1. Who handles your information
The operator listed below is responsible for personal information used to manage AURA accounts, subscriptions, support and platform security. This notice covers the AURA service.
Merchants control how their own customers place orders and how they fulfil them. AURA also processes shop and order information to provide the platform for merchants. Contact the shop first about its sale or use of your data; contact AURA about platform handling or if help is needed to route a request.
2. What we collect and where it comes from
Information comes from you, merchants using the service, your browser and connected providers when a feature is used.
- Account and contact details: name, email, optional WhatsApp number, password hash and account security records.
- Shop content: product information, images, settings, imported catalogue data and connected domain details.
- Order and billing records: customer name, contact details, delivery address, items, payment status, invoice references and subscription history.
- Technical and support data: IP address, browser information, security logs, error details, support messages and optional analytics or advertising identifiers when permitted.
- AI inputs and replies when an AI feature is used. Payment details entered on a payment provider page are handled under that provider’s notice.
3. Why information is needed
We use relevant information to create and secure accounts, build and host shops, process orders and subscriptions, provide support, investigate misuse and meet legal obligations. Optional analytics and advertising use the choices described in our Cookies policy.
Required fields are marked in the relevant form. Without necessary account, delivery or billing details, we may be unable to provide that feature or complete a transaction. An optional WhatsApp number is not required to create an account.
4. Who may receive information
Relevant information may be shared with the merchant handling an order and providers needed for hosting, storage, email, payments, shipping, catalogue import, AI or support. The recipients depend on the integrations used.
Examples supported by the application include Billplz for payments, EasyParcel and Pos Malaysia for shipping, configured AI or import providers, and Google, Meta or TikTok for tracking when enabled and permitted. Listing an integration does not mean it is active on every shop.
Information may also be disclosed where legally required or needed to investigate fraud or protect rights. Marketing communications require the appropriate permission; an account or support request alone is not permission for unrelated promotions.
5. Overseas processing
Connected services may process information outside Malaysia. The destination depends on the chosen provider and its infrastructure. Contact the privacy team for details of the providers and locations relevant to your service.
Before production use, the operator must confirm the applicable transfer basis, provider safeguards and any consent needed. Merchants must review these arrangements before connecting services that receive their customers’ data.
6. Storage, retention and security
Access controls, password hashing and available account security features help protect information. No online system can eliminate every risk. Report suspected unauthorised access promptly without sending passwords or payment secrets.
Records are kept for service delivery, dispute handling, security and applicable legal or accounting requirements, then should be deleted or anonymised when no longer needed. Temporary import records and browser storage have different lifetimes. An expired preview link does not by itself delete a stored draft.
A final retention schedule and backup deletion process must be confirmed by the operator before this draft is adopted. Cancelling renewal does not automatically erase account, shop or billing records.
7. Your choices and requests
You may request access to or correction of personal information, withdraw consent where relevant, ask to stop direct marketing, or request deletion or portability where applicable. Some records may need to be retained, and withdrawal can affect a feature that needs the information.
Contact the privacy address below with the account email and a description of your request. We may need proportionate identity verification. Do not send identity documents until a secure method is agreed. Requests should be handled within applicable legal periods, with any refusal or limitation explained.
You may raise a data protection concern with Malaysia’s Personal Data Protection Commissioner through the official website, www.pdp.gov.my.
8. Updates and contact
Review this notice when it is updated. Material changes should be communicated through an appropriate service channel. This notice is available in English and Bahasa Melayu; contact us if anything is unclear. Use the privacy contact listed below for requests about your information.
Service provider details
- Operator
- AURA Shop Demo (sample operator)
- Business registration
- DEMO: not a registered SSM number
- Business address
- Sample business address, Kuala Lumpur, Malaysia
- Support email
- support@example.com
- Privacy contact
- privacy@example.com
