Legal

Privacy Policy

These privacy notices explain, pursuant to Articles 13 and 14 of the General Data Protection Regulation (GDPR) and Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG), how we process personal data in connection with our website, user accounts, SaaS features, and related communication, payment, and support processes.

Contents · 17

01Controller

Controller within the meaning of Art. 4 No. 7 GDPR:

Julian Bruder Einzelunternehmen
(Trading as: Aura Historia)
Hardenbergstraße 80
04275 Leipzig
Germany

Email: julian.bruder@aura-historia.com
Contact: contact@aura-historia.com

02Sources and Categories of Processed Data

We process personal data that:

  • you provide directly to us, for example when registering, using your account, contacting us, subscribing to newsletters, or placing an order,
  • arises technically when you use the website or service,
  • is provided by our service providers in the context of authentication, payment processing, hosting, security, or analytics,
  • originates from publicly accessible sources where content is indexed, documented, or analyzed for the platform.

Depending on your use, this may include in particular:

  • master and contact data (e.g. email address, name)
  • account and authentication data
  • preference and settings data
  • contract, billing, and payment metadata
  • usage, log, and device data
  • content and interaction data within the service
  • address and location data where you use geographic features
  • data from publicly accessible sources, including historical or antiquarian content

03Website Access and Technical Provision

When you access our website or app, technically necessary data are processed, in particular:

  • IP address
  • date and time of access
  • accessed pages, files, and resources
  • browser or user-agent information
  • technical connection and security data

The processing serves the following purposes:

  • provision of the website and service
  • delivery of content
  • IT security, abuse prevention, and attack detection
  • error analysis, stability, and performance

Legal bases:

  • Art. 6 para. 1 lit. f GDPR – legitimate interest in the secure and functional operation of our website and systems
  • Section 25 para. 2 TDDDG – where access to terminal equipment storage is strictly necessary for technical operation

04User Accounts, Authentication, and Account Data

If you create or use a user account, we process in particular:

  • email address
  • first and last name where provided
  • preferred language and currency where provided
  • account preferences
  • roles, permissions, and subscription status

You can also sign in with Google or Facebook (Meta). In that case, we receive account information from the provider you choose that is needed to authenticate you and create or associate your Aura Historia account. Depending on the provider and your settings with them, this may include your email address, name, and an identifier for your provider account. We use this information for sign-in and account management. Google and Meta also process information under their own privacy policies. These sign-in options are separate from Google Analytics, Google Maps, and Facebook links for sharing content.

For more information, see Google's Privacy Policy and Meta's Privacy Policy.

Purposes of processing:

  • registration and login
  • account management and access control
  • account security
  • provision of personalized settings and features

Legal bases:

  • Art. 6 para. 1 lit. b GDPR – performance of the user contract and pre-contractual steps
  • Art. 6 para. 1 lit. f GDPR – abuse prevention, IT security, and protection of the user account

05Use of SaaS Features

When you use our service, we may process additional data, in particular:

  • search queries and filter settings
  • saved search filters and related configurations
  • watchlist entries
  • notification and matching settings
  • product and content interactions, such as feedback on matches
  • preference data relating to display and use of the service
  • support or inquiry content where you contact us

Where partner, shop, or administration features are used, we may additionally process:

  • shop, domain, contact, and address data, including the locations of dealers and auction houses
  • partner applications and related status or review data
  • API access data or related administration data
  • role and activation information

AI assistants and other connected applications: If you connect an AI assistant or another application to your account, it asks for your approval on our authorization page. The page shows the application's name, the website that identifies it and the address it returns to; you may decline. Once you approve, the application can access the data and functions shown there, for example your profile and addresses, saved searches, watchlist and notifications. For each connection, we store the address of the application's public client document, the name the application gives itself, the permissions you approved, and when the connection was created and last used. We store access and refresh tokens only in hashed form. To check an application, we retrieve its public client document from the application's own website; we send no data about you with this request and keep the document for at most one hour. The authorization page may load the application's logo from its website, which transmits your IP address to that website. We process the application's requests like other requests to our service. Our logs record the application's host and security events, such as the reuse of a refresh token, but never token values or the content of results. The application's provider processes the results it receives under its own privacy policy. You can disconnect an application at any time in your account under Access tokens, Connected apps; this ends all of its access at once. Disconnecting does not delete data the application has already received; contact its provider about such data. The client document, the logo and the connection details above concern AI assistants that identify themselves with a public client document. Other applications, such as shop integrations we register, also show the requested permissions on the authorization page and can be disconnected in the same place.

