Privacy Policy

1. Introduction — Who we are

This Privacy Policy explains how we collect, use, share and protect personal information, and the rights you have over your data.

Aura Systems Ltd. ("Aura Systems", "we", "us" or "our") is the data controller responsible for the personal information described in this policy. We are based in the United Kingdom and we operate HushFun.com — a profile-based social and community application focused on adult kink and relationship education and community.

HushFun.com is built for a privacy-conscious adult community. We have designed our products around a simple principle: collect as little personal information as possible, and look after whatever we do collect.

As a UK organisation that processes personal data, we are registered with the UK Information Commissioner's Office (ICO), the United Kingdom's independent data protection authority.

• Data controller: Aura Systems Ltd.
• Location: United Kingdom
• ICO registration: Registered with the UK Information Commissioner's Office.
• Privacy contact: privacy@hushfun.com

If you have any questions about this policy or how we handle your information, please contact us using the details in Section 17 (How to contact us).

2. Scope of this policy — the website vs the app

This policy covers two distinct things. The difference matters, because the data we collect is very different in each case:

1. The HushFun.com marketing website — the public-facing website where you can read about HushFun.com, browse educational content and learn about our community. For general visitors, we do not store personal information about you.
2. The HushFun.com app — the profile-based social and community application that you register for and log in to. When you create an account and use the app, we do collect and process personal information so the service can work.

The marketing website is separate from the app itself. Wherever it matters, we have made clear below which part of the service a given practice relates to.

This policy does not cover the practices of third parties we do not control, including any external websites or services you reach through links from our website or app. See Section 14 (Third-party links).

3. What data we collect

We have split this into four clear categories so you can see exactly what applies to you.

3.1 Website visitors — no personal information stored

If you simply browse the HushFun.com marketing website without registering, we do not store personal information about you.

Optional analytics and advertising cookies are used only with your consent, which you give through our cookie banner and can withdraw at any time. With your consent, we use analytics to understand how the website is used overall, for example:

• which pages and articles are most popular;
• how the website is performing (for example, page load speed); and
• whether any errors are occurring that we need to fix.

We look at this information in aggregate to understand overall usage patterns rather than to identify you personally. We explain the cookies and providers involved, and how to control them, in Section 8 (Cookies & analytics).

3.2 Registered app users — account and registration data

When you register to use the HushFun.com app, we collect personal details so we can create and operate your account. The data we typically collect at and after registration includes:

• Email address — used for your account, sign-in, verification and important service communications;
• Username / display name — the name you choose to be known by within the community;
• Authentication credentials — for example a password (which is stored in a securely hashed form, never in plain text) and, where used, multi-factor authentication details;
• Date of birth / age verification information — because HushFun.com is an adult platform, we verify that you are at least 18 years old (see Section 13 (Children's privacy));
• Profile information — the details you choose to add to your profile, which may include things such as a bio, interests, preferences and similar information; and
• Optional location information — if you choose to provide it (see Section 3.4).

Some of this information is required to create an account; other information is optional and entirely up to you to provide.

3.3 User-generated content — images, video and audio

Because HushFun.com is a profile-based community platform, you can upload and share user-generated media, including images, videos and audio recordings, as part of your profile and your participation in the community.

• How it is processed and stored: Media you upload is stored on our hosting and storage infrastructure (and that of our trusted processors — see Section 9) so that it can be displayed within the app as you intend. Media may be processed for technical purposes such as format conversion, generating previews/thumbnails, and to support our safety and moderation systems.
• You are responsible for what you upload: You should only upload content that you have the right to share, that depicts only consenting adults, and that complies with our terms and community guidelines. Please think carefully before uploading any sensitive or intimate media.
• How you can delete it: You can remove media you have uploaded at any time from within the app. When you delete content, we remove it from active display and delete it from our systems within 30 days, subject to short-term backup retention and any legal obligation to retain certain records. See Section 11 (Data retention).

3.4 Location data — and our "fuzzy proximity" approach

Location is optional. You are never required to share your location to use HushFun.com.

If you choose to provide your location, you can see the general location of other users, and they can see your general location, for example to find community or connections near you.

We deliberately do not reveal anyone's exact location. Keeping that detail private is one of the main ways we protect our users' privacy and safety. We call this our "fuzzy proximity" approach:

• We show only an approximate, generalised proximity (for example, a sense of how near or far another user is), never a precise address, precise coordinates or a pinpoint on a map.
• The level of detail is intentionally reduced so that a user's exact whereabouts cannot be derived from what is shown to others.
• This design choice means you can benefit from local connection and community without exposing exactly where you are.

