Privacy Policy

This Policy applies to:

• Consumers and end users
• Merchants and suppliers
• Visitors to our websites or applications

It covers personal data collected:

• Directly from you
• Automatically via device or system logs
• Through your use of Aulax ordering and collection features, such as QR-based ordering and Order Code verification

Aulax follows data minimisation, collecting only data necessary for a secure, high-quality, and personalised service.

2.1 Information You Provide Directly

• Identity: Full name and date of birth (for age verification — 18 and over — and account security).
• Contact: Verified email and mobile phone number. You are responsible for maintaining accurate contact information to receive secure PINs / OTPs.
• Verification: PINs or One-Time Passwords (OTPs) sent via SMS or email.
• Billing: Billing address and payment tokens. Full card numbers are not stored.
• Content and Feedback: Reviews, ratings, and experience feedback. Public content may be moderated in accordance with platform policies.

2.2 Transaction and Interaction Data

• Purchase history, digital receipts, and reward activity.
• Order Interaction: Data from your interactions with Aulax ordering and collection features — for example, QR scans and Order Code verification — used to ensure orders are processed and collected accurately.

2.3 Technical, Device, and Location Data

• IP address, device ID, app diagnostics, and crash logs.
• Real-time Location: GPS and proximity data collected only with your explicit consent, for discovery, navigation, and service optimisation.

• Core Services: Order and collection facilitation and identity authentication via PINs / OTPs. A convenience or service fee may be applied per transaction; any such fee is clearly disclosed to you before you complete the transaction.
• Social Commerce and Feedback: Displaying user feedback and experience reviews. Anonymised and aggregated datasets are owned by Antive Ltd and may be shared with third parties for analytics and service optimisation.
• Security and Integrity: Fraud detection and prevention, bot detection, and account integrity checks.
• Marketing: Updates, offers, and notifications. “Soft opt-in” communications may be sent to existing users for related Aulax services; opt-out is available at any time.
• Legal Compliance: Age verification and tax reporting.

• Contractual Necessity: To provide requested services.
• Legitimate Interests: Security, fraud prevention, service improvement, and aggregated feedback.
• Legal Obligation: Tax, AML, and age-verification compliance.
• Explicit Consent: For location tracking and marketing communications. Consent may be withdrawn at any time without affecting prior lawful processing.

• Merchants: Limited to name, Order Code, and age status. Merchants act as independent Data Controllers; Aulax is not liable for their independent use of this data.
• Infrastructure Partners: PCI-DSS payment processors and secure cloud providers under strict GDPR contracts.
• Third-Party Links: The Service may link to external websites. We are not responsible for their privacy practices.
• Legal Authorities: Where required under UK law.

Security Measures

TLS encryption, multi-factor authentication (MFA), role-based access controls, and regular security audits. While we apply industry-standard protections, no digital system can guarantee absolute security.

Account Deletion

When you delete your account, we remove or anonymise the personal data that identifies you. Some records are kept where the law requires — for example, transaction records retained for tax purposes — or in an anonymised form that no longer identifies you.

Retention Periods

• Financial records: 6 years (for tax purposes)
• Account data: for the duration of your account, then deleted or anonymised on closure
• Security logs: retained as needed for investigations

Under UK GDPR, you may:

• Access, rectify, or erase your personal data
• Object to or restrict processing
• Request data portability
• Request human review of automated decisions
• Withdraw consent at any time

You can delete your account at any time from within the Aulax app.

To exercise your rights, email hello@aulax.app with “Data Protection Request” in the subject line. You may also lodge a complaint with the UK Information Commissioner’s Office (ICO).

We monitor suspicious behaviour to prevent fraud, misuse, or violations of platform policies.

Accounts may be suspended or restricted without prior notice in high-risk scenarios.

Relevant data may be shared with authorities to protect the integrity of the Service.

The Service is intended for adults aged 18 and over.

We do not knowingly collect personal data from anyone under 18; if identified, such data is promptly deleted.