Effective date: August 28, 2026
This Privacy Policy explains how Aura Space Plan ("the Service", "we", "us") collects, uses, shares and protects personal data. It should be read together with our Terms of Service and, for personal data an Organizer collects about their own event guests, our Data Processing Addendum.
1. Who we are
Aura Space Plan is operated by Sasa Arsenovic (trading as "ArsAxis"), Belgrade, Serbia ("we", "us", "our").
For the personal data of Organizer and Staff accounts described below, we act as the data controller under Regulation (EU) 2016/679 ("GDPR") and Serbia's Law on Personal Data Protection ("ZZPL"). Where we process personal data about an Organizer's event Guests, we act as a data processor and the Organizer is the controller — see Section 11 and our Data Processing Addendum.
For any privacy question or request, contact us at [email protected].
2. Two kinds of personal data
Aura Space Plan is a multi-tenant event and venue management platform: an Organizer signs up, creates Venues, and manages Events, Staff, menus and guest lists. Two different kinds of personal data flow through it, and they are treated differently:
- Account data — the Organizer's own details and those of their Staff, created when they sign up or are added by an Organizer. We are the controller of this data.
- Guest data — the names, phone numbers and related details of the Organizer's own event guests, entered by the Organizer (typed in or imported from a spreadsheet). We are the processor of this data; the Organizer decides what to collect and why.
3. What we collect
- Organizer & Staff account data: name, email address (used as the sign-in username), phone number, business address, a salted password hash (we never store your password itself), and optional website/social links, logo and branding images.
- Guest data (entered by an Organizer about their own guests): name, phone number, number of accompanying guests and their names if provided, table assignment, seating notes, and food/dietary restriction notes. Dietary notes can incidentally reveal health- or religion-related information (e.g. an allergy or a religious dietary practice) — see Section 11.
- Technical data: your IP address (used transiently to rate-limit requests and prevent abuse), standard browser/device information sent with any web request, and the cookies described in Section 5.
- Images you upload (logos, event artwork) are stored on our infrastructure and validated by their actual file content, not just the filename or declared type.
4. How we use it, and on what legal basis
- To create and operate your account, and to provide the features you use — necessary to perform our contract with you.
- To secure the Service, prevent abuse, and enforce rate limits on public links (invitation QR codes, venue flyers) — our legitimate interest in keeping the Service safe and available.
- To respond to support requests and legal obligations.
- To diagnose errors: when configured, error events are sent to a Sentry-compatible error tracker. Session cookies and Authorization headers are stripped before an error ever leaves the app, and error tracking captures failures, not your data or activity — our legitimate interest in keeping the Service reliable.
We never use your data, or your guests' data, for advertising, and we never sell personal data to anyone.
5. Cookies
- A session cookie, encrypted and cryptographically authenticated, that keeps you signed in. Strictly necessary; expires after 12 hours or when you log out.
- A language-preference cookie, remembering whether you last chose English or Serbian. Strictly necessary for the interface to work as you left it; kept for one year.
We do not use advertising or analytics cookies, and no third-party script, font or tracker loads in your browser when you use the Service — everything the interface needs is served from our own infrastructure.
6. Who we share data with
We use a small number of infrastructure providers ("sub-processors") to run the Service. None of them may use your data for their own purposes.
- Railway Corporation — application hosting.
- Cloudflare, Inc. — object storage for uploaded images (R2), and DNS/TLS for our custom domain.
- A Sentry-compatible error-tracking provider — only if configured; receives error diagnostics with cookies and auth headers already stripped, never guest or tenant content.
- A managed database host — currently a database file on our own hosting; we plan to move to a managed PostgreSQL provider (see Section 8 for what that changes and doesn't).
We do not sell personal data, and we do not share it with advertisers or data brokers.
7. International transfers
Some of the providers listed above are based outside Serbia and the EU/EEA (Railway and Cloudflare are US-based, though the servers we use may sit in a specific region we select). Where personal data is transferred outside Serbia or the EU/EEA, we rely on the transfer safeguards those providers offer — standard contractual clauses or an equivalent mechanism — rather than transferring data without any safeguard.
We have not yet appointed an EU representative under GDPR Article 27. If our processing of EU/EEA residents' data grows beyond occasional, small-scale activity, we will appoint one; until then, EU/EEA data subjects can exercise their rights directly through the contact in Section 10.
8. How long we keep data
- Guest and event data is deleted automatically. Each Organizer sets a retention window (3 or 7 days after the event; 3 days if never chosen — there is no "keep forever" option). Once that window passes, the entire event — its guests, seating, waiter-call history and activity log entries — is permanently erased, not archived.
- Account data (Organizer, Staff, Venues, Events, media) is kept while the account is active, and is permanently and irreversibly deleted — every venue, event, guest record, staff record, uploaded image and activity-log entry — when an Organizer account is deleted by an administrator.
- We keep short-term database backups (currently up to the 14 most recent, roughly a two-week window) so we can recover from technical failure. A deletion can therefore persist in a backup for a short time after it disappears from the live Service, until that backup is rotated out.
9. Security
- Your session cookie is encrypted and then authenticated (not the other way around) so it cannot be edited or forged client-side.
- Passwords are stored as salted hashes, never in plain text.
- Uploaded files are size-capped and checked against their actual file content, not just their declared type.
- Production traffic runs over HTTPS with HSTS enabled.
- Every Organizer's data is isolated from every other Organizer's at the application level — one tenant cannot read or modify another's records.
10. Your rights
Under GDPR and ZZPL, you have the right to: access the personal data we hold about you; have inaccurate data corrected; request erasure; restrict or object to certain processing; receive your data in a portable format; and withdraw consent at any time where processing is based on consent.
- To exercise any of these rights over your own Organizer or Staff account data, email [email protected].
- If you are an event guest and want to exercise rights over data an Organizer entered about you, please contact that Organizer or venue directly — they are the controller of that data (Section 11). We will assist them in responding to your request.
- You may lodge a complaint with Serbia's Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti), or, if you are in the EU/EEA, with your local data protection supervisory authority.
11. Guest data specifically
When an Organizer adds guests to their guest list, the Organizer decides what personal data to collect and why, and is the data controller for that data under GDPR/ZZPL. We process it strictly on the Organizer's instructions, as their processor, under the terms of our Data Processing Addendum — we do not use guest data for our own purposes, do not contact guests on our own initiative, and do not analyze it beyond what the Service itself needs to function (for example, seating and capacity calculations).
If dietary/food-restriction notes reveal health- or religion-related information, that is a choice the Organizer makes when collecting it from their guests — Organizers should collect only what they need and have an appropriate basis (typically the guest's own disclosure for hospitality purposes) for doing so.
12. Children
Creating an Organizer or Staff account is intended for business use by adults. Organizers may include the names of minors in a guest list (for example, a family event) solely for venue/seating management; Organizers are responsible for having an appropriate basis to include a minor's data in their guest list.
13. Changes to this Policy
We may update this Policy as the Service changes. We will update the effective date above when we do; material changes will be highlighted in the app.
14. Contact
Sasa Arsenovic (trading as ArsAxis), Belgrade, Serbia — [email protected]