Privacy Policy
Aura Business · Last updated: October 5, 2026
Aura Hub ("we", "our" or "us") makes Aura Business (the "App"), a bookkeeping assistant for small businesses: invoices, expenses, money received, and Fern, an assistant you can type or talk to. This policy explains what data the App handles, where it goes, and the choices you have.
Business records are sensitive, so here are the parts most people want to know first:
- Your books live on your phone. Without an account, nothing about your business leaves your phone, apart from what you choose to share yourself (§ 5).
- With Pro, an encrypted copy is kept on our servers. Records are encrypted on your phone before upload. We hold a recovery key, so this is "encrypted at rest", not end-to-end encryption: we could decrypt your records, and we say so plainly (§ 6).
- When you're signed in, Fern's understanding goes online. Your messages to Fern, and with a question a summary of your books, are sent to OpenAI (or Google's Gemini as a back-up) to work out what you meant. Neither trains on them. You can switch this off (§ 4).
1. Who we are
Aura Hub is an independent software company based in Lagos, Nigeria, and is the data controller for the personal data described here, except where § 9 says we act for you. We are subject to the Nigeria Data Protection Act 2023 and regulated by the Nigeria Data Protection Commission.
The rights in § 11 are given to everyone who uses Aura Business, wherever they live.
- Email: support@aurabusiness.app
- Website: https://aurahub.com.ng/aurabusiness
2. Age
Aura Business is for people aged 18 and over who run or help run a business. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has an account, email support@aurabusiness.app and we will delete it.
3. What data the App handles
On your phone (always)
Everything you put into the App is stored on your phone:
| Data | What it is |
|---|---|
| Your business details | Name, logo, contact details, and the payment details you put on invoices |
| Customers and suppliers | Names, business names, and any phone numbers, emails or addresses you add |
| Your books | Invoices, payments, expenses, bills, items and prices, item pictures, quick-invoice presets, invoice designs |
| Fern | Your chat with Fern, her notes and reminders, your learned category rules, and the Activity history |
| Bank feed (if you turn it on) | Bank alerts found in your text messages, and bank statements (CSV) you import, kept as suggestions for you to review |
On our servers, only if you sign in
| Data | Why |
|---|---|
| Email address and password (or your Google account's email and name, if you sign in with Google) | To create and secure your account. Passwords are handled by our sign-in provider and stored only as a hash |
| Display name | Shown in your account |
| Your business's currency, membership role, and an anonymous business ID | To run the account and link your phones |
| Subscription status (plan, trial and renewal dates, store) | To know whether Pro is active |
| How many online questions you used this month | To apply the monthly allowance |
| With Pro: your records and pictures, encrypted on your phone | To keep a copy of your books and sync them between phones (§ 6) |
| With Pro and WhatsApp linked: your WhatsApp number and the messages you send to Aura's WhatsApp number | So messages you send there reach Fern (§ 7) |
Alongside the encrypted records, our servers see their type (invoice, payment and so on), an ID, the time they changed and which phone changed them. They don't see what's inside.
Not collected
We do not use advertising, analytics or crash-reporting services. We do not collect your location or your phone's contacts list. We do not receive your voice recordings (§ 5).
4. Fern's understanding online
When you're signed in and Fern's understanding online is on (Fern's profile; it's on unless you switch it off), messages about your books go through our server to OpenAI's API, so Fern can work out what you meant and answer harder questions. If OpenAI doesn't answer, Google's Gemini API gets the same request.
What is sent:
- the words of your message, your last few messages in the conversation, Fern's instructions, today's date, your currency and up to six customer names;
- with a question, a summary of your books, written on your phone: totals by period and month, who owes what, customers' totals (names only, never their phone numbers or emails), bills, spending, items sold, what needs doing today, your open notes and reminders, and your latest 40 money records.
Notes, undo and small talk stay on your phone. Neither OpenAI nor Google (on the paid service we use) trains its models on this data. OpenAI keeps API data for up to 30 days and Google for up to 55 days, to detect abuse; we ask OpenAI not to store the conversation beyond that. Our server passes the request on and does not store it.
