AuraStack

Privacy Policy

Last updated 10 October 2026

1. Commitment to Customer Privacy

AuraStack is run by Bakchich SAS (RCS Marseille 942 552 274), Marseille Innovation, Pôle Média, 37 rue Guibal, 13003 Marseille, France, which is responsible for your personal data. We do not sell or rent customer personal information. We collect the information necessary to fulfill digital software orders, attribute referral partnerships, and measure the performance of our own website and advertising, as described below.

2. Information We Collect

  • Digital Delivery Email: Collected during checkout to deliver your software activation codes, redemption credentials, and transactional invoices. If you pay with Dhmad, it is also shared with Dhmad so it can send you its payment receipt. A one-way hash of it is also used for advertising measurement, as described below.
  • Checkout Reminders: If you start a PayPal checkout and do not pay, we may email you up to two reminders about that order (the first within a day, the second within about three days with a discount code), at most once every 30 days and never after you have bought from us. This is in our legitimate interest in completing orders you started; it is said under the email field at checkout. Reply STOP to any of our emails and we will not email you again except for your orders.
  • Order Follow-up Emails: After we deliver an order to your email, we may email you: a check-in a few days later to make sure it works, then a request to review it; after a purchase, a few similar products from the same collection; reminders shortly before a plan you bought ends; and, months after your last order, news from the store. Apart from the check-in and the last renewal reminder, at most one of these emails a week, counting checkout reminders. A gift sent from a signed-in account gets none of them; if someone else ordered for you without an account, unsubscribe or reply STOP. This is in our legitimate interest in serving existing customers with similar products; it is said under the email field at checkout. Every one of them has a one-click unsubscribe link, and replying STOP works too: we then email you only about your orders.
  • Product Reviews: If you review a delivered order, your rating and comment are published on the product page with your country (from your payment or billing details) and the date, never your name or email. Every reviewer gets a 10% code for their next order, whatever the rating, bound to the order's email. We hide a review only for contact details, insults or someone else's personal data, or when its author asks us to, and keep it on record; ask us through the support chat to remove yours.
  • People Browsing Now: While a page is open, your browser sends a ping every 30 seconds with a random session reference (kept in your browser for that visit only) and, on a product page, the product you are looking at. We use it only to count visitors seen in the last two minutes; we store no IP address or browser details with it, and delete pings after a day.
  • Billing Details: Your billing country, and if you buy for a company its name and VAT number, collected at checkout to charge the right VAT and to issue your invoice. A VAT number is checked with the European Commission's VIES service, which returns the company name and address registered for it. The country your connection comes from is used to apply EU VAT when it is in the EU.
  • Transaction References: Payment references (PayPal, NOWPayments or Dhmad), Order IDs, and fulfillment timestamps. We never store credit card numbers, CVVs, or full payment credentials on our servers; all payment processing is handled off-site by the payment provider you choose: PayPal, NOWPayments for cryptocurrency, or Dhmad for payments from Tunisia.
  • Affiliate Attribution Cookies: When you access AuraStack through an affiliate referral link, a secure 30-day first-party cookie (`aura_ref`) is created to attribute partnership commissions, with a second cookie (`aura_ref_via`) that records which partner link you came through (the store or a product page). These cookies contain no personally identifiable data.
  • Partner Sign-in Cookies: When a partner signs in to the partner dashboard, we set a secure session cookie (`aura_partner_session`, kept for 30 days, or until the browser closes if you choose not to stay signed in) and a cookie holding your partner code and when the session ends (`aura_partner`), so the site header can show that you are signed in. Signing out ends the session and removes both cookies.
  • Website Analytics: We use Google Analytics to understand how our store is used. It sets first-party cookies (`_ga` and `_ga_*`, kept for up to 2 years) and receives the pages you visit, your browser details and approximate location, and the products you view, start checking out and buy (product, quantity, price, order reference and payment method). Order access links are removed from page addresses before any analytics tool reads them.
  • Advertising Measurement (OpenAI Ads): To measure whether our ads in ChatGPT lead to purchases, the OpenAI Ads Measurement Pixel sets first-party cookies (`__oppref`, which stores an ad click reference for 30 days, and `__obref`, a random browser reference kept for 365 days) and reports page views, product views, checkout starts and purchases. The Pixel may also send one-way hashes of contact details you enter on our site, such as your email. When an order is delivered, our server sends OpenAI the order reference, products and amount, together with a one-way SHA-256 hash of your delivery email (never the email itself), your IP address and browser details, and the cookie values above. We keep that attribution data with the order record. It is used for ad measurement only.
  • Support Chat: Our live chat is provided by a self-hosted Chatwoot instance (support.bakchich.cc). Loading it sets first-party cookies (`cw_conversation`, kept for up to 12 months, and `cw_snooze_campaigns_till`) so your conversation persists, and the chat server receives the URLs of the pages you visit, your IP address and browser details. When you open the chat from an order page, the order reference, status and product are shared so our team can help you. Messages you send are stored there to handle your request.

3. Security & Encryption Standards

All traffic between your browser and our platform is encrypted with TLS (HTTPS). Digital activation tokens are delivered over authenticated HTTPS channels and stored in protected database records accessible only by providing the matching customer email and order reference.

4. User Rights (GDPR & CCPA)

Under applicable European (GDPR) and California (CCPA) privacy laws, you have the right to request access to, correction of, or permanent erasure of your order delivery records. To submit a data deletion or inspection request, contact privacy@aurastack.com with your order reference.