ChaseList Privacy Policy

Last updated: 16 October 2026

1. Who we are

Aurora AI Solutions Studio UG (haftungsbeschränkt), Friedhofstr. 10, 70191 Stuttgart, Germany, info@helloaurora.ai ("ChaseList", "we"). See the Imprint. We are not required to appoint a data protection officer.

2. Our two roles

• Controller: for data about our website visitors, waitlist subscribers, and customers' account and billing data (sections 3–6).
• Processor / service provider: for documents and End Client data that our customers (bookkeepers) upload or collect through ChaseList. The bookkeeper is the controller and decides what is collected. Our DPA governs this processing. If you are an End Client, please contact your bookkeeper first. We will forward requests we receive to them.

3. Website and server logs

Hosting by Vercel Inc. Technical data (IP address, time, requested URL, user agent) is processed to deliver and secure the site and kept for up to 30 days. Legal basis: Art. 6(1)(f) GDPR (security and operation).

4. Waitlist

Email, number of clients and current tool, so we can tell you when ChaseList opens. Basis: consent, Art. 6(1)(a). Withdraw anytime via info@helloaurora.ai. Stored with Supabase in Frankfurt (EU). Kept until launch plus at most 12 months.

5. Customer accounts and use of the Service

Name, business name, email, login data, settings, and usage and audit logs, so we can provide the Service. Basis: contract, Art. 6(1)(b). Security logs: Art. 6(1)(f). Kept for the account's lifetime and then deleted within 60 days, except data we must keep by law.

6. Billing and payments (Stripe)

Checkout, subscriptions, tax calculation and invoices are handled by Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe Inc., USA). We receive name, email, billing address, tax ID, plan and payment status, and the last 4 digits and brand of the card. We never see full card numbers. Stripe also processes data as an independent controller for fraud prevention and compliance (see stripe.com/privacy). Basis: Art. 6(1)(b) and (c). German tax law requires us to keep invoices and accounting records for up to 10 years (§ 147 AO, § 257 HGB).

7. Emails

We send transactional emails (login links, trial and billing notices, service messages) via Resend. On customers' instructions, we send reminder emails to their End Clients (processor role). No marketing emails without consent. Any marketing email includes an unsubscribe link.

8. Cookies and tracking

No advertising or analytics cookies, no tracking pixels and no third-party analytics. We use only strictly necessary cookies or local storage for login sessions (§ 25(2) TDDDG). Stripe Checkout, hosted by Stripe, may set its own necessary cookies for fraud prevention.

9. Recipients and transfers

Our sub-processors are listed at /subprocessors. Some are US companies. Transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses. Customer account and product data (checklists, End Client contacts, uploaded documents) are stored with Supabase in the USA (AWS us-east-1), where most of our customers are. Waitlist data is stored in Frankfurt (EU).

10. Security

See our Security page.

11. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent (Art. 15–21). You may complain to a supervisory authority, e.g. the LfDI Baden-Württemberg. US residents: depending on your state (e.g. California, Colorado, Virginia), you may have rights to know, correct, delete and opt out of sale or sharing. We do not sell or share personal information for cross-context behavioural advertising. Contact info@helloaurora.ai. We respond within 30 days (GDPR) or 45 days (US state laws).

12. Children

The Service is for businesses and not directed at children under 16.

13. Changes

We will post updates here and email customers about material changes.