Privacy Policy

01Who we are

The Aura smart‑home service (the “Service”) — comprising the Aura mobile app, the Aura Core hub, and Aura Dot peripherals — is operated by Watt Wizards Private Limited, a company registered in Jaipur, Rajasthan, India, and a wholly‑owned subsidiary of Flock Energy Limited (United Kingdom). In this policy “we”, “us”, and “our” refer to Watt Wizards Private Limited.

For the purposes of applicable data‑protection law, we act as the data fiduciary / data controller for the personal data described here. You can reach us at any time at support@flockenergy.co.uk.

02Scope of this policy

This policy covers the personal data we process when you create an Aura account, set up and use the Aura Core hub and Aura Dot devices, and control your appliances through the app. It does not cover third‑party products you choose to connect (for example, the air‑conditioner or other appliance your Aura Dot controls), which are governed by their own manufacturers’ policies.

03Data we collect

We collect only what we need to run the Service. The categories are:

We do not collect your location, contacts, photos, calendar, or advertising identifiers, and the app contains no advertising or third‑party analytics SDKs (see Section 08).

04Wi‑Fi & Bluetooth setup data

To get your Aura Core online, the app asks for your Wi‑Fi network name (SSID) and password during setup. This is sent directly to your Aura Core over a local Bluetooth or Wi‑Fi connection and stored on the device so it can reconnect. Your Wi‑Fi password is not stored on our cloud servers.

05How we use your data

• Create, secure, and operate your account and the Service.
• Register your Aura hardware and let you control your appliances.
• Show live device status and respond to your commands in real time.
• Keep firmware and the app up to date and working reliably, including security fixes.
• Provide customer support and respond to your requests.
• Maintain security, prevent fraud and abuse, and meet our legal obligations.

We do not sell your personal data, and we do not use it for advertising or to build marketing profiles.

06Legal bases for processing

Depending on your jurisdiction, we rely on the following bases:

• Performance of a contract — to provide the Service you signed up for.
• Legitimate interests — to keep the Service secure, reliable, and free from abuse, balanced against your rights.
• Consent — where you give it (for example, providing Wi‑Fi credentials during setup, or granting Bluetooth access). You can withdraw consent at any time.
• Legal obligation — where we must process data to comply with the law.

07Sharing & service providers

We do not sell or rent your data. We share it only with a small set of service providers (processors) who help us run the Service, and only as needed:

We may also share data within the Flock Energy group (our UK parent, Flock Energy Limited) where needed to operate the Service, and we may disclose data where required by law or to protect the rights, safety, and security of our users and the Service.

08No advertising or third‑party tracking

The Aura app contains no advertising, no third‑party analytics, and no cross‑app tracking. We do not integrate ad networks or behavioural‑tracking SDKs, and the app declares that it does not track you in the sense defined by Apple’s App Tracking Transparency framework.

09Device permissions we request

We do not request access to your camera, location, contacts, microphone, or photos. You can review and change permissions at any time in your device settings; revoking Bluetooth will prevent device setup and local control.

10Data retention & account deletion

We keep your personal data only as long as your account is active or as needed to provide the Service, then delete or anonymise it.

You can delete your account directly in the app (Profile → Delete account). When you do, your account is immediately disabled and signed out, and your data is scheduled for permanent deletion after a short grace period (currently 14 days, which also gives you a window to recover an account deleted by mistake). After the grace period, your account and its associated data are permanently purged from our systems.

We may retain a limited amount of data where the law requires it, or where it is needed to complete a transaction or resolve a dispute; if so, we will tell you what is being kept and why, and we will delete it once it is no longer required. Wi‑Fi credentials stored on your Aura Core are cleared when you reset the device.

11How we protect your data

• Traffic between the app, our servers, and your hub is encrypted in transit (TLS / HTTPS).
• Passwords are stored using one‑way hashing — we never store them in plain text.
• Session tokens are stored hashed on our servers and in your device’s secure keychain/keystore.
• Access to production systems is restricted on a need‑to‑know basis.

No system is perfectly secure, but we work to protect your data and will notify you and the relevant authorities of a significant breach where the law requires.

12International transfers

We operate from India and are part of a group headquartered in the United Kingdom. Your data may be processed in, or transferred to, India, the UK, or other countries where our service providers operate. Where we transfer data across borders, we use appropriate safeguards as required by applicable law (such as the India Digital Personal Data Protection Act, 2023 and, for UK/EU users, the UK GDPR).

13Your rights

Subject to your local law, you may have the right to:

• Access the personal data we hold about you and request a copy.
• Correct inaccurate or incomplete data.
• Delete your account and data (see Section 10).
• Withdraw consent you previously gave.
• Object to or restrict certain processing, and request data portability (UK/EU users).
• Nominate another person to exercise your rights in the event of death or incapacity (India DPDP Act).

To exercise any of these, email support@flockenergy.co.uk. We will respond within the timeframe required by law. You also have the right to complain to your local data‑protection authority (in the UK, the Information Commissioner’s Office; in India, the Data Protection Board).

14Children

The Service is not directed to children. You must be old enough to enter a binding contract in your country (and at least 18) to create an account. We do not knowingly collect personal data from children; if you believe a child has provided us data, contact us and we will delete it.

15Changes to this policy

We may update this policy as the Service evolves. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the app. Your continued use of the Service after an update means you accept the revised policy.

16Contact & grievances

For any privacy question, request, or complaint, contact us: