Privacy

What we collect, and why

When you buy

• Your name and email. To deliver your files and to identify you when you come back for them. Your name is also sent to the payment provider, because a charge that carries no cardholder identity is far more likely to be declined by your own bank.
• Your order contents and amount. To know what to deliver and what you own.
• Records of delivery and download. Timestamps, IP address and browser, plus the exact wording of the consent you gave at checkout. Explained below.
• A random id for your browser. Your browser makes up a random number the first time you reach the checkout, keeps it in its own storage, and sends it back to us with your order. It is not a fingerprint: nothing about your device, your screen, your fonts or your hardware is read, and the number means nothing to any other website. It exists so that if a payment is ever questioned, we can show that the same browser also placed the orders before it that were never questioned. Clearing your site data erases it and nothing breaks.

We never see or store your card details. Those go directly to Dodo Payments, who are the merchant of record, and they never pass through this site.

When you just visit

Page views, in aggregate, so we know which products people look at. No cross-site tracking, no advertising pixels, no fingerprinting, and no cookie banner because there is nothing to consent to.

There is not one third-party script anywhere on this site. No Google Analytics, no advertising tag, no session recorder, no chat widget, no social button. Nothing you do here is visible to anybody but us, and the browser is told to refuse the camera, the microphone and your location outright, so nothing on the page can even ask.

How long we keep things, exactly

Nothing is kept “indefinitely”. The full list:

• Your account and licences: for as long as you want access to your files. Your downloads never expire, so neither does this, until you ask us to remove it.
• Delivery, consent and download records: two years from the order. A card payment can be questioned long after it was made, and these are the only records that show what you asked for and what you received.
• The random browser id: the same two years, on the same orders, for the same reason.
• Support messages: two years, so we can pick up a thread where it left off.
• Tax records: as long as the law requires, which is currently eight years in India. These are held by Dodo Payments as the seller of record as well as by us.

Why we are allowed to hold it

Your name, email and order exist to perform the contract you entered into: we cannot deliver files to somebody we cannot identify. The delivery, consent, IP and browser-id records exist for our legitimate interest in preventing fraud and defending a payment dispute, which is a purpose the GDPR names explicitly. Nothing here is used for advertising, profiling or automated decisions about you, and nothing is sold or shared for anybody else’s purposes.

Why we keep delivery records

This is the one area where we deliberately keep more than the minimum, so it deserves a straight explanation.

Card networks built their dispute rules around physical delivery, with signatures and tracking numbers. A digital product produces none of that. If somebody tells their bank they never received or never authorised a purchase, the only thing that answers the question honestly is a record showing when the licence was issued, when the file was downloaded, from what address, and what the buyer agreed to at checkout.

These records are kept for six years, which is the period during which a payment can still be questioned or a tax authority can ask about it. They are never used for marketing and never shared with anyone except where needed to answer a payment dispute or where the law requires it.

Who else touches your data

• Dodo Payments, merchant of record. Handles payment, billing and tax. Receives your name, email and order contents.
• Supabase, database and file storage.
• Vercel, hosting.
• Resend, email delivery.

That is the complete list. We do not sell data, we do not share it with advertisers, and we do not have an affiliate network reading your behaviour.

How long we keep things

• Order and delivery records: six years.
• Your account and licence keys: until you ask us to remove them.
• Newsletter subscription: until you unsubscribe.
• Support messages: two years, then deleted.

Your rights

You can ask for a copy of everything we hold about you, ask us to correct it, or ask us to delete it. Email us and we will do it within thirty days, usually the same week.

On deletion: we anonymise rather than destroy. Your name, email and address are removed and your identifier is rotated, so what remains cannot be connected back to you. The order and delivery record itself is kept in that anonymised form, because a payment can still be questioned for years afterwards and because tax rules require it. Anonymised records of that kind fall outside data protection law precisely because they no longer identify anyone.

Deleting your account does not remove licences you have already bought from your own machine, and it does mean we can no longer identify you if you need your files again. We will say so before doing it.

Children

This is a professional developer tool and is not directed at children. We do not knowingly collect data from anyone under sixteen.

Who to complain to, and how

Aurelius Black is operated by VEXHO, a sole proprietorship registered in India under the legal name Zaid Hashim Koradia. VEXHO decides what happens to your data and is answerable for it. Under India’s Digital Personal Data Protection Act the same person handles grievances, and that person can be reached at privacy@aureliusblack.com. It is read by a human, and every message gets a written reply.

Any other privacy question, including a request for a copy of your data or for it to be deleted, can go to the same address or through the contact page. We answer within thirty days and usually within one.

If we cannot resolve it between us, you are entitled to complain to a regulator: the Data Protection Board of India, or the supervisory authority in your own country if you are in the UK, the EU or the EEA. Complaining to them does not require our permission and does not affect anything you have bought.