Privacy Policy

Effective 19 October 2026 · Last updated 19 October 2026

English · Русский · Română

1. 1. Who we are
2. 2. What this policy covers
3. 3. Aurora Account
4. 4. Aurora Automotive
5. 5. Aurora Vision
6. 6. This website
7. 7. Cookies
8. 8. Why we may process your data
9. 9. Who helps us, and who sees what
10. 10. Data outside Moldova
11. 11. How long we keep data
12. 12. Security
13. 13. Your rights
14. 14. Age
15. 15. Changes to this policy
16. 16. Contact and complaints

1. Who we are

Aurora is software made and operated by Roman Zubenco, a private individual resident in the Republic of Moldova (“we”, “us”). For the personal data described in this policy, unless a section says otherwise, we are the controller: we decide why and how it is processed.

Contact for anything in this policy: yafebest@gmail.com.

2. What this policy covers

This policy covers:

• Aurora Account at account.papusoi.com: one account and one sign-in for every Aurora product;
• Aurora Automotive at aurora.papusoi.com and on the domains of the repair shops that use it;
• Aurora Vision, software that customers install and run on their own computers;
• this website, papusoi.com.

It does not cover services run by others that you reach through ours, such as Google when you choose “Continue with Google”. Their own policies apply there.

3. Aurora Account

What we collect

• Your account: your email address (confirmed by a code or by Google), your name, your language, and your time zone, which your browser reports so that the dates in our emails are in your time.
• Your passkeys: for each one, the public key and identifier your device creates, the name you give it, and when it was added. Your fingerprint, your face and your device’s PIN never leave your device: the device checks them itself, and we cannot see them.
• One-time codes: when you sign in or confirm an action by email, we send a six-digit code. We store only a one-way hash of it, and it expires after 10 minutes.
• Sign in with Google, if you use it: the identifier Google gives your Google account, and the basic profile it shares (email, name and picture). We never see your Google password.
• Security records: your active sessions and a history of sign-ins: when, by which method, from which kind of device and browser (for example “iPhone · Safari”), and the approximate city, which our network provider derives from your IP address. Your IP address is used at the moment of each request to limit abuse, such as repeated wrong codes; it is not stored in your account. A cookie marks the browser you use, so that we can tell you when a new device signs in.
• Account changes: changes of email address, recoveries of a lost passkey, and a scheduled deletion, each with its date, so that you and we can see what happened and undo what can be undone.
• The products you use: which Aurora products you have signed in to, first and last time. Products may also tell Aurora Account about the places you have in them, such as a repair shop and your role there, so that your account can show them to you under “Your services”.
• Data exports: when you ask for a copy of your data, we prepare a file and keep it for 7 days so that you can download it.

What we do with it

• sign you in, and keep you signed in on the devices you choose;
• sign you in to Aurora products: when you do, the product receives your account identifier, your email address and whether it is confirmed, your name, your language, and how and when you signed in;
• protect your account: ask you to confirm sensitive actions, warn you by email about a new device or a changed email address, block automated abuse, and let you sign out of devices you no longer use;
• send you the emails the service needs: codes, security alerts and notices about your account. We send no newsletters and no marketing.

Before we email a sign-in code, a bot check by Cloudflare Turnstile may run in your browser. It looks at signals from the browser to tell people from scripts, and it sets no tracking cookies for advertising.

4. Aurora Automotive

The shop’s records: the shop decides, we process

A repair shop that uses Aurora Automotive keeps its own business records in it: work orders and the clients, phone numbers and vehicles written on them; parts, suppliers and purchases; payments; its mechanics and their pay. For the personal data in those records the shop is the controller and we are its processor. We store and process them only to provide Aurora Automotive to that shop, only as its use of the product instructs, and never for purposes of our own. Each shop’s records are kept apart from every other shop’s.

If you are a client of a shop and want to see, correct or erase what the shop recorded about you, ask the shop. If you write to us, we will pass your request to the shop and help it answer.

The shop is responsible for having a lawful reason to record its clients’ data and for telling its clients about it. Our obligations to the shop as its processor are set out in the Data Processing Agreement.

The people who work in a shop

For the people a shop invites to work in Aurora Automotive, we hold their name, email address, role, the date they joined, and the phone number they give the shop. They sign in through Aurora Account (section 3). Invitations are sent by email and stay valid for 7 days.

