AURA Sign InYour privacy
Your Privacy
The security of your data matters to us - we treat it like it is our own.
About our privacy policy
Treehouse Analytics Ltd is committed to safeguarding the privacy of information that is provided to us during the course of our business and information we receive from visitors to our website. This Privacy Policy explains when and why we collect personal information about you, how we use it, the conditions under which we may share it with others, and how we keep it secure.
When data is collected, processed and stored by Treehouse Analytics Ltd, we are what is known as the "Data Controller". That means we are responsible for what happens to the information that you provide. If you have any questions about how we use your data, please email us at hello@treehouseanalytics.com.
This website is operated by Treehouse Analytics Ltd (company number 11034156), registered in England & Wales, whose registered office is at Park Gate, 161-163 Preston Road, Brighton, BN1 6AF, United Kingdom. In this policy "we", "us" and "our" means Treehouse Analytics Ltd. We are registered with the UK Information Commissioner's Office (ICO), registration number ZB407000.
Collection and use of personal information
We would like to keep you up to date with regard to analytical support and our services. If you choose to join our network or contact us with a query and voluntarily provide us with personally identifiable information about yourself - such as your name, email or postal address, or telephone number - we will collect and store that personal information.
We recognise that your information is valuable, and we will only use your personal information if and to the extent that applicable law allows. We will therefore only process your personal information where:
- it is necessary for the performance of a contract with you or the organisation you work for;
- it is necessary in connection with a legal obligation to which we are subject;
- you have given your consent (where necessary) to such use, or the organisation you work for has obtained your consent (where necessary) to share your information with us; or
- we (or a third party) have a legitimate interest which is not overridden by your interests, rights and freedoms. Such legitimate interests include providing our people-insight and analytics services, running our business, and marketing relevant services directly to you.
We may use your personal information to:
- verify the identity of our clients where we are required to do so;
- deliver our people-insight, analytics and consulting services to you and/or the organisation you work for, if you are a client;
- run the business (for example, administrative and operational processes, including recruitment);
- improve our services and products, if you or the organisation you work for are a client or prospective client;
- consider whether we can pursue certain business-development initiatives;
- send you marketing materials and invite you to events (where you have consented or we are otherwise permitted to do so); and
- process and respond to requests, enquiries or complaints received from you.
Click to view each section in detail.
Our people-insight services use artificial intelligence and machine-learning techniques - for example, to analyse and categorise open-text feedback at scale - as part of delivering insight to our clients. Where we use these techniques:
- there is always human oversight: our team reviews and interprets outputs, and insights are delivered by people, not generated and released automatically;
- we do not make decisions that produce legal or similarly significant effects on an individual based solely on automated processing;
- we apply appropriate safeguards, including working with data that is anonymised or aggregated wherever possible; and
- we do not use personal information collected through this website to train artificial-intelligence models.
The analysis we carry out on client data within our AURA platform is governed by our agreement with the relevant client and that platform's own terms.
AURA is the online platform we provide to client organisations for 360 feedback and engagement surveys. This section explains the personal information we hold as controller to run AURA itself. It applies to everyone who signs in to AURA, including people who only give feedback.
Feedback belongs to your organisation. When an organisation uses AURA to run feedback campaigns or surveys, the feedback that people give, and the reports built from it, are processed by us on behalf of that organisation. The organisation is the controller of that data, under its own data processing agreement with us. Its privacy notice explains how your feedback is used, who can see it and how long it is kept, so please read that notice, and direct any questions or requests about feedback to the organisation that invited you.
To run AURA itself, we hold the following:
- Account details - your name, work email address, your role in AURA and the organisation or organisations you belong to. These usually come from the organisation that gives you access;
- Sign-in and security records - when you sign in, records of the one-time codes and password links we send you, and failed sign-in attempts. For a failed attempt we record the type of failure, a one-way hash of the email address entered, the IP address, an approximate location (country and city) and the browser's user agent;
- IP addresses - explained below;
- Usage records - when you sign in, which screens you open and when, when you open a feedback form (including the campaign and the person the feedback is about), when you save or submit a response, and when you set your password. Our system administrators can view and export a summary of this activity for each user, including the number of sessions, pages viewed, time active, last activity and the IP address recorded at sign-in. Users in client organisations cannot see it;
- Technical logs - a record of each request to AURA's servers (what was requested, the result, how long it took and the country it came from, with no IP address and no user), and page-load timings linked to your account and organisation; and
- Email delivery records - when AURA sends you an email, such as an invitation or a reminder, we record when it was sent and whether it was delivered, delayed, bounced or reported as spam. These records hold a one-way hash of your email address rather than the address itself.
