Privacy Policy
Last updated: February 2026
This Privacy Policy explains how Aurea CV OÜ ("SeCoFlow", "we", "us", or "our") collects, uses, and protects your personal data when you visit our website at secoflow.com or use our services.
Aurea CV OÜ is the data controller. We are registered in Estonia (Reg. #: 16944269, VAT: EE 102718876), with our registered address at Saani 2/2-26, 10149 Tallinn, Estonia.
1. Information We Collect
1.1 Information You Provide
- Account information: name, email address, and password when you create an account.
- Billing information: payment details (processed securely by Stripe — we do not store full card numbers).
- Customer Content: text, URLs, and data you submit to our platform for content optimisation.
- Communications: messages you send to us through contact forms, email, or support channels.
- Newsletter subscription: email address when you subscribe to our newsletter.
1.2 Information Collected Automatically
- Usage data: pages visited, features used, actions taken within the platform.
- Device and browser information: browser type, operating system, screen resolution, and language preferences.
- IP address: used for security, fraud prevention, and approximate geographic location.
- Cookies and local storage: as described in our Cookie Policy.
1.3 Information We Do Not Collect
- API keys: when you use our BYOK (Bring Your Own Key) features, your AI provider API keys are encrypted client-side. We do not store your API keys in plain text on our servers and do not have access to them.
- AI provider usage data: interactions between your API keys and third-party AI providers are direct. We do not log or monitor your AI provider usage.
2. How We Use Your Information
We process your personal data for the following purposes:
| Purpose | Legal Basis (GDPR) |
|---|---|
| Providing and operating the service | Performance of contract (Art. 6(1)(b)) |
| Processing payments and managing subscriptions | Performance of contract (Art. 6(1)(b)) |
| Sending transactional emails (account confirmations, billing receipts) | Performance of contract (Art. 6(1)(b)) |
| Sending marketing emails and newsletters | Consent (Art. 6(1)(a)) |
| Responding to your enquiries and support requests | Legitimate interest (Art. 6(1)(f)) |
| Improving and developing our products | Legitimate interest (Art. 6(1)(f)) |
| Preventing fraud and ensuring security | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
3. Information Sharing
We do not sell your personal data. We may share information with the following categories of recipients:
- Payment processor: Stripe processes your payment information on our behalf. See Stripe's Privacy Policy.
- Infrastructure providers: hosting and cloud services that store and process data on our behalf, under data processing agreements.
- Email services: for sending transactional and marketing emails on our behalf.
- Legal and regulatory authorities: when required by law, regulation, or legal process.
All third-party service providers are contractually required to protect your data and may only process it for the purposes we specify.
4. International Data Transfers
Aurea CV OÜ is based in Estonia (European Union). Some of our service providers may process data outside the EU/EEA. Where this occurs, we ensure appropriate safeguards are in place, such as EU Standard Contractual Clauses or an adequacy decision by the European Commission.
5. Data Retention
- Account data: retained for as long as your account is active and for 30 days after account deletion, during which you may request an export.
- Customer Content: deleted within 30 days of account termination.
- Billing records: retained for up to 7 years to comply with tax and accounting obligations.
- Marketing consent records: retained for as long as the consent is valid and for 3 years after withdrawal for compliance purposes.
- Support correspondence: retained for up to 2 years after the last interaction.
6. Your Rights
Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:
- Access: request a copy of the personal data we hold about you.
- Rectification: request correction of inaccurate or incomplete data.
- Erasure: request deletion of your personal data ("right to be forgotten").
- Restriction: request that we limit the processing of your data in certain circumstances.
- Portability: receive your data in a structured, commonly used, machine-readable format.
- Objection: object to processing based on legitimate interests, including direct marketing.
- Withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, email us at [email protected]. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. For Estonia, this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
7. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption of data in transit (TLS/HTTPS).
- Client-side encryption of API keys (BYOK).
- Access controls limiting who can access personal data within our organisation.
- Regular security reviews of our infrastructure and code.
No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
8. Children
SeCoFlow is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through the service and update the "Last updated" date at the top of this page. We encourage you to review this page periodically.
10. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us:
Aurea CV OÜ
Saani 2/2-26, 10149 Tallinn, Estonia
Reg. #: 16944269 | VAT: EE 102718876
Email: [email protected]