U.S. State Supplemental Privacy Notice

This U.S. State Privacy Notice (“Notice”) supplements the information in and forms part of the Aura Privacy Policy  (“Privacy Policy”). This Notice contains disclosures required by certain U.S. state privacy laws, including those of California, Colorado, Connecticut, Virginia and Utah. We share the same information about our practices with everyone but use this notice to make disclosures required by those laws.

This Notice applies to all products, services, apps, and websites that link to our Privacy Policy, except where otherwise noted.

Summary of How we Handle your Personal Information

Summary of How we Handle your Personal Information

Certain state privacy laws require that we make certain disclosures to consumers, including the categories of personal information we collect, the purposes for which we use that information, the categories of sources of personal information, and the categories of third parties with whom we share personal information. This section lays out this information in the manner specified by some of those laws, but it does not differ in substance from the information we provide in our Privacy Policy.

Sources of Personal Information

All the categories of personal information we collect come from the following categories of sources:

• You (either via voluntary submission or automatic collection, such as when you use our services)
• Our affiliates within the Aura family of companies listed in the Privacy Policy, which may include Circle Media Labs, Inc. (“Circle”) and Intersections, LLC dba Pango (“Pango”)
• Third parties (such as service providers, other users or marketing partners who may refer you to our services, and your organization if you use a product with a business account)

Categories of Personal Information Collected and with Whom we Share It

• Identifiers (such as name, account username, email address, or in the case of our identity theft protection services, social security number, passport numbers, date of birth and home address)
• Commercial information (such as transaction data)
• Financial and transactional data (such as payment instrument or credit card details, and data regarding your routine financial transactions, if you activate the financial transaction monitoring services)
• Internet or other network or device activity (such as app usage and interactions with our services)
• Approximate geolocation information (e.g., your city and state based on IP address)
• Professional or employment-related information (if you use a service that we offer to businesses)
• Social media account information ( if you use our Social Media Monitoring services)
• Demographics and statistical information (such as age and gender)
• Customer service information (e.g. support requests)
• Survey responses and other research information
• Other information that identifies or can be reasonably associated with you

Categories of Third Parties with Whom we Share Your Personal Information

The categories of personal information collected, as described above, may be shared with the following categories of third parties:

• Your organization (if you are using a product with a business account)
• Our affiliates within the Aura group of companies listed in the Privacy Policy, which may include Circle and Pango
• Third party service providers that perform services on our behalf (e.g. payment processors, analytics providers)
• Third party ad networks (Google)
• Third parties for legal purposes (e.g. in response to legal process)
• Others with your consent or at your direction

More detail about these categories is available in Section 3 of our Privacy Policy.

Categories of Business & Commercial Purposes for Which We Use Your Personal Information

The categories of personal information collected, as described above, are used for the following categories of purposes:

• To provide, maintain, troubleshoot, and support our services.
• For billing and payment purposes.
• To communicate with users and prospective users.
• To improve our services.
• To develop new services.
• To market and advertise our services.
• To prevent harm or liability.
• For legal compliance.

More information about these categories, including examples of use cases, is available in Section 2 of our Privacy Policy.

Do Not Track Signals

Some mobile and web browsers transmit "do-not-track" signals. Because of differences in how web browsers incorporate and activate this feature, it is not always clear whether users intend for these signals to be transmitted, or whether they even are aware of them. We currently do not take action in response to these signals. Learn more about Do Not Track.

Your Privacy Rights

Non-Discrimination

The CCPA prohibits businesses from discriminating against you for exercising your rights under the law. Such discrimination may include denying a good or service, providing a different level or quality of service, or charging different prices. The CCPA permits businesses to provide differing levels or quality or different prices where the business can demonstrate that the difference is reasonably related to the value to the business of the consumer’s personal information.

Opt-Out From Sale and Sharing/Processing for Targeted Advertising

You may have the right to opt out of the “sale” of your personal information or “sharing” or “processing” of your personal information for targeted advertising purposes, as defined by relevant state laws. Some state laws broadly defines “sale” such that it may include allowing third parties to receive certain information, e.g. cookies, to deliver personalized advertising on our services.