IP addresses. When you sign in to AURA or open it while signed in, and when a sign-in attempt fails, we record the IP address the request came from. We use it only for security and to investigate misuse, for example to spot an unusual sign-in or to look into an incident. We keep the full address for 90 days. After that we shorten it so that it identifies only the network it came from (for an IPv4 address we keep the first three of its four parts, and for an IPv6 address the first three of its eight), and we delete it completely 13 months after it was recorded. Our system administrators can see a user's recorded address in AURA's internal security and usage screens. We do not use IP addresses for marketing, and we do not share them with anyone for marketing purposes.
Sign-in sessions. A sign-in session lasts no longer than 90 days, after which you need to sign in again. Our authentication provider also records the IP address of each signed-in session and each two-step verification, and these records are removed within 90 days.
AURA relies on these service providers, which process personal information for us:
- Supabase - database and sign-in (authentication), hosted in London (eu-west-2);
- Vercel - hosting, server functions and file storage;
- Resend - delivery of AURA's emails; and
- an AI model provider, reached through the Vercel AI Gateway - used when an organisation asks AURA to summarise or group written feedback. Before any written answer is sent, AURA replaces the names of the organisation's AURA users, other names it can detect by rule, and email addresses, phone numbers and ID numbers with placeholders. This is rule-based: it reduces identifying detail but cannot guarantee to remove all of it. Every request asks for zero data retention, and AURA sends requests only to models that the Gateway lists as offering it.
Vercel and Supabase also keep their own technical logs, which include IP addresses, for periods that they set.
We will only retain your personal information for as long as is necessary for the purpose for which it was collected, including for the purposes of complying with any legal, regulatory, accounting or reporting requirements.
We recognise that your personal information is valuable, and we take a variety of technical and organisational measures to hold your personal information securely in electronic and physical form. We take appropriate steps to protect your personal information from unauthorised access, improper use or disclosure, unauthorised modification, unlawful destruction, or accidental loss, consistent with applicable law. Our premises are access-controlled and our electronic systems require logins and password authentication.
All our partners, staff and third-party service providers who have access to confidential information (including personal information) are subject to confidentiality obligations.
However, the transmission of information via the internet is not completely secure. Although we take appropriate and proportionate steps to protect your information, we cannot guarantee the security of information transmitted electronically.
We do not sell, trade or rent your personal information. We may share it with trusted third-party service providers who process it on our behalf and under our instructions, and with professional advisers or authorities where we are legally required to do so. Our key processors are:
- Vercel - website hosting;
- Resend - delivery of enquiry emails;
- Vercel Web Analytics - cookieless, aggregated website analytics; and
- Vercel Speed Insights - cookieless performance measurement (Core Web Vitals), which records how quickly pages load and respond. It sets no cookies and does not identify you.
Some of our service providers may process personal information outside the United Kingdom. For example, Resend is headquartered in the United States and processes email within the EU (Ireland). Where personal information is transferred outside the UK, we take steps to ensure it receives an equivalent level of protection - for example, by relying on UK "adequacy" regulations (including the UK Extension to the EU-US Data Privacy Framework) or on approved safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
Under UK data-protection law you have a number of rights in relation to your personal information. Subject to certain safeguards, limits and exemptions, you have:
- the right to be informed about how we use your information (this policy);
- the right of access to the personal information we hold about you (a "Subject Access Request");
- the right to request rectification of information that is inaccurate or incomplete;
- the right to erasure of your information (the "right to be forgotten");
- the right to object to or restrict the way we use your information;
- the right to data portability - to receive your information in a secure, re-usable format; and
- where our processing is based on consent, the right to withdraw that consent at any time.
To make a request, or if you are concerned that any information we hold about you is incorrect, please contact us by email at hello@treehouseanalytics.com, or write to us at the registered address above. We will verify your identity before responding. You will not usually have to pay a fee, although we may charge a reasonable fee, or decline to act, where the law permits (for example, where a request is manifestly unfounded or excessive), and we will explain our reasons.
You can control the marketing you receive from us using the "Manage your preferences" or "Unsubscribe" options in our emails, or by emailing hello@treehouseanalytics.com at any time.
Complaints. If you are unhappy with how we have handled your personal information, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk. We would, however, appreciate the chance to address your concerns first, so please do contact us.
Our website may contain links to other websites controlled by third parties. You should review those sites' own privacy policies. We do not accept any responsibility for their use of your personal information.
We do not use tracking or advertising cookies. To understand how the site is used we rely on Vercel Web Analytics, which is cookieless: it measures aggregate, anonymised usage without setting cookies, without storing your IP address, and without identifying you. Because it sets no cookies and tracks no individual, no cookie-consent banner is needed.
We use only a small number of strictly necessary cookies to remember your choices, such as your preferred language. You can disable cookies through your browser settings, though some preferences may then not be remembered.
We may update this Privacy Policy from time to time. The current version is always available on this page. This policy was last updated in October 2026.