You can change or remove your location information at any time in your settings.

4. How we collect your data

We collect personal information in the following ways:

• Directly from you — when you register, complete or update your profile, upload media, enter optional location information, or contact us (for example by email).
• Automatically, with your consent — through analytics on the marketing website (which pages are popular, how the site is performing, and error detection). Where this relies on non-essential cookies, we use them only after you opt in (see Section 8).
• Through your use of the app — technical and account information generated as you use the service, such as authentication events and content you choose to create or share.
• From our service providers — limited information from the trusted processors that help us run the service (for example, our hosting, storage and age/identity verification providers). See Section 9.

5. Legal bases for processing (UK GDPR / EU GDPR Article 6)

Under the UK GDPR and EU GDPR, we must have a lawful basis to process your personal information. Depending on the situation, we rely on one or more of the following:

• Performance of a contract — to create and operate your account and provide the HushFun.com service you have asked for (for example, processing your registration details, profile and uploaded content so the app works).
• Consent — where you have given us clear consent for a specific purpose, such as providing optional location data, sharing certain optional profile details, or where consent is otherwise required. You can withdraw your consent at any time (see Section 12).
• Legitimate interests — where it is reasonably necessary for purposes that do not override your rights and freedoms, such as keeping our service secure, detecting and preventing fraud or abuse, understanding aggregate website usage to improve our content, and maintaining the safety of our community. Where we rely on legitimate interests, we have considered the impact on you.
• Legal obligation — where we must process information to comply with the law (for example, responding to lawful requests, meeting age-verification and record-keeping requirements, or complying with our regulatory duties).

Because HushFun.com is an adult platform, some information you choose to share may be more sensitive in nature. Where we process information that attracts additional protection under data protection law, we rely on an appropriate additional condition for processing — typically your explicit consent and/or the fact that you have manifestly made the information public by choosing to share it within the community. [Legal counsel to confirm the appropriate Article 9 / special category and equivalent conditions.]

6. How we use your data (purposes)

We use personal information for the following purposes:

• To create, operate and secure your account and provide the HushFun.com service;
• To display your profile and content to others as you intend, within the app;
• To verify your age and confirm you are eligible to use an adult platform;
• To enable optional location-based features using our fuzzy proximity approach;
• To communicate with you about your account, important service updates, security notices and support requests;
• To keep the community safe — including moderation, enforcing our terms and community guidelines, and detecting and preventing abuse, fraud and prohibited content;
• To maintain and improve our service — including understanding aggregate website usage, monitoring performance and detecting and fixing errors;
• To comply with our legal and regulatory obligations; and
• To establish, exercise or defend legal claims where necessary.

We do not use your personal information to build advertising profiles, and we do not sell it (see Section 9).

7. Our "fuzzy proximity" location explanation

We have given location its own short section because we think it matters most to our users' safety.

When location features are enabled, HushFun.com never shares your exact location with other users. Instead, we apply fuzzy proximity: we reduce and generalise location detail so that only an approximate sense of distance or general area is shown. We built it to work this way on purpose, to protect your privacy and safety.

In practice this means:

• Other users can get a general sense of how near you might be — useful for local community and connection.
• Other users cannot see your precise location, address or coordinates.
• The same protection applies in reverse: you see only the general proximity of others, never their exact whereabouts.

Location remains optional and fully under your control, and you can disable or remove it at any time.

8. Cookies & analytics (the website)

We keep data collection on the marketing website to a minimum, and we split cookies and on-device storage into two groups: strictly necessary (always on, because the service cannot work without them) and optional (analytics and advertising, used only with your consent).

• When you first visit, optional cookies are off by default. We ask for your consent through a cookie banner before any analytics or advertising cookies are set.
• Our website analytics is provided by Cloudflare and Google Analytics (GA4), configured to respect your consent choice and to be compliant with the UK GDPR, PECR and EU law. Google Analytics sets non-essential cookies (for example _ga) only after you opt in.
• We use analytics only to understand aggregate usage — which content is popular, how the site is performing, and whether errors are occurring — so we can improve the experience and fix problems.
• You can change or withdraw your consent at any time, and declining optional cookies does not affect your ability to use the website.