Every figure in an answer is checked on your phone against your books before Fern shows it. Fern only ever drafts money records: nothing is saved until you tap Save.
To keep everything on your phone, switch off Fern's understanding online in Fern's profile, or don't sign in. Fern then uses her on-phone understanding only.
5. Other things that leave your phone
- Speech. When you talk to Fern, the App uses your phone's own speech recognition service (on most Android phones, Google's). Depending on your phone's settings, that service may process the audio on the phone or online, under its provider's terms. We never receive your voice. Fern's spoken voice is made on your phone.
- Fern's voice files. If you download Fern's voice, the files come from our file host (Cloudflare). They contain nothing about you.
- Sharing invoices. When you share an invoice, receipt or export, it goes to the app you pick (for example WhatsApp) and on to the people you send it to. That's your choice, and from then on it's governed by that app's terms. Exports (CSV and the JSON backup copy) are not encrypted.
- Bank alerts. If you turn on bank alerts, the App reads the text messages on your phone (the last 30 days on the first scan, then new ones) to find alerts from banks. Messages that aren't bank alerts are skipped and not saved. From each alert it keeps only the amount, date, description, the other party, the bank, the last digits of the account and the balance after. Text messages are never uploaded; with Pro, the bank-feed entries made from them join your encrypted copy.
- Purchases. Google Play handles payment; RevenueCat tells us your subscription status (§ 9).
6. The encrypted copy (Pro)
With Pro, your records and pictures are encrypted on your phone with AES-256-GCM, using a key that belongs to your business, before they're uploaded. On your phone, that key is protected by Android's hardware-backed Keystore.
Our server keeps the business key wrapped with a recovery key that we hold. That's what lets you sign in on a new phone, or recover after losing your password, and get your books back. It also means we could decrypt your records. We don't do so, except where you ask us to help with your account or the law requires it, but we won't describe this as end-to-end encryption, because it isn't.
If Pro ends, the books on your phone are untouched. For 30 days the App can still restore from your encrypted copy; it stops uploading changes. The copy stays on our servers until you delete your account (§ 12).
7. WhatsApp (Pro)
If you link a WhatsApp number to your business, messages you send from that number to Aura's WhatsApp number reach your chat with Fern, where anything about money becomes a draft for you to review. They travel through Meta's WhatsApp Business Platform. Our server receives each message as Meta delivers it, encrypts it with your business key straight away, and stores only the encrypted copy. We keep your linked number unencrypted, because we need it to know which business a message belongs to.
Fern does not reply to customers or send anything on WhatsApp for you. You can unlink a number at any time in the App.
8. How we use your data, and our legal basis
| What we do | Why | Lawful basis |
|---|---|---|
| Run your account, the encrypted copy and sync | To provide the App you signed up for | Contract |
| Fern's understanding online | It's how Fern understands you when you're signed in; you can switch it off | Contract, and your choice to keep it on |
| Bank alerts from your text messages | Only because you turned them on | Consent, withdrawn by turning them off |
| WhatsApp intake | Only because you linked a number | Consent, withdrawn by unlinking |
| Check your subscription | To sell and honour Pro | Contract |
| Rate limits, security and abuse prevention | To keep the service safe and working | Legitimate interests |
We don't make automated decisions about you that have legal or similarly significant effects, and we don't profile you.
9. Who we share data with
We share data only as needed to run the service. These providers act as our processors, handling data only on our instructions, except Google Play, which processes your payment as its own controller.
| Provider | Purpose | Data | Where |
|---|---|---|---|
| Supabase | Database, sign-in, encrypted file storage | Account data and the encrypted copy | EU (Ireland) |
| Railway | Runs our API server | Requests passing through, not stored | EU (Netherlands) |
| Cloudflare | Network delivery and protection for our API; hosts Fern's voice files | Requests passing through | Worldwide |
| OpenAI | Fern's understanding online | § 4 | United States |
| Google (Gemini API) | Back-up for Fern's understanding online | § 4 | United States |
| RevenueCat | Subscription status | Anonymous business ID, purchase records | United States |
| Google Play (its own controller) | Payment | Your Google account and payment | |
| Meta (WhatsApp) | Only if you link WhatsApp | Your messages to Aura's number | Meta |
| Resend | Account emails (sign-up confirmation, password reset) | Your email address | United States |
We do not sell your data, and we never use your books to train AI models.