Imported history

A shop may import its records from an earlier system. They are kept read-only, for that shop alone, under the same terms as its other records.

5. Aurora Vision

Aurora Vision is installed on the customer’s own computer. Camera streams, recordings, snapshots and camera settings stay on that computer: they are not sent to us, and we have no access to them. The customer who runs it is the controller of that footage and is responsible for using cameras lawfully, including any notices and permissions that local law requires.

If an Aurora Vision server signs people in through Aurora Account, section 3 applies to that sign-in, and the server may tell Aurora Account which objects a person has there and with what role. If a future feature sends any other data from a Vision server to us, this policy will describe it before the feature ships.

6. This website

papusoi.com has no analytics, no trackers, no embedded content from other companies and no forms. Its fonts are served from our own server. Like every web server, ours writes a short access log (address, time, page and browser) to keep the site running and safe; see section 11 for how long it stays.

7. Cookies

We use only cookies the services cannot work without. None is used for advertising or analytics, so none needs a consent banner.

8. Why we may process your data

Where the EU General Data Protection Regulation (GDPR) or the data protection law of the Republic of Moldova applies, we rely on these grounds:

• To provide the service you asked for (performance of a contract): your account, signing you in, the products you use, the emails they need.
• Legitimate interests, which we weigh against yours: keeping accounts and services secure, preventing abuse and fraud, keeping backups, and fixing problems. You may object to these at any time (section 13).
• Legal obligations, where a law requires us to keep or disclose data.

We do not make decisions about you that have legal or similarly significant effects by automated means. Rate limits and bot checks are automatic, but they only slow down or block requests that look like abuse.

9. Who helps us, and who sees what

We do not sell, rent or trade personal data. We share it only with the providers below, who process it on our behalf and under contract, and only as far as each one’s job requires:

The services themselves run on a server we operate in the Republic of Moldova. Inside an Aurora product, what other people can see is decided by that product: in Aurora Automotive, for example, the people of a shop see that shop’s records and its list of people. We may also disclose data when the law compels us to, or to protect someone’s safety, and only as far as necessary.

10. Data outside Moldova

Cloudflare, Amazon Web Services and Google process data in the United States and elsewhere. Where the law requires safeguards for such transfers, we rely on the protections these companies provide: the EU–US Data Privacy Framework, under which they are certified, and the European Commission’s Standard Contractual Clauses in their data processing terms.

11. How long we keep data

12. Security

• Every connection between your browser and our network is encrypted (HTTPS). Aurora Account’s traffic stays encrypted all the way to our server.
• There are no passwords to steal: you sign in with passkeys, which resist phishing, or a one-time code.
• Codes and the tokens we issue to products are stored only as one-way hashes.
• Sensitive actions, such as adding a passkey, changing your email or deleting your account, ask you to confirm that it is you.
• Backups are encrypted at rest. The server can only add backups, and cannot read or delete them.
• Access to the servers is limited to the operator.

No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.

13. Your rights

Depending on where you live, and in any case where the GDPR or Moldovan data protection law applies, you have the right to:

• access your data and receive a copy; in Aurora Account, “Download my data” gives you a file at any time;
• correct it; your name, email and language are in your profile;
• erase it; “Delete account” erases your account after 14 days;
• take it with you in a portable format: the export is a JSON file;
• object to processing based on our legitimate interests, and ask us to restrict processing while a question is settled;
• complain to a data protection authority (section 16).

For anything the settings do not cover, write to us. We answer within one month, and may ask you to prove that the account is yours before acting on a request. For a shop’s records in Aurora Automotive, see section 4.

14. Age

Aurora is meant for adults. You must be at least 18 to create an Aurora Account. If we learn that an account belongs to someone younger, we will delete it.

15. Changes to this policy

When we change this policy, we publish the new version here with a new date. If a change matters, for example a new kind of data or a new provider, we tell account holders by email before it takes effect.

16. Contact and complaints

Roman Zubenco, Republic of Moldova · yafebest@gmail.com

If you are not satisfied with our answer, you may complain to the National Center for Personal Data Protection of the Republic of Moldova, or, if you live in the European Union or the European Economic Area, to the data protection authority of your country.