This page describes Aura's public commitments to responsible data use, AI governance, child safety, security, vendor oversight and accountability.
India-first compliance
Aura's primary operating context is India. The product team will assess the Digital Personal Data Protection Act and Rules as they apply, the Information Technology framework, copyright, consumer and advertising requirements, child-protection law and other applicable requirements.
If Aura serves people in another jurisdiction, the team will complete a jurisdiction assessment before launch or material expansion. The legal framework changes, so Aura will maintain a live legal register.
Our principles
- Purpose limitation: use data for a specific, stated and reasonably necessary purpose.
- Data minimisation: use the lowest-risk signal that can operate the feature.
- Transparency: explain AI scoring, face or identity checks, visibility, brand review, rewards and providers before collection.
- User control: provide usable settings, consent choices and rights routes.
- Security by design: protect media, OTPs, face-related signals, reward codes, prompts, brand assets and support records.
- Fairness and accessibility: test scoring, moderation and discovery across real-world conditions and provide a review route.
- Accountability: keep evidence of what operated, who approved exceptions and what changed.
Consent and notice controls
- Show a short notice at the point of collection and link to the full policy.
- Separate required service consent from optional marketing, non-essential analytics, public promotion, precise location, contact discovery, face-related processing and commercial reuse where required.
- Record consent version, timestamp, account or parent identifier, notice shown, language, purpose, method, withdrawal and later changes.
- Make withdrawal of optional consent at least as easy as giving it and explain the feature impact.
Children and vulnerable users
Under-13 access is prohibited under the current launch model. For users under 18, Aura will verify parental consent where required, restrict age-sensitive content, avoid prohibited targeted advertising and provide a parent or guardian route for rights and deletion.
Product and campaign teams must not pressure minors to disclose private information, perform dangerous acts, use sexualised themes, purchase products, make regulated claims or participate in undisclosed advertising.
AI governance
- Document what each model does, what it does not do and which feature depends on its output.
- Collect only the media, metadata and signals needed for scoring, moderation, safety or generation.
- Score challenge performance, not appearance or unrelated personal traits, and publish a high-level explanation.
- Test across devices, lighting, languages, backgrounds, body types, skin tones, permitted ages and accessibility needs.
- Provide human review for serious enforcement, high-value rewards, systematic scoring complaints, child-safety matters and material brand disputes.
- Version models, prompts, rubrics and reference content. Maintain rollback and incident procedures.
- Label permitted synthetic content where required and block unlawful synthetic media, impersonation and non-consensual imagery.
Vendors and security
Aura uses written contracts that describe purpose, fields, security, confidentiality, sub-processors, location, deletion, incident notice and support for user rights.
Providers must disclose whether content is retained, used for training, reviewed by people, transferred outside India, used for advertising or combined with other data.
Aura will use role-based access, least privilege, encryption, secure deletion, restricted media storage, monitored administration, backups, vulnerability management and incident response.
Incidents and complaints
Aura maintains routes for privacy requests, content reports, copyright notices, appeals, child safety, non-consensual intimate imagery, credible threats, self-harm, fraud and security incidents.
Aura will meet applicable legal timelines and will prioritise emergency safety risks. The exact timeline depends on the complaint, Aura's role and the law in force at the time.
Accountability and updates
Aura reviews compliance before major launches and at least annually. Teams handling personal data, content, moderation, rewards or brand assets receive training.
This page may be updated when law, product, vendors or risk changes. The App will display the current version and effective date.