Shopify connection: When you install the Aura Historia sales channel in Shopify and connect your Aura Historia account, we process the shop domain, product data, shop language and currency, and shipping profiles, destination areas, advertised methods, conditions, prices and product/variant membership to publish your listings and supported shipping information on Aura Historia. Shopify sessions and access credentials, together with bounded import progress, are stored with Cloudflare. This integration does not request customer data; precise fulfillment addresses are not imported. You can disconnect in the Shopify channel or uninstall the app. This stops further shipping imports and starts removal of owned imported shipping assertions and revocation of Aura Historia access; manual partner edits are preserved. Credentials and bounded job data needed for pending cleanup can be retained separately for up to seven days. Disconnecting does not automatically confirm deletion of listings already submitted or all imported assertions; contact support when cleanup remains unconfirmed.

Purposes of processing:

  • provision and personalization of the service
  • management of search, watchlist, and notification functions
  • authorization checks and abuse prevention
  • handling of partner and API features

Legal bases:

  • Art. 6 para. 1 lit. b GDPR – performance of the contract
  • Art. 6 para. 1 lit. f GDPR – product operation, security, abuse prevention, and further development

06Addresses, Search Locations, and Geographic Features

When you use geographic features, we process in particular, depending on the feature:

  • addresses you save in your account, with label, address text, country, region, and postal code where provided
  • geographic information derived from them, such as country, region, coordinates and their precision, and the processing status
  • your selected search location, meaning a saved address or a country with an optional postal code
  • coordinates you use for a radius search or keep in a saved search
  • your current location if you explicitly share it through your browser

Saved addresses and search location: Your saved addresses and your search location are private and intended for your account only. We use them to determine distances and regional results for you. They are not used to verify your residence, billing address, nationality, or whether objects can be delivered. We do not derive a search location from your language, currency, or IP address.

Geocoding: After you save or change an address, we determine its geographic location in the background, with a delay. To do so, we send the address text and your country, region, and postal code details to Amazon Location Service provided by Amazon Web Services (AWS), which we use through the Frankfurt region (eu-central-1). Amazon Location Service relies on data from data providers, whose processing may also take place outside this region. We store the result only where the provider's terms permit it and use it exclusively for your account, even if other users save the same address. We adopt a precise point only from an unambiguous result. Until the lookup is complete, or if there is no unambiguous result, the address remains usable without a precise point; you can correct it at any time. Geocoding does not verify your address.

Browser location sharing: We request your current location only when you explicitly trigger it. Your browser asks for your permission first; you can refuse or withdraw it in your browser settings. We use the coordinates for the search in question and store them only if you save the search.

Saved searches with a location: If a saved search includes a radius, we store the coordinates used for it as a private copy. This copy does not change if you later edit or delete an address. You remove it by changing or deleting the saved search.

Not shared with analytics services: We do not send addresses or coordinates to Google Analytics and do not include them in diagnostic logs. Location features do not require consent to analytics/tracking or external maps; your choices in the consent settings remain unchanged.

Public locations of dealers and auction houses: Dealers, auction houses, and other providers can add locations for their business. For active locations, we may publicly display the exact geographic point as well as the country and region, and use them for radius searches and to associate listings. The full address entered, supporting evidence, and management details remain protected and are accessible only to authorized persons. Retired locations are no longer shown publicly; it may take a short time until all search results are updated. Private user addresses are never used as public locations.

Attribution: Geographic data come from Amazon Location Service and its data providers. The required source and copyright notices are available on the Amazon Location Service attribution page.

Purposes of processing:

  • determining distances, and regional search and filtering
  • radius searches and notifications for saved searches
  • location-based discoverability of dealers, auction houses, and their listings

Legal bases:

  • Art. 6 para. 1 lit. b GDPR – provision of the address, location, search, and partner features you use
  • Art. 6 para. 1 lit. f GDPR – legitimate interest in the location-based discoverability of dealers, auction houses, and listings

07Paid Services, Subscriptions, and Payment Processing

If you purchase paid digital services or subscriptions, we process in particular:

  • selected plan and billing interval
  • order, customer, checkout, and subscription identifiers
  • payment status, transaction metadata, and invoice metadata
  • country, tax country, and VAT-relevant information
  • Stripe customer and portal information

Payment processing is carried out via Stripe (Stripe Payments Europe, Limited, Dublin, Ireland). We do not store full payment card data; such data are processed directly by Stripe. Depending on the specific legal context, Stripe may act partly as an independent controller and partly as a service provider.

