Privacy Policy
Effective Date: May 25, 2026
Fortuna Labs (the "Company") handles personal information carefully so that you can trust and use Auroro (the "Service"). This Policy explains, in accordance with applicable law, what information the Company processes and how.
1. Information We Collect
The Company collects information necessary to provide, operate, and improve the Service.
- Account Information: Email, name, profile picture — automatically transferred when you authenticate with a Google or Apple account
- Immigration Profile: Age, education, language test scores, work experience, family information, etc. — entered directly by you. Used for Canadian immigration score calculation and recommendation of suitable immigration paths
- Usage Records: Immigration streams you track, score simulation results, customer support history
- Device Information: Push notification token, device and app version on access, access logs
The Company does not require separate identity verification documents (passport, ID card, etc.) for identification.
2. Purpose of Use
- Member authentication and identity verification
- Immigration score calculation and recommendation of suitable immigration paths
- Sending notifications you have consented to
- Customer support response and service operation/improvement
3. Retention Period
- Account and immigration profile: Completely deleted within 30 days of a membership withdrawal request
- Customer support records: 1 year (for dispute response)
- Access logs: 1 year
- Push tokens: Immediately upon notification deactivation or app deletion
Where retention obligations exist under applicable law, information will be retained for the period prescribed by such law.
4. Automated Score Calculation
The Company automatically calculates scores including CRS, PNP, and CLB based on the information you input. These results are estimates and do not replace the official determination of Immigration, Refugees and Citizenship Canada (IRCC). You may request an explanation of these calculation results.
5. Third-Party Provision and Processing Delegation
The Company does not sell your personal information to outside parties. For service operation, however, the Company delegates certain processing to the following global infrastructure providers:
- Authentication: Google, Apple (OAuth token verification)
- Infrastructure: Google Cloud (app and database hosting), Cloudflare (content delivery and file storage)
- Push Notifications: Expo
Each processor handles information only within the purposes specified in this Policy, pursuant to the Data Processing Agreement (DPA) executed with the Company.
6. International Transfer
Because the Service operates through global infrastructure (Google Cloud, Cloudflare, etc.), your information is transferred to countries where the above processors operate. The Company ensures safety through TLS encryption during transmission/storage and standard data processing agreements. Your consent to this international transfer is required to use the Service.
7. Your Rights
You may exercise the following rights at any time:
- View, correct, or delete your personal information
- Request suspension of processing
- Withdraw consent and terminate membership
- Request an explanation of automated score calculations
How to exercise: Apply through My tab → Customer Support in the app, or by email to admin@fortuna-labs.io. Requests will be processed within 10 business days.
8. Security Measures
The Company implements reasonable technical and managerial measures to protect personal information, including encryption during transmission and storage (TLS, AES-256), access control under the principle of least privilege, retention of access logs, and external intrusion prevention.
9. Contact
For inquiries regarding personal information processing: admin@fortuna-labs.io
If you have any objection to this Policy or our processing practices, please contact us at the email address above first. If your concern is not resolved, you have the right to lodge a complaint with the personal information protection supervisory authority in your country of residence.
10. Change Notice
If this Policy changes, we will notify you through in-app announcements and push notifications 7 days before the effective date (30 days for material changes). For processing that requires separate consent — such as advertising or marketing — the Company will obtain separate consent from users before implementation.
This Policy applies together with the Terms of Service.