8.1 Cookies and local storage we use

Under UK PECR and ICO guidance, technologies such as localStorage that store identifiers on your device are treated similarly to cookies, so we disclose them here too. The marketing website has no backend of its own: the only things it stores on your device without your consent are an optional guest-chat profile and a small cookie that remembers your cookie-consent choice (described below). Any analytics or advertising cookies are non-essential and are set only with your consent. Authentication and other account features run on the separate HushFun app at app.hushfun.com, which is where the login and session cookies are set.

The table below sets out the cookies and on-device storage involved in using HushFun, who sets them, and whether they are strictly necessary or optional.

The items marked strictly necessary above are required to provide the service and do not need your consent. Everything marked optional — analytics, advertising and the approximate-location feature — is used only with your consent and can be declined or withdrawn at any time. We do not sell your personal information, and we do not use these cookies to build hidden profiles about you.

8.2 Controlling cookies

When you first visit, our cookie banner lets you Accept all or Customise your choice per category (analytics and advertising can each be turned on or off, and you can decline them by leaving them off; strictly necessary cookies are always on). You can change or withdraw your consent at any time, and you can also control or delete cookies through your browser settings — most browsers let you block or clear cookies and on-device storage. Please note that the items marked strictly necessary above are needed to provide core functionality — blocking or deleting them may stop you signing in, break your session, or reset the guest-chat preview.

9. Data sharing and disclosure

We do not sell your personal data to third parties. We also do not "share" it for cross-context behavioural advertising as those terms are defined under California law.

We do share limited personal information in the following circumstances:

9.1 Service providers (processors and sub-processors)

We work with trusted third parties who process personal information on our behalf and under our instructions, only to the extent needed to provide their service to us. These include:

• Hosting and infrastructure providers [e.g. cloud hosting provider];
• Storage providers for user-generated media (images, video and audio) [e.g. object storage provider];
• Analytics providers (consent-based, aggregate website analytics) — Cloudflare and Google Analytics;
• Age and identity verification providers used to confirm you are 18 or over [e.g. age verification provider];
• Communications/email providers used to send service messages [e.g. transactional email provider]; and
• Safety, moderation and security providers that help us keep the community safe [e.g. content moderation/anti-abuse provider].

We put appropriate data processing agreements in place with these providers requiring them to protect your information and use it only for the purposes we specify. A current list of key sub-processors is available on request.

9.2 Legal and safety disclosures

We may disclose personal information where we reasonably believe it is necessary to:

• comply with a legal obligation, court order or other lawful request;
• enforce our terms and community guidelines;
• detect, prevent or address fraud, security or abuse issues; or
• protect the rights, safety and property of our users, the public or Aura Systems.

9.3 Business transfers

If Aura Systems is involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction. We will take steps to ensure your information remains protected and will notify you where required by law.

10. International data transfers

We are based in the United Kingdom, and your information may be processed in the UK, the European Economic Area (EEA), or other countries where our service providers operate.

Where we transfer personal information outside the UK or EEA to a country that is not covered by an "adequacy" decision, we put appropriate safeguards in place to protect it, such as:

• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; and/or
• the EU Standard Contractual Clauses (SCCs); and/or
• for transfers to certified organisations in the United States, the UK Extension to the EU–US Data Privacy Framework (DPF).

Where a country is covered by UK "adequacy" regulations (including the EEA), no additional safeguard is required. Otherwise we rely on one of the mechanisms above, together with any additional measures needed to protect your information. Our processors are located in the UK, the EEA and other countries; we keep an internal record of where each processor operates and the transfer mechanism that applies. You can request more information about these safeguards, and a current list of relevant processor locations, using the contact details in Section 17.

11. Data retention

We keep personal information only for as long as we need it for the purposes set out in this policy, after which we delete or anonymise it.

• Website visitor analytics: aggregate and anonymous, retained in aggregate form for 24 months.
• Account and profile data: retained while your account is active, and deleted within 30 days after account deletion, subject to short-term backups and legal requirements.
• User-generated media (images, video, audio): retained while present on your profile/account; deleted within 30 days of you removing it or closing your account.
• Age-verification records: retained only as long as necessary to meet our legal and regulatory obligations as required by applicable age-assurance regulations. Note: We do not store personal details like id documents, but we do retain a record of the verification outcome and the date it was performed.
• Records we are legally required to keep: retained for the period required by law.

Where complete deletion is not immediately possible (for example, in secure backups), we isolate the information and protect it until deletion is possible.