Purposes of processing:

  • contract conclusion and performance
  • invoicing, payment processing, and billing
  • management of subscriptions, terms, renewals, and cancellations
  • compliance with tax and commercial-law obligations

Legal bases:

  • Art. 6 para. 1 lit. b GDPR – performance of the contract
  • Art. 6 para. 1 lit. c GDPR – statutory retention, invoicing, and tax obligations
  • Art. 6 para. 1 lit. f GDPR – fraud prevention, receivables management, and system security

08Newsletter and Marketing Communications

If you choose to receive marketing emails, we process in particular:

  • your email address
  • your first and last name, where provided
  • language and currency information, where provided
  • records of your subscription, confirmation, and later unsubscription

We use this information to send newsletters, personalized recommendations for relevant objects, and information about features and plans. We use Loops to manage subscriptions and send these emails.

Subscribing is voluntary and separate from creating or using an account. Signing in to Aura Historia does not mean that you have agreed to receive marketing emails. If you opt in during account registration, we start sending after you verify your email address. A separate newsletter subscription starts after you confirm through the link we email you. You can unsubscribe at any time using the link in a marketing email or otherwise withdraw your consent.

Legal basis:

  • Art. 6 para. 1 lit. a GDPR – your consent

Withdrawal of your consent does not affect the lawfulness of processing carried out before the withdrawal.

09Cookies, Local Storage, and Session Storage

We use technically necessary storage in your browser. We may store your selected language, functional preferences, and consent choices in cookies or local storage so we can remember and apply them on later visits. Sign-in and registration may also require temporary browser storage. Optional analytics features and external maps are used only where legally permitted and after your consent.

Legal bases:

  • Section 25 para. 2 TDDDG and Art. 6 para. 1 lit. f GDPR – for technically necessary storage
  • Section 25 para. 1 TDDDG and Art. 6 para. 1 lit. a GDPR – for optional analytics/marketing storage or loading external content where consent is required

10Consent Management, Google Analytics, and External Maps

Our website uses a consent banner and separate consent settings. Optional analytics features and external content are activated only to the extent legally permissible and after your consent. You can make separate choices for analytics/tracking and external maps.

We use Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Under our current technical implementation, analytics cookies or similar optional storage are generally activated only after your consent. At the same time, the consent-management implementation or Google Consent Mode may already involve limited technical communication with Google before your consent, for example to transmit consent status or technically reduced, cookieless signals. Where this occurs, it serves solely to technically manage the consent state and not to activate full cookie-based analytics.

If you grant consent, the following data may in particular be processed for statistical evaluation:

  • visited pages and events
  • technical device and browser information
  • approximate location and language information
  • interaction and usage data

You may withdraw your consent at any time with effect for the future via the consent settings.

On shop pages, we may embed maps from Google Maps, also provided by Google Ireland Limited. Google Maps is loaded only after you have consented to the use of external maps. Before your consent, no Google Maps iframe connection is established. When you load the map, data such as your IP address, device and browser information, referrer information, and the requested address or coordinates may be transmitted to Google. Google may also process data in third countries, in particular the United States. You may withdraw this consent at any time via the consent settings.

Legal bases:

  • Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG – for Google Analytics processing, optional analytics storage, and loading Google Maps after your consent
  • Art. 6 para. 1 lit. f GDPR – only insofar as purely technical signals are processed before consent in order to enforce and document your consent choice

For further information, please refer to Google's Privacy Policy.

11Publicly Accessible Sources, Web Scraping, and Historical Content

Our platform also processes information from publicly accessible sources on the internet. Depending on the source, this may in particular include:

  • descriptions, images, prices, and metadata relating to historical or antiquarian objects
  • shop, contact, or company information where publicly accessible
  • historical documentation material, contextual information, and source references
  • in individual cases, personal data where such data form part of publicly accessible content

According to our intended operating model, no access restrictions are circumvented and no obviously protected areas are technically bypassed.

Purposes of processing:

  • research, indexing, and discoverability
  • documentation and archiving
  • scholarly, historical, and educational preparation
  • technical analysis, classification, and contextualization

Legal basis:

  • Art. 6 para. 1 lit. f GDPR – our legitimate interest in the research, documentation, indexing, and preparation of publicly accessible information in a historical and antiquarian context

Where personal data are not collected directly from the data subject, information is provided through these publicly available privacy notices in accordance with Art. 14 GDPR. Given the large number of potential sources and datasets, individual notification may in individual cases be impossible or would involve disproportionate effort.

Data subjects and rights holders may object within the statutory framework or request review at:

Email: contact@aura-historia.com

After review, we remove, block, or restrict content where legally required or where our legitimate interests do not prevail in the individual case.

12AI-Assisted Processing and No Automated Individual Decisions

Some features use automated or AI-assisted methods to organize content and find relevant search results. For enhanced matching of saved searches, we send the search description you enter, relevant listing descriptions, and sometimes an image to Cloudflare for assessment of possible matches. These inputs may contain personal data if they relate to an identifiable person.

