Privacy Policy

This Policy applies to:

• Consumers and end users
• Merchants and suppliers
• Visitors to our websites or applications

It covers personal data collected:

• Directly from you
• Automatically via device or system logs
• Through our “phygital” infrastructure (hardware, sensors, and automated tills)

Aulax follows data minimisation, collecting only data necessary for a secure, high-quality, and personalised service.

2.1 Information You Provide Directly

• Identity: Full name and Date of Birth (for age verification and account security).
• Contact: Verified email and mobile phone number. You are responsible for maintaining accurate contact information to receive secure PINs/OTPs.
• Verification: PINs or One-Time Passwords (OTPs) sent via SMS or email.
• Biometrics: Encrypted identifiers (e.g., FaceID). Templates are processed only with your explicit consent via your device’s secure enclave and are deleted if the feature is disabled or the account is closed. Aulax does not store raw biometric images.
• Billing: Billing address and payment tokens. Full card numbers are not stored.
• Content & Feedback: Reviews, ratings, and city experience feedback. Public content may be moderated in accordance with platform policies.

2.2 Transaction & “Phygital” Interaction Data

• Purchase history, digital receipts, and loyalty/reward activity.
• Infrastructure Interaction: Data from Aulax-enabled hardware (QR scanners, sensors, and automated tills) used to ensure transaction accuracy and detect checkout discrepancies (e.g., missed scans).

2.3 Technical, Device & Location Data

• IP address, device ID, app diagnostics, and crash logs.
• Real-time Location: GPS and proximity data collected only with explicit consent for discovery, navigation, and infrastructure optimisation.

• Core Services: Self-checkout facilitation and identity authentication via PINs/OTPs. A convenience or service fee may be applied per transaction to cover operational costs; any such fee will be clearly disclosed to you before you complete the transaction.
• Social Commerce & Feedback: Displaying user feedback and city experience reviews. Anonymised and aggregated datasets are owned by Antive Ltd and may be shared with third parties for analytics and city-wide optimisation.
• Security & Integrity: Fraud detection, prevention of theft-by-omission, bot detection, and account integrity checks.
• Marketing: Updates, offers, and notifications. “Soft opt-in” communications may be sent to existing users for related Aulax services; opt-out is available at any time.
• Legal Compliance: Age-verification for restricted goods and tax reporting.

• Contractual Necessity: To provide requested services.
• Legitimate Interests: Platform security, fraud prevention, service improvement, and aggregated social feedback.
• Legal Obligation: Tax, AML, and age-verification compliance.
• Explicit Consent: For location tracking, marketing communications, and biometric processing. Consent may be withdrawn at any time without affecting prior lawful processing.

• Merchants: Limited to Name, Order Code, and age-status. Merchants act as independent Data Controllers; Aulax is not liable for their independent use of this data.
• Infrastructure Partners: PCI-DSS payment processors and secure cloud providers under strict GDPR contracts.
• Third-Party Links: The Platform may link to external websites. We are not responsible for their privacy practices.
• Legal Authorities: Where required under UK law.

Security Measures

TLS encryption, multi-factor authentication (MFA), role-based access controls, and regular security audits. While we apply industry-standard protections, no digital system can guarantee absolute security.

Retention Periods

• Financial records: 6 years (for tax purposes)
• Account data: for the duration of your account, deleted or anonymised upon closure
• Biometric templates: deleted immediately when disabled or on account closure
• Security logs: retained as needed for investigations

Under UK GDPR, you may:

• Access, rectify, or erase your personal data
• Object to or restrict processing
• Request data portability
• Request human review of automated decisions
• Withdraw consent at any time

To exercise your rights, email hello@aulax.app with “Data Protection Request” in the subject line. You may also lodge a complaint with the UK Information Commissioner’s Office (ICO).

We monitor suspicious behaviour to prevent fraud, misuse, or violations of platform policies.

Accounts may be suspended or restricted without prior notice in high-risk scenarios.

Relevant data may be shared with authorities to protect the integrity of our digital-physical infrastructure.

The Platform is not intended for individuals under 16 years of age.

We do not knowingly collect personal data from children; if identified, such data is promptly deleted.