Aurora privacy policy

Who we are

FarFlash Group Ltd., Canada (“FarFlash”, “we”, “us”), operates Aurora, an invitation-only workspace for client reports, organization information, invoices, payments and team administration. This policy covers Aurora; other FarFlash products and third-party services may have their own policies.

Our privacy contact is the FarFlash team at hello@farflash.com. You can also write to FarFlash Group Ltd., Attention: Privacy, Schwartz Reisman Innovation Campus, 108 College Street, 7th Floor, Toronto, ON M5G 0C6, Canada.

Information we handle

• Accounts and access: email address, authentication identity, account settings, invitations, organization memberships and roles.
• Client work: reports, files and information supplied by you, your organization or FarFlash for your organization’s workspace.
• Billing: billing name, contact details and address, invoices, payment amounts and status, transaction references, reconciliation records and payment instructions you provide.
• Service and security: support correspondence, email delivery records, audit history and technical logs. Hosting and authentication services may process IP addresses and browser information. Authentication controls also use hashed identifiers derived from email addresses or IP addresses to limit repeated attempts.

When you use Google sign-in

Google provides basic account identity information, such as your account identifier, name, email address, email verification status and profile picture when available. Our authentication provider stores this identity information to sign you in, maintain your session and match your verified email to your invitation or existing membership.

Aurora requests basic identity permissions only. It does not request access to your Gmail messages, Google Drive files or contacts. We do not sell Google user data, use it for advertising, or use it to train AI models. You can remove Aurora’s Google access in your Google Account connections. Revoking that connection does not itself delete existing Aurora records; contact us to request deletion.

Why we use it and who can access it

We use information to provide the workspace, control access, deliver service messages, manage invoices, process and reconcile payments, support clients and investigate account, security or payment problems. We do not sell personal information or use Aurora account information for targeted advertising.

Your organization’s owners and administrators can manage team access and billing. Members can view assigned reports and their own account settings. FarFlash platform administrators operate the service and manage client organizations. Your organization determines what it shares in its workspace; contact it about information it supplies or how it uses that information.

Service providers and international processing

We use Supabase for authentication, databases and private file storage; Vercel for hosting; Resend for service email; and Stripe and PayPal for their respective payment methods. These providers receive information needed to deliver, secure and support their services. Payment credentials entered in a processor’s checkout are handled by that processor; Aurora retains transaction and provider references rather than full card numbers or card security codes.

Information may be processed outside Canada, including in the United States, where the currently provisioned Aurora databases are hosted. It may be subject to the laws and lawful access requirements of those jurisdictions. We may also disclose information where required by law or necessary to investigate fraud, protect rights or address a security incident.

Cookies and safeguards

Aurora uses cookies to maintain sign-in sessions and invitation flows. Blocking these cookies can prevent those features from working. Payment and sign-in providers may use their own cookies when you use their services.

Access controls, organization permissions, private file storage and audit records help protect information. Access to client reports and billing depends on your role. No online service can guarantee absolute security.

Retention and deletion

We retain information for as long as needed to provide the service and meet applicable accounting, legal, security and dispute-resolution requirements. The period depends on the type of record, the client relationship and any outstanding obligation or dispute. When information is no longer needed for those purposes, it is deleted or de-identified.

Removing an organization membership or expiring an invitation does not automatically erase an account, report, invoice or audit record. Deletion requests are reviewed individually, including any records your organization needs to retain. Some information may remain in backups until those backups are replaced or expire. We can explain what can be deleted and what must be retained when you contact us.

Your choices and requests

You can update the account settings available to you in Aurora. To request access to, correction of or deletion of your personal information, withdraw consent, or raise a privacy concern, email hello@farflash.com with “Aurora privacy” in the subject. Include the email you use for Aurora and the organization involved; do not send passwords or full payment credentials. We may need to verify your identity and coordinate with your organization before acting.

Withdrawing information needed for authentication or billing may prevent us from continuing the related service. Access and deletion requests are subject to applicable law and the rights of other people.

Changes to this policy

We will post updates on this page and change the effective date. If a change materially affects how Aurora uses your personal information, we will provide additional notice where required.