This processing supports search functionality. It does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you within the meaning of Art. 22 GDPR.

Legal bases:

  • Art. 6 para. 1 lit. b GDPR – where required to provide contractual features
  • Art. 6 para. 1 lit. f GDPR – legitimate interest in product functionality, quality assurance, security, and contextualization

13Recipients, Service Providers, and Third-Country Transfers

We use external service providers and infrastructure providers. Personal data may be transferred or disclosed to the following categories of recipients:

  • Amazon Web Services (AWS) – for registration and sign-in, and for geocoding addresses (Amazon Location Service)
  • Cloudflare – for website delivery and security, and enhanced matching of saved searches
  • Hetzner Online GmbH – where parts of our service are hosted there
  • Stripe – for payment processing, subscription management, checkout, and customer portal functions
  • Loops – for newsletters and marketing emails
  • Google – if you use Google Analytics, Google Maps, or Google sign-in
  • Meta/Facebook – if you use Facebook sign-in
  • applications you connect yourself, such as AI assistants – for the data and results you allow them to access; their providers process these under their own privacy policies
  • additional technical, legal, tax, or organizational service providers – where required for operations, support, security, compliance, or the enforcement of claims
  • authorities, courts, and third parties – where we are legally obliged to do so or where this is necessary to enforce legal claims

Some of these providers may process data outside the European Union or European Economic Area, or access it from outside those areas. This may include Google, Meta/Facebook, AWS, Stripe, Cloudflare, and Loops.

Where third-country transfers take place, we rely – depending on the provider and situation – in particular on:

  • adequacy decisions of the European Commission (e.g. the EU-U.S. Data Privacy Framework where applicable),
  • the European Commission's Standard Contractual Clauses,
  • supplementary contractual, technical, and organizational safeguards.

Contact us for information about the safeguards applying to a particular transfer. Google Analytics and Google Maps are separate from Google sign-in; Facebook sign-in is separate from sharing content through Facebook.

14Storage Duration

We store personal data only for as long as required for the respective purposes or as long as statutory retention obligations apply.

The following criteria typically apply in particular:

  • Account data: until the account is deleted or the user relationship ends; thereafter deletion or blocking unless statutory retention obligations prevent this
  • Addresses and search location: until you remove the address or search location or delete your account. When you delete an address, we remove its label and address details; if none of your other addresses uses the same input, we also delete the details sent to Amazon Location Service and the result from our records. We do not keep earlier versions as history. A request already in progress at Amazon Location Service cannot be recalled, but its result is no longer stored after deletion. Coordinates in saved searches remain stored until you change or delete the search or your account. These data are removed from backups when the relevant backup period expires.
  • Contract, billing, and tax data: for the duration of statutory commercial-law and tax-law retention periods
  • Newsletter data: while you are subscribed; evidence of your consent and unsubscription may be kept longer where needed to document your choice and handle legal claims
  • Technical and security data: for as long as needed to protect and maintain the service or investigate an incident
  • Connections of AI assistants and other applications: until you disconnect the application, otherwise as for account data. Access and refresh tokens are deleted when you disconnect, and otherwise by scheduled cleanup after they expire
  • Data from public sources: as long as required for documentation, research, or platform purposes, or until a justified deletion or blocking request must be complied with
  • Browser storage: until expiry of the relevant storage period or until you delete it yourself

15Rights of Data Subjects

Subject to the statutory requirements, you have in particular the following rights:

  • Art. 15 GDPR – right of access
  • Art. 16 GDPR – right to rectification
  • Art. 17 GDPR – right to erasure
  • Art. 18 GDPR – right to restriction of processing
  • Art. 20 GDPR – right to data portability
  • Art. 21 GDPR – right to object to processing based on Art. 6 para. 1 lit. f GDPR
  • Art. 7 para. 3 GDPR – right to withdraw consents with effect for the future

Requests may be addressed to:

contact@aura-historia.com

Registered users may also delete their account via the account area:

https://aura-historia.com/account

Please note that deletion is not possible to the extent or for as long as we still require data to comply with legal obligations, to establish, exercise, or defend legal claims, or for IT-security reasons.

16Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority particularly competent for us is:

Sächsische Datenschutz- und Transparenzbeauftragte
Maternistraße 17
01067 Dresden
Germany
Website: https://www.saechsdsb.de/
Email: post@sdtb.sachsen.de

You may also contact any other competent supervisory authority, in particular the authority of your place of residence, place of work, or the place of the alleged infringement.

17Changes to These Privacy Notices

We may adapt these privacy notices where this becomes necessary due to legal, technical, organizational, or content-related changes. The version published on our website shall be authoritative.

Status: 10 November 2026