12. Data security

We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse or alteration, including:

• encryption of data in transit and, where appropriate, at rest;
• secure, hashed storage of authentication credentials (we never store passwords in plain text);
• access controls and the principle of least privilege for our staff and systems;
• monitoring, logging and safeguards to detect and respond to security issues; and
• contractual security obligations on our service providers.

No method of transmission or storage is ever completely secure, so while we work hard to protect your information, we cannot guarantee absolute security. Please help protect your own account by using a strong, unique password and keeping your credentials confidential.

13. Your rights

You have a number of rights over your personal information. We will not discriminate against you for exercising any of them. To make a request, contact us at privacy@hushfun.com (see Section 17). We may need to verify your identity before acting on certain requests, and we will respond within the time limits required by law.

13.1 Your rights under UK GDPR and EU GDPR

• Right to be informed — to know how your data is used (this policy).
• Right of access — to request a copy of the personal information we hold about you.
• Right to rectification — to have inaccurate or incomplete information corrected.
• Right to erasure ("right to be forgotten") — to ask us to delete your information in certain circumstances.
• Right to restrict processing — to ask us to limit how we use your information in certain circumstances.
• Right to data portability — to receive certain information in a structured, commonly used, machine-readable format and, where feasible, have it transmitted to another controller.
• Right to object — to object to processing based on legitimate interests.
• Right to withdraw consent — where we rely on your consent, you can withdraw it at any time, without affecting processing carried out before withdrawal.
• Right to complain — to lodge a complaint with a supervisory authority (see Section 18).

13.2 Your California rights (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to know — to request the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties with whom we share it.
• Right to delete — to request deletion of personal information we have collected from you, subject to legal exceptions.
• Right to correct — to request correction of inaccurate personal information.
• Right to opt out of the sale or sharing of personal information — note that we do not sell your personal information, and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of in this respect.
• Right to limit use of sensitive personal information — to direct us to limit the use of sensitive personal information to permitted purposes.
• Right to non-discrimination — we will not discriminate against you for exercising any of your privacy rights.

You may submit a request by emailing privacy@hushfun.com. You may use an authorised agent to make a request on your behalf, subject to verification.

13.3 Your regional rights (other jurisdictions)

We aim to respect equivalent privacy rights wherever you live, including:

• Canada (PIPEDA): rights to access and correct your personal information and to withdraw consent, and protections based on fair information principles.
• Australia (Privacy Act / Australian Privacy Principles): rights to access and correct your personal information and to make a privacy complaint.
• Brazil (LGPD): rights including confirmation of processing, access, correction, anonymisation or deletion, portability, information about sharing, and withdrawal of consent.

If you are located in another country with applicable data protection laws, please contact us — we will honour the rights available to you under those laws. [Legal counsel to confirm any country-specific mechanisms or representatives required, e.g. an EU/UK representative or LGPD DPO.]

14. Children's privacy (18+)

HushFun.com is an adult platform and is strictly for people aged 18 or over.

The service is not intended for, and must not be used by, anyone under the age of 18. We require age verification at registration and we do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a person under 18, we will delete that information and close the account.

If you believe a minor has provided us with personal information, please contact us immediately at privacy@hushfun.com.

15. Third-party links

Our website and app may contain links to third-party websites, services or resources that we do not operate or control. This Privacy Policy does not apply to those third parties. We are not responsible for their content or privacy practices, and we encourage you to read the privacy policy of any third-party service before providing it with your personal information.

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or for other operational reasons. When we make material changes, we will update the "Last updated" date at the top of this policy and, where appropriate, provide a more prominent notice (for example, within the app or by email).

It is worth looking over this page now and again, so you stay up to date with how we handle your information.

17. How to contact us

If you have any questions, concerns or requests about this Privacy Policy or your personal information, please contact us:

• Email: privacy@hushfun.com
• Data controller: Aura Systems Ltd., United Kingdom
• Postal address: 167-169 Great Portland Street, Fifth Floor, London W1W 5PF

If something is troubling you, we will work with you to put it right.

18. Complaining to the ICO and other supervisory authorities

You have the right to lodge a complaint with a data protection supervisory authority. We would appreciate the chance to address your concerns first, so please consider contacting us before you do.

If you are in the United Kingdom, you can complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom

If you are in the EEA, you can complain to your local data protection authority. If you are elsewhere, you can complain to the relevant authority in your country.