Legal

Privacy Policy.

Alpha draft — not legal advice. Pending counsel review before GA. This document is provided for transparency during alpha access only and does not constitute a legally binding privacy notice.

Last updated: 12 July 2026. Effective from: alpha access opening date.

1. Data controller

The data controller is Aurelian Stewardship Ltd, a company registered in England and Wales. References to “Aurelian”, “we”, “us”, or “our” in this policy refer to Aurelian Stewardship Ltd. You can reach us at privacy@tryaurelian.com.

2. Data we collect

We collect the following categories of personal data:

Identity and contact data: your email address, name (if provided), and any correspondence you send us.
Usage analytics: page views, feature interactions, session duration, browser type, and device category. We do not use third-party ad-tracking pixels.
Financial parameters: asset allocations, risk tolerance, investment horizon, and scenario inputs you enter into the planning tool. These are held encrypted at the household tier and are never transmitted to the modeling engine in raw form.
Model inputs and outputs: anonymised weight vectors and distribution outputs produced during your planning sessions. The engine receives no personally identifiable information; only anonymised parameters are processed.
Financial audit records: where Aurelian processes transactions or facilitates connections with regulated financial institutions, records of those activities are retained as required by law (see section 6).

3. Legal bases (UK GDPR)

We process your personal data under the following lawful bases:

Art. 6(1)(b) — Contract: processing necessary to provide the Aurelian service you have signed up for, including running your financial plan and maintaining your account.
Art. 6(1)(c) — Legal obligation:processing required to comply with applicable law, including the UK Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (“MLR 2017”), the Financial Services and Markets Act 2000 (“FSMA 2000”), and FCA record-keeping requirements.
Art. 6(1)(f) — Legitimate interest: processing for product analytics, fraud prevention, and service improvement, where our interest does not override your fundamental rights and freedoms.

4. California residents (CCPA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) grants you additional rights:

Right to know: you may request disclosure of the categories and specific pieces of personal information we have collected about you.
Right to delete: you may request deletion of personal information we have collected from you, subject to certain exceptions (see section 6).
Right to opt out of sale or sharing: Aurelian does not sell your personal information and does not share it for cross-context behavioural advertising. No opt-out is required.
Right to non-discrimination: we will not discriminate against you for exercising your CCPA rights.

To exercise CCPA rights, email privacy@tryaurelian.com with subject line “CCPA request”. We will respond within 45 days.

5. Your rights under UK GDPR

As a data subject under the UK GDPR, you have the following rights. To exercise any of them, email privacy@tryaurelian.com. We respond within one calendar month.

Right of access (Art. 15): obtain a copy of your personal data and information about how we use it.
Right to rectification (Art. 16): correct inaccurate or incomplete personal data.
Right to erasure (Art. 17): request deletion of your personal data. See section 6 for the full erasure and retention framework.
Right to restriction (Art. 18): request that we restrict processing while a dispute about accuracy or lawfulness is pending.
Right to data portability (Art. 20): receive your data in a structured, machine-readable format (applies to data processed on the basis of consent or contract).
Right to object (Art. 21): object to processing based on legitimate interests. We will cease unless we can demonstrate compelling legitimate grounds.

6. Right to erasure vs audit-log retention

This section explains exactly what happens when you request deletion of your Aurelian account and data. The law draws a clear line between data Aurelian is free to delete and data Aurelian is legally required to keep.

6.1 What is deleted within 30 days of your request

Upon receiving a valid erasure request under Art. 17 UK GDPR (or an account deletion request via the product), we will permanently and irreversibly delete the following within 30 calendar days:

Your profile data: name, email address, and account credentials.
Your preferences, notification settings, and UI configuration.
Uploaded documents (statements, tax returns, or other files you provided).
Saved financial plans, scenario inputs, and model inputs/outputs associated with your account.
Marketing consent records (we retain a suppression record — your email on a do-not-contact list — for the minimum period required to honour opt-outs).

6.2 What is retained despite an erasure request (Art. 17(3)(b) exception)

Art. 17(3)(b) of the UK GDPR provides that the right to erasure does not apply where processing is necessary for compliance with a legal obligation. The following records fall within this exception and cannot be erased:

Financial transaction records and audit logs required under the UK Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017) and the Financial Services and Markets Act 2000 (FSMA 2000). These records must be retained for 7 years from the date of the relevant transaction or activity.
FCA-mandated records of any regulated activities, communications relating to regulated services, and KYC/AML customer due diligence documentation, to the extent Aurelian is subject to FCA authorisation or exemption.

Pseudonymisation on erasure: Upon account deletion, we replace all direct personal identifiers (name, email, user ID) in retained records with an opaque cryptographic reference that cannot be reverse-engineered to identify you without the deletion key, which is itself destroyed. The financial record remains to satisfy the regulator; the link to you as an individual is severed to the maximum extent the law permits.

6.3 Automatic purge after retention period

Retained audit records are subject to automated deletion. Seven years after the date of the last relevant transaction or regulated activity on your account, all remaining pseudonymised records are automatically and permanently purged from our systems. No manual action is required from you.

6.4 Written confirmation after erasure

When we process an erasure request, we will send you a written confirmation to the email address associated with your account (or to an alternative address you specify) detailing:

What data was permanently deleted and when.
What data is being retained, under which legal obligation, and for how long.
The pseudonymisation measures applied to retained records.

If you disagree with a retention decision, you may lodge a complaint with the Information Commissioner's Office (see section 9).

7. Data retention schedule

Data category	Retention period	Basis
Profile, email, preferences	Until deletion request + 30 days	Contract (Art. 6(1)(b))
Usage analytics	3 years from last activity	Legitimate interest (Art. 6(1)(f))
Financial audit logs	7 years from transaction date	Legal obligation — MLR 2017 / FSMA 2000 (Art. 6(1)(c))
Model inputs/outputs	Session duration unless saved; deleted on account erasure	Contract (Art. 6(1)(b))
Marketing suppression records	Until opt-out is no longer necessary to honour	Legal obligation (PECR / Art. 6(1)(c))

8. International data transfers

Aurelian's production infrastructure is hosted in the United States (us-central1). Transfer of personal data from the UK to the US is subject to the UK International Data Transfer Agreement (IDTA) or equivalent safeguards. We rely on Standard Contractual Clauses (SCCs) with our cloud infrastructure provider. A full transfer impact assessment is pending counsel review as part of GA readiness.

9. Right to complain

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

Website: ico.org.uk
Helpline: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would appreciate the opportunity to address your concern before you contact the ICO. Please write to us first at privacy@tryaurelian.com.

10. Changes to this policy

We will update this policy before general availability and whenever our data practices materially change. Where required by law, we will seek your consent before processing your data in a new way. Material changes will be communicated by email to registered users.

Contact

Data protection enquiries: privacy@tryaurelian.com. Aurelian Stewardship Ltd, England and Wales.