App Privacy

The Aurea Via operations app is a workplace tool for our staff and for staff of the businesses whose payments we process. It is not a consumer application. It carries no shopping and no payment function, and it is of no use to a member of the public.

Accounts cannot be created from inside the app. They are issued by an administrator at your organisation, and you sign in with credentials that organisation controls. That administrator decides who holds an account, what it can see, and when it is closed — which is why, for most requests about your own data, they can act fastest.

Your account

Your name and work email address, and where your organisation provides them your job title and phone number, together with your role and the organisation the account belongs to. This reaches us from the administrator who created the account, or from you when you complete your profile.

Your password is stored only as a cryptographic hash, which cannot be turned back into your password. Where two-factor authentication is enabled, we also hold the secret your authenticator app uses to generate codes.

Your device, so notifications can reach it

When you allow notifications, the app registers your device with us. We store the notification token issued by the operating system, whether the device is iOS or Android, the device model and operating system version, the app version, and the time the device last contacted us.

The device model is held for one reason: so a colleague can identify your handset during a support call. The last-contact time is held so that devices which have gone quiet — replaced, reinstalled, or belonging to someone who has left — can be found and removed.

Turning notifications off, signing out, or uninstalling the app ends that registration.

How the service is used

We keep security and audit records: sign-ins and sign-outs, the IP address a request came from, and a record of changes made to configuration — who changed what, and when. These exist so that a change to a live payment system can be traced to a person, and so unauthorised access can be detected. In a regulated payments business they are not optional.

The alerts this app delivers are operational: a merchant that has stopped sending traffic, a route declining above its threshold, a terminal returning errors. They describe businesses, acquirers and terminals.

They do not contain a cardholder’s name, a card number, or any payer’s personal details.

Google, through Firebase Cloud Messaging, and on iOS Apple, through the Apple Push Notification service, deliver these messages to your device. To do that they receive your device’s notification token and the contents of the message. They carry the message; they are not given your account details.

The app does not request and does not receive your location, your contacts, your photos, your calendar, your microphone, or your health data.

It does not track you.The app carries no advertising identifier, no advertising or marketing software, and nothing that would follow you across other companies’ apps or websites. We do not sell personal data and we do not share it for advertising. There is no advertising in this product to sell it for.

No card numbers reach this app. Card data in the Aurea Via platform is held by a PCI DSS Level 1 certified vault provider and is never displayed in, or transmitted to, the mobile app.

Traffic between the app and our servers is encrypted in transit, and secrets are stored encrypted at rest. Access to production data is limited to the people whose work requires it, and administrative actions are recorded.

Changing your password ends your sessions on other devices, and an administrator can revoke access across every device immediately.

Account data is kept while the account is open, and afterwards only for as long as our record-keeping obligations require. Device registrations are removed when they fall out of use or when you sign out. Security and audit records are kept for the period those obligations set, because their whole purpose is to still be there when a question is asked later.

Your rights over your personal data — access, correction, deletion, objection, and complaint to a supervisory authority — are set out in the Aurea Via Privacy Policy and apply to everything on this page.

Because your account was issued by your organisation, start with your administrator — they can act on most requests straight away. Otherwise write to us at info@aureavia.com, the same address the main policy gives, and we will reply within the time the law allows.