Privacy Policy — AURA CAPITAL

Draft — not lawyer-reviewedThis document is a working draft template prepared for this build. It has not been reviewed by a qualified lawyer in any jurisdiction, it does not yet identify the governing jurisdiction or the contracting parties, and it must not be relied upon as a binding agreement. Before any real transaction, a qualified legal professional must complete, adapt, and approve it.

1. Who is responsible for your data

The marketplace at this domain is operated by Nexus Acquisitions, a sole proprietorship, under the brand AURA CAPITAL. Nexus Acquisitions is the data controller for information submitted through this site. No separate corporate entity or data protection officer has been appointed at this stage.

To be completed before use: registered business address, data protection contact, and the applicable supervisory authority.

2. What we collect

Account information

Name, email address, and a password stored only as a salted PBKDF2 hash.
Optional entity name and country of residence or establishment.
Session records: a hashed session token, the CSRF token, a truncated browser user-agent string, and expiry times.

Seller submission information

Contact name and business email address.
Business name, website or asset URL, sector, monetisation model, and business age.
Reported annual gross revenue and annual net profit, asking price, and traffic or customer metrics.
Business description and stated reason for selling.
Supporting financial documents you choose to upload.
Attestation records: that accuracy was confirmed and which terms version was accepted, with a timestamp.

Buyer application information

Full name, business email, entity name, and country.
Preferred sectors, target price range, monetisation preferences, timeline, and stated experience.
Declared capital allocation.
Confidentiality acknowledgment: the agreement version, a UTC timestamp, and the requesting IP address.

Technical and security information

IP address, used for rate limiting, security auditing, and recording agreement acceptance.
Audit records of privileged actions such as status changes and confidential-record access.
Blocked-message records when the deal-room filter intervenes, including an excerpt of the refused text.

3. Why we process it, and on what basis

To provide the service you requested — account creation, intake, review, and marketplace access. Legal basis: performance of a contract or steps taken at your request.
To protect the marketplace and its participants — authentication, session management, rate limiting, message filtering, audit logging. Legal basis: legitimate interests in security and fraud prevention.
To evidence agreement acceptance — recording the version, timestamp, and IP at the moment a confidentiality acknowledgment is accepted. Legal basis: legitimate interests in being able to demonstrate the terms that applied.
To meet legal obligations — where applicable record-keeping or disclosure duties arise. Legal basis: compliance with a legal obligation.

We do not sell personal information, do not use it for advertising, and do not build behavioural profiles for marketing.

4. Location of storage and processing

The application runs on Cloudflare's edge network. Application data is stored in a Cloudflare D1 database and uploaded documents in a Cloudflare R2 bucket with public access disabled. Cloudflare operates infrastructure globally, so data may be processed in regions outside your own. Where that constitutes a cross-border transfer, appropriate safeguards must be identified before production use.

To be completed before use: confirm the specific storage region(s), the transfer mechanism relied upon, and whether any additional processor agreements are required.

5. Who can access your information

You — your own account, applications, documents, and deal rooms.
Authorised reviewers and administrators — to assess applications, publish listings, and moderate deal rooms.
The counterparty — only for information released within a deal room you are a participant in, or confidential listing detail published for approved buyers.

Confidential listing information is withheld from visitors and from applicants who have not been approved. Access control is enforced on the server for every confidential record; it is not a matter of hiding interface elements.

6. How long we keep it

Account and application records — retained while your account is active and for a period afterwards sufficient to evidence application decisions.
Uploaded financial documents — retained while a submission is live and for a defined period after a decision, then deleted or returned on request.
Session records — deleted on sign-out or expiry (7 days), and purged on access when expired.
Audit records — retained for a defined period because their value is historical.
Blocked-message excerpts — retained for review and appeal handling, then purged.

To be completed before use: set a specific number of months for each category above and put a deletion routine in place. A policy that states a period without an enforceable routine is not a retention policy.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or export your personal information, and to object to processing based on legitimate interests. You may also have the right to complain to a supervisory authority.

Because this marketplace has no published contact channel yet, these rights cannot currently be exercised through a stated route. That is a real gap, not a formality.

To be completed before use: publish a monitored contact route, define a response window, and document the verification steps used before acting on a request.

8. Cookies

This site sets two cookies, both strictly necessary:

aura_sid — the session cookie. HTTP-only, SameSite=Lax, Secure over HTTPS, 7-day expiry. It contains a random token, not your identity.
aura_csrf — a double-submit CSRF token, readable by the page so it can be echoed in forms. It contains no personal data.

There are no analytics cookies, advertising cookies, or third-party tracking scripts on this site.

9. Security measures in place

Passwords hashed with PBKDF2-HMAC-SHA256 at 100,000 iterations and a unique 16-byte salt.
Session tokens stored only as SHA-256 hashes, so a database copy cannot be replayed.
All state-changing requests require a CSRF token that must match the visitor's cookie.
Server-side authorization on every confidential and administrative route.
Uploads validated by MIME type and size, hashed, and stored in private object storage.
Parameterised database queries throughout, with no string-concatenated SQL.
Security headers including CSP, X-Frame-Options, and nosniff.
Rate limiting on authentication and submission endpoints.

No system is impenetrable. This policy does not claim compliance with any specific privacy or data protection framework, because no formal assessment has been carried out.

10. Children

The marketplace is intended for business owners and acquisition participants. It is not directed at children and should not be used by anyone under 18.

11. Changes

This draft will change. Material changes should be notified to registered users, and the "last updated" date above should be revised. Continuing to use the marketplace after a change does not, by itself, establish consent to a materially different policy.