. You may complain to the Office of the Privacy Commissioner of Canada.

Quebec’s Law 25. You can ask for access and rectification. Where the law provides it, you can ask us to stop disseminating information, or to de-index it. You can withdraw consent for a purpose that needed it. We answer within 30 days, or we tell you why we need longer when the law allows a delay. You may complain to the Commission d’accès à l’information du Québec. The person in charge of protection of personal information is named below.

GDPR and UK GDPR. You can ask for access, rectification, erasure, restriction, and portability, and you can object to processing based on legitimate interests. You can complain to a supervisory authority. You can withdraw consent where we rely on it. We do not make a decision that produces legal effects about a person by automated means alone. A future AI feature, if the customer turns it on, would assist the customer. It would not hire, fire, or score a person by itself.

CCPA and CPRA, for California. You can ask to know, delete, and correct personal information, and you can opt out of sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics. We will not discriminate against you for exercising these rights. An authorized agent may submit a request with proof of authority.

Some information cannot be tied back to a person. An anonymous survey answer is one example. Where we cannot tell whose response it was, there is nothing to return as that person’s response.

Cookies

We do not use analytics cookies, advertising cookies, or other cookies that are not strictly necessary. This website does not set a tracking cookie. The app keeps the sign-in session and the language you choose in storage on your device, because the product cannot sign you in or remember that choice without it.

If we add analytics, or any storage that is not strictly necessary, we will update this policy first. Where the law requires us to ask, we will ask before that storage is set.

Children

Aurore is a workplace product. It is not directed at children. Customers must not use it to collect information about anyone under 16. If we learn that we hold information about a child, we will delete it.

Breach notification

If we become aware of a breach of security safeguards involving personal information, we act on the role we have.

As processor, we notify the customer without undue delay. The notice says what we know about what happened, the kind of information involved, and what we are doing about it. The customer then meets its own duties to people and to authorities.

As controller, for account and website information we control, we notify the affected people and the authorities when the law requires it. Under PIPEDA, that is when there is a real risk of significant harm. Under Quebec’s Law 25, that is when there is a risk of serious injury, and the notice goes to the Commission d’accès à l’information and to the people concerned. Where the GDPR applies to us as controller, we notify the supervisory authority within 72 hours of becoming aware of a breach that requires notice, unless the law provides an exception.

Privacy officer

Quebec’s Law 25 requires a person in charge of the protection of personal information. That person is Sebastian Sanio. The same person is accountable under PIPEDA. Write to hello@getaurore.com with the subject “Privacy”. Sebastian Sanio is in Montreal, Quebec, Canada. We do not offer a postal channel.

Changes

We post changes on this page and we change the “Last updated” date. That date is the effective date of the version you are reading.

If a change is material for account data we control, we will also email the account owner, or show a notice in the app, before the change takes effect. For employee data, the customer’s instructions and any signed data processing agreement govern. A change to this policy does not silently widen what we do with employee content.

Contact

Sebastian Sanio, Montreal, Quebec, Canada. hello@getaurore.com. The privacy officer is Sebastian Sanio, at the same address.

You can also contact the Commission d’accès à l’information du Québec, the Office of the Privacy Commissioner of Canada, or, where the GDPR applies, your local supervisory authority.