AURA VISTA PRIVACY POLICY v1
Aura Vista LLC · 1088 NE 7th Ave, Apt 425, Portland, OR 97232 · effective 2026-11-03
This policy explains what we collect, why, who we share it with, and what happens when you delete your account. It applies to auravista.world.
1. The information we collect
Your account. Email address, sign-in method (email or Google), and the settings you choose. Your email is verified before use.
Your profile. What you choose to show: display name, pronouns (up to 40 characters), bio (up to 600 characters), photo, and, if you sell, your practice details, offerings, availability, and verification applications (training background, referral contacts, your written statement).
Identity tags you choose to share. See Section 2, this is its own subject.
Transactions. What you buy or sell, order contents and delivery address, payments and payouts, refunds, disputes, and tax details collected through Stripe for sellers (W-9/W-8, banking).
Communications. Messages between you and sellers or community members, support conversations (including as a guest, keyed by your email), reviews you write, community posts, and session chat.
Session records. For 1:1 video sessions: booking details, session timing, and, only if both participants accept, a text transcript. See Section 3.
Practitioner client records. If you're a practitioner, you may keep records of your off-platform work, a client's name, contact details, what was booked, and your own private notes. These are your business records; see Section 5.
Technical records. Security logs, webhook and delivery logs (including email delivery status and bounce records), and per-profile view counts that carry no information about the viewer at all, we don't record who viewed a profile, and we exclude bots and the profile's own team.
We do not run advertising trackers, and we don't sell personal data. Ever.
2. Identity tags (special-category information)
You may optionally add tags to your practitioner profile describing aspects of your identity, faith background, disability, neurodivergence, sexuality, and similar, so that people seeking a practitioner like you can find you.
- These are entirely optional and self-disclosed. We never infer them, never buy them, and there is no step where you must disclose them to use Aura Vista.
- Each tag requires your explicit consent, recorded against the exact version of the notice you accepted. Your consent history is kept (append-only) so we can always show what you agreed to and when.
- We use them only to display them on your profile and, where filtering exists, to include you in results when someone searches for them, never to exclude you from anything, rank you, or market to you.
- We do not verify identity tags. There is no ethical way for us to verify most of them, and we don't try.
- You can add or withdraw any tag anytime; withdrawal removes it from your public profile.
- Because this is sensitive information, we treat it with the strictest handling in this policy.
3. Video sessions and transcripts
1:1 sessions run on video infrastructure from Daily.co. When both participants accept, a text transcript of the conversation is created, never an audio or video recording. Transcripts are kept 30 days and then automatically deleted; either participant can stop transcription at any time. Transcripts are readable only through the platform, by the session's participants, through expiring access links; Aura Vista staff do not read transcripts except to investigate a specific report or legal requirement. Sessions and their records are not HIPAA-protected communication, and no clinical confidentiality or privilege applies to them (see the Terms of Service for what this means practically).
4. Who we share data with
Only the providers needed to run the platform, under their own confidentiality commitments:
- Stripe, payments, payouts, seller onboarding, tax forms, disputes.
- EasyPost and carriers (USPS), shipping rates, labels, and tracking; the carrier receives the recipient's name, address, and phone as needed to deliver.
- Daily.co, video session rooms and text transcripts (their storage; 30-day deletion per above).
- Supabase, our database, authentication, and file storage.
- Resend, transactional email delivery (not marketing; we don't send bulk email). If an address hard-bounces or marks email as spam, we suppress it.
- Vercel, application hosting.
- Google, if you connect Google Calendar (in progress), per the authorization you grant at the time; calendar data is used only to manage your availability and is not shared with other users beyond what you publish.
- Legal. Where law requires, or to protect someone's safety, our rights, or to respond to valid legal process; and in connection with a sale of the company, with notice.
We don't share your data with anyone else without your permission.
5. Practitioners' client records
If you work with a practitioner who records your off-platform bookings on Aura Vista, they are the keeper of those records, including their private notes. If you delete your account, those records are anonymized and retained rather than deleted, so the practitioner's business records remain lawful and intact; they can no longer be linked back to your account. Practitioners must handle client records lawfully and use contact details only for the work they were given for.
6. How long we keep things
- Transcripts: 30 days, automatic.
- Email delivery logs: while your account is active, then 12 months.
- Security, transaction, and tax records: as long as tax, fraud, and legal-compliance rules require (typically several years for tax).
- Everything else profile- or content-related: deleted or anonymized when you delete your account (Section 7), or when you remove the item yourself.
- Suppressed email addresses: kept as a suppression record so we honor a bounce or spam complaint permanently.
7. Deleting your account
You can delete your account yourself from account settings (you'll confirm by typing your email). We refuse the deletion while you manage a practice or are a platform administrator, detach or hand over first, then it goes through. When it runs: your profile, interests, notifications, course progress, community memberships, chats and DMs, reviews, and certificates are deleted. Community posts and conversations you took part in are de-authored but keep their shape for the people you talked with. Photos are removed from storage. Transactions and practitioner client records survive anonymized as business records. This processing is immediate for your own data; backup copies are overwritten on the normal backup cycle.
8. Your rights
You can access, correct, and delete most of your data yourself, in the product, at any time. You can also ask us for a copy of your personal data, ask what we hold about you, object to a use of it, or withdraw a consent (like an identity tag), write to us at the address above. We respond within a reasonable time, and never sell your data or require more data than the feature needs. If you're in the EU/EEA or UK, you additionally have the right to lodge a complaint with your supervisory authority.
9. Security and breaches
Data is stored with Supabase under encrypted connections; access inside Aura Vista is role-restricted and every staff action on an account is logged. Payment card data never touches our systems, it goes straight to Stripe. If a breach affects you, we'll tell you what happened and what we did about it, within the time the law requires.
10. Children
Aura Vista is not for people under 18, and we don't knowingly collect data from anyone under 18. If you believe a minor has an account, tell us and we'll remove it.
11. Changes
We'll announce material changes by email and in the app before they take effect, and this policy's effective date will change. The version you saw when you last consented stays available.
12. Contact
Questions, requests, or complaints: Aura Vista LLC, 1088 NE 7th Ave, Apt 425, Portland, OR 97232, or through our contact page.