Aura does not “sell” your personal information or "share/process” it for targeted advertising purposes (as defined by state privacy laws) except in the following circumstances:

• in the context of some free versions of our products that are supported by personalized advertising served by Google, and through the use of cookies on our website. Advertising, including personalized advertising, enables us to provide certain of our products for free, to provide offers relevant to you, and, because we believe it’s important that everyone has the opportunity, regardless of their situation, to have secure and private access to the internet. Personalized advertising enables ads to be shown that are more relevant to you. Advertising, including personalized advertising, enables us to provide you with certain content and services for free and allows us to provide you with offers relevant to you.
• We share your name, email address and other contact information with our affiliates, which may include Circle and Pango, to better market our collective products and services to you.

Depending on the services you use and how you use them, we may “sell” or “share/process” for targeted advertising purposes the following categories of personal information:

• Identifiers (such as advertising identifiers and cookies, or in the case of sharing with our affiliates which may include Circle and Pango, your name and email address)
• Internet or other network or device activity (such as what Aura product/app you’re using)
• Approximate geolocation information (city level location data)

To opt out of our use of your information for such purposes, see below. Please note that we do not knowingly sell or share/process for targeted advertising purposes the personal information of minors under 16 years of age without legally-required affirmative authorization.

How to Opt Out from the Sale of Your Personal Information

To opt out from the “sale” of your personal information, the following options are available to you:

• You may opt out of Google ad personalization via the Google Ads Settings page. Note that this opt out mechanism is operated by Google. After opting out of personalized advertising, you may still see non-personalized ads, but the serving of these ads does not involve a “sale” of your personal information.
• If you are using a free product of ours with personalized advertising, you may upgrade to a paid version of that product. Paid versions of our products do not contain any advertising.
• You may stop using any product of ours with personalized advertising.
• If you use different devices or browsers, you may need to replicate your choices across those devices and browsers.

Please note that we do not require users to create accounts in order to use the free versions of our VPN products. Because of this, we cannot identify such users based on an email address, username or other identifying detail that would normally be collected as part of an account creation process.

For more information about Aura’s privacy practices, see our Privacy Policy.

California Third Party Disclosure Requests

California law permits users who are California residents to request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their “personal information” (if any) as defined under California Civil Code 1798.83 for their direct marketing purposes in the prior calendar year, as well as the type of personal information disclosed to those parties. See the “Contact Us” section below for where to send such requests. As a matter of routine, we enter into contractual terms with all third parties that access and handle your personal data. Note that Aura does not share personal information with third parties for their own direct marketing purposes without your prior consent.

Additional Rights

Your state’s law may permit you to request that we:

• provide you the categories of personal information we have collected or disclosed about you in the last twelve months, the categories of sources of such information, the business or commercial purpose for collecting or selling your personal information, and the categories of third parties with whom we shared personal information. This information is provided in this Notice;
• provide access to, or a copy, of certain information we hold about you;
• delete certain information we have about you; or
• correct inaccurate information we have about you.

You may also have the right to receive information about the financial incentives that we offer to you (if any), and the right to not be discriminated against (as provided for in certain state laws) for exercising your rights.

Certain information may be exempt from such requests under applicable law. For example, we need certain types of information so that we can provide the services to you and for compliance with applicable law.

When you exercise these rights, we may take reasonable steps to authenticate your identity before fulfilling your request (such as verifying your email address or payment instrument). If you ask us to delete certain information, you may no longer be able to access or use our services.

You are also permitted to designate an authorized agent to submit certain requests on your behalf. In order for an authorized agent to be verified, you must provide the authorized agent with a signed, written permission to make such requests, or a power of attorney. We may also follow up with you to verify your identity before processing the authorized agent’s request.

If you would like further information regarding your legal rights under U.S. state privacy law or would like to exercise any of them, please contact us at:

Aura Sub, LLC

2553 Dulles View Drive, Suite 400, Herndon, VA  20171

Email: privacypolicy@aura.com