Privacy policy

Last updated: July 2026

aura obscura ("we", "us") runs aura portrait pop-ups across Southeast Asia and operates this website. This policy explains what personal data we collect, why, and the choices you have. It is written to satisfy Singapore's Personal Data Protection Act (PDPA) and Thailand's Personal Data Protection Act (PDPA), and we honor the equivalent data-protection laws in the other places we pop up — including Hong Kong's PDPO, Malaysia's PDPA, Indonesia's PDP Law, and the Philippines' Data Privacy Act.

What we collect

  • Booking details — name, email, phone number, Instagram handle (optional), session type, date and city, and any duo details you provide.
  • Payment metadata — amount, currency, method and a payment reference. Card and bank details never touch our servers; they are handled by our payment processors (Stripe and HitPay) on their secure systems. If you opt in to keeping a card on file for add-ons, that card is stored by Stripe, not by us.
  • Newsletter and waitlist signups — your email address and, where relevant, the city you're interested in.
  • Event inquiries — the details you submit through the events form.
  • Site analytics — via Google Tag Manager and the Meta Pixel, to understand how visitors find and use the site. See "Cookies" below.

How we use it

  • To run your booking: confirmations, reminders, venue information and day-of coordination.
  • To announce tour dates and news, if you've signed up — you can unsubscribe any time.
  • To respond to event inquiries and prepare quotes.
  • To measure marketing (for example, knowing an Instagram post led to bookings) and improve the site.
  • To feature your portrait on our social media, website and marketing materials — only if you ticked the consent box at checkout or in the aura interpreter.
  • To generate your reading in the aura interpreter: a portrait you upload there is processed to write your interpretation, and kept to improve the interpreter. Uploading requires ticking the consent box; sharing it publicly is a separate, optional tick.

What we don't do

We don't sell your data. We don't send marketing without your consent. Card details are collected and stored by our payment providers (Stripe and HitPay) under their own security standards — we never see or hold full card numbers ourselves.

Who we share data with

Service providers who help us operate: payment processors (Stripe, HitPay), our database and hosting providers (Supabase, Netlify), our email delivery service, our AI provider (Anthropic), which generates the aura interpreter's readings, and analytics providers (Google, Meta). Each processes data under its own safeguards and only for the purpose of providing the service.

Cookies & tracking

We use cookies and similar technologies for site functionality and analytics (Google Tag Manager, Meta Pixel). A notice on your first visit tells you cookies are in use; your browser settings let you block or clear them, and you can opt out of ad measurement via Meta and Google's own ad-preference tools.

Retention

Booking records are kept for as long as needed for operations, tax and accounting. Newsletter data is kept until you unsubscribe. You may ask us to delete your data sooner (see below).

Your rights

Under these laws — wherever you met us on tour — you may request access to, correction of, or deletion of your personal data, and you may withdraw consent for marketing at any time. Write to hello@auraobscura.com and we'll respond within 30 days.

Children

Portrait subjects can include children above 7 accompanied by a parent or guardian; bookings and data belong to the accompanying adult.

Changes

We'll post any changes to this policy on this page with an updated date.