Aurian Haus
Legal

Privacy Policy

Last updated: 3 August 2026

Operator: Aurian Haus is a trading name of The Trustee for House of Hansen Trust, ABN 80 287 120 663.

Address: Available on request. Privacy contact: hello@aurianhaus.com

This Privacy Policy explains how we handle personal information. We aim to handle personal information consistently with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where the small-business exemption currently applies to us, some of these obligations are voluntary commitments we choose to meet.

1. What we collect

  • Account information: name, business name, email, phone, password hash, role.
  • Client/project information: brand assets, briefs, product information, billing details, URLs and any material you upload to the portal (including product images).
  • Communications: support messages, revision notes, internal activity logs.
  • Technical data: IP address, browser type, device information, and cookies or similar tokens (including security tokens set by our bot-protection provider, see section 9).
  • Payment data: processed by Stripe; we do not store full card numbers.

2. Why we collect it

To provide and improve the Services; to deliver, review and approve work; to bill you and meet tax and record-keeping obligations; to respond to support; to protect our systems from bots and abuse; and to send service notifications and (with your consent) marketing.

3. AI generation and third-party AI providers

Because Aurian Haus produces 100% AI-generated content, your brand assets, product imagery and reference material may be sent to third-party AI model providers (for example, Higgsfield and the underlying model vendors they rely on) for the sole purpose of generating your deliverables. These providers are located overseas, including in the United States. Some may retain uploads briefly for safety, and some may use inputs to improve their models unless opted out. If you do not want a specific asset submitted, tell us in writing before kickoff.

We handle uploaded brand and product images only to produce your deliverables, and we do not publish them without your authorisation.

Please note: under Australian law, content that is 100% AI-generated generally does not attract copyright (which requires a human author). How ownership and licensing work for your deliverables is set out in our Terms.

4. Who we disclose to

We disclose personal information to the following categories of recipients, most of whom process data overseas (primarily in the United States):

  • Hosting, database and storage: Supabase (Postgres on Amazon Web Services), with row-level security; data is stored in Australia and/or the USA.
  • Front-end hosting: Lovable.
  • Payments: Stripe (card data is handled by Stripe; USA).
  • Transactional and marketing email: Resend (USA).
  • Bot protection: Cloudflare Turnstile (USA), see section 9.
  • Review and delivery: Frame.io and similar tools.
  • AI model providers: as described in section 3 (overseas, including USA).
  • Internal scheduling: Google (Calendar, Tasks and OAuth) for our team's workspace account.
  • Professional advisors and government authorities where required by law.

5. Overseas transfer

Some of the providers above process data outside Australia, primarily in the United States. Where the APPs apply to us, we take reasonable steps to ensure overseas recipients handle your personal information consistently with the APPs; many of these providers are also bound by their own contractual and legal privacy commitments. We will name the relevant countries on request.

6. Storage and security

Your data is hosted on Supabase (Postgres on Amazon Web Services) with row-level security, encryption in transit (HTTPS) and access controls. You can export and delete your own data using the tools in your account (see section 8). No system is perfectly secure, and we cannot guarantee absolute security.

7. Retention

We retain personal information for as long as it is needed for the purposes above and to meet our legal obligations. We are required to keep tax and financial records for at least 5 years (Australian Taxation Office); we keep records for at least that period. Project files may be deleted earlier on written request, subject to any legal hold.

8. Your rights

You can:

  • Export your data and delete your account using the self-serve tools in your account; or
  • Request access to or correction of your personal information by emailing hello@aurianhaus.com; we aim to respond within 30 days.

Where the Privacy Act applies to us, these are legal rights; where the small-business exemption applies, we honour them as a voluntary commitment. Where the Privacy Act applies to us, you may also complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9. Cookies, security tokens and analytics

  • Strictly necessary / security: we use Cloudflare Turnstile on our Login, Signup, Contact and Free Sample forms to block bots. Turnstile runs via Cloudflare and processes your IP address and device signals, and may set or read a security token. This information may be processed overseas (including the USA). See Cloudflare's privacy terms for details.
  • Functional: cookies that remember your preferences and keep you signed in.
  • Analytics: we do not currently run third-party website analytics. If we add it, we will name the provider here and explain what it collects before we turn it on.

Australia does not require a cookie consent banner unless we target visitors in the EU or UK. You can control or refuse cookies through your browser settings. See our Cookies Policy for more.

10. Marketing

We will only send marketing emails with your consent or where permitted under the Spam Act 2003 (Cth). Marketing is sent via our email provider (Resend). Every marketing message identifies us (Aurian Haus, a trading name of The Trustee for House of Hansen Trust, ABN 80 287 120 663) with accurate contact details, and includes a one-click unsubscribe that we honour within 5 business days. You can unsubscribe at any time.

11. Children

The Services are a business-to-business portal intended for users aged 18 and over acting for a business. We do not knowingly collect the personal information of anyone under 18. Clients must not upload material containing a child's personal information without appropriate consent.

12. Changes

We may update this policy. The "Last updated" date at the top reflects the latest version.

This Privacy Policy is general information only and is not legal advice. A Queensland solicitor should review it before it is relied on, in particular the cross-border disclosure wording and our position under the small-business exemption.