10. Your customers' details
The names, phone numbers, emails and addresses of your customers and suppliers are data you collect for your business. You decide what to record and are responsible for having a lawful reason to keep it. Where that data is in your Pro encrypted copy, or in a request to Fern's understanding online, we and the providers above handle it on your behalf, only to provide the App to you. If one of your customers asks us about their data, we will refer them to you.
11. Your rights
These are given to everyone, wherever you live:
- Access: ask for a copy of the data we hold about you.
- Correction: ask us to correct inaccurate data. You can correct your own records in the App at any time.
- Deletion: delete your account and its data (§ 12).
- Portability: export your payments and expenses as CSV, or save a backup copy (JSON) of all your books, at any time, free. The backup copy refers to pictures by name and does not include the pictures themselves.
- Restriction and objection: ask us to pause or stop processing, including processing based on legitimate interests.
- Withdraw consent: turn off bank alerts, unlink WhatsApp, or switch off Fern's understanding online, at any time.
- Complain to a regulator: our supervisory authority is the Nigeria Data Protection Commission. If your country has its own data protection authority, you may be able to complain to them too. We'd rather you came to us first, but you don't have to.
Email support@aurabusiness.app to exercise any of these. We respond within one month and will tell you if a complex request needs longer.
12. Deleting your account
In the App: in Fern's chat, tap ⋮ → Settings → Account & sync → Delete account, then confirm.
This permanently deletes, from our servers: your sign-in account, your profile, your businesses and memberships, the encrypted copy of your records and pictures, your business keys, your subscription record, your linked WhatsApp numbers and your usage counts.
The books on your phone stay on your phone after you delete your account, so you don't lose them by accident. To remove them, use Settings → Erase everything on this phone, or uninstall the App.
Deleting your account does not cancel a Google Play subscription. Cancel it in Google Play first, or you'll keep being charged.
See the Data deletion page for every option, including deletion by email.
13. Retention
- Account and encrypted copy: kept while your account exists, deleted immediately when you delete the account in the App, or within 30 days of an emailed request.
- Fern's understanding online: not stored by us; kept by OpenAI for up to 30 days and by Google for up to 55 days for abuse monitoring.
- Server logs: our API logs record each request's method, path, status and timing, not its contents. Our hosting providers keep their own short-lived operational logs, which can include IP addresses.
- Payment records: Google Play and RevenueCat keep transaction records under their own policies. We may also need to keep basic transaction records for tax and accounting.
14. International transfers
Your account and encrypted copy are stored in the EU (Ireland), and our API runs in the EU (Netherlands). We work from Nigeria. OpenAI, Google, RevenueCat and Resend process data in the United States, and Cloudflare's network is worldwide. Under the Nigeria Data Protection Act, we rely on the data-processing terms each provider has agreed to, which bind them to process data only on our instructions and keep it secure. Email us to ask which terms apply to a provider.
15. Security
- Records and pictures in the encrypted copy are encrypted on your phone with AES-256-GCM before upload.
- Your sign-in session and keys on the phone are sealed with Android's Keystore.
- All traffic between the App and our servers is encrypted in transit (TLS).
- Our database enforces that only members of a business can reach its data.
- Access to production systems is limited to those who need it.
- We will notify you and the regulator of a personal data breach where the law requires it, without undue delay.
No system is perfectly secure, and we don't claim otherwise.
16. Changes to this policy
We may update this policy. We'll tell you about significant changes in the App or by email before they take effect. The date at the top shows the latest version.
17. Contact us
Aura Hub Lagos, Nigeria support@aurabusiness.app https://aurahub.com.ng/aurabusiness