Privacy and Personal Information Collection Statement

Scope of this notice

This notice covers only the current public Auriatorium waitlist. The waitlist does not currently collect payment, transaction, invoice, account or fulfilment information. Paid commerce will require an expanded privacy notice before it is enabled, covering the configured UK software seller and planned Revolut payment processing. Historical Stripe and Paddle purchases retain the payment and privacy information supplied at purchase. This informational waitlist currently has no age restriction; customer age, capacity to contract and any youth-user safeguards require separate legal review before the store opens.

No sale of waitlist data

We do not sell or rent the Auriatorium waitlist, email addresses or associated personal information. We use it only for the waitlist purposes described here, to protect the service and comply with applicable obligations.

What we collect and why

Email is required if you want to join: without it we cannot send the confirmation link or waitlist updates. Interests are optional. Campaign tags are optional values read from the page URL. IP address and browser/user-agent details are recorded automatically when you submit.

Email choice and double opt-in

Submitting the form records a request, not an active subscription. You must use the email confirmation link before a new or previously unsubscribed address becomes confirmed. A repeat submission refreshes the current preferences, attribution and consent snapshot. A previously unsubscribed address returns only to pending and is not silently reactivated. Consent covers Auriatorium waitlist and opening updates only; it does not subscribe you to general Hodfords group marketing.

Every confirmation email includes a free unsubscribe link. You may also request one below. To avoid revealing whether an address is on the waitlist, this form gives everyone the same response and sends a purpose-bound link to every valid address submitted. For an unknown address, clicking it is a harmless no-op.

Service providers and US processing

The application stores waitlist data in its PostgreSQL database under a waitlist-only access scope. That database is hosted on infrastructure in the United States, so waitlist data is transferred to and stored there.

Hodfords LLC, whose registered office is 16192 Coastal Highway, Lewes, Delaware 19958, County of Sussex, USA, provides hosting and technology processing for this infrastructure. The physical server is owned by the Hodfords-owned infrastructure company Icelab Networks, LLC, identified in its published company material at 8191 SouthPark Lane, Suite 201, Littleton, Colorado 80120, USA. These infrastructure systems necessarily handle the data automatically to store and serve it, but their US staff have no access to Auriatorium personal data and do not inspect it.

Separately, Plus Five Five, Inc., trading as Resend, receives the destination email address and message content and metadata to deliver confirmation and unsubscribe emails. Resend says its primary processing is in the United States and publishes transfer safeguards in its Data Processing Addendum. Its own handling is described in the Resend Privacy Policy.

Google Analytics 4 (provided by Google) receives analytics data only after you make an affirmative analytics choice on this teaser. Google Tag Manager is not used — the GA4 tag loads directly. Until you choose to allow analytics, this site sends Google no page requests or events, and declining or withdrawing keeps it that way. No email address or waitlist form content is sent to Google. The linked cookie policy sets out the Google processing, international transfer details, retention limits, and the cookies used.

With your separate affirmative advertising choice, we use the Meta (Facebook/Instagram) Pixel and server-side Conversions API (provided by Meta Platforms Ireland Limited and Meta Platforms, Inc.) to measure our advertising: page views and a waitlist Lead event are sent to Meta, matched with a one-way SHA-256 hash of your email address, your IP address, browser user-agent, and _fbp/_fbc cookie identifiers, and deduplicated by a shared event_id. Hodfords Limited and Meta Platforms Ireland Limited act as joint controllers for the initial collection and transmission of this data under the Meta Controller Addendum, and transfers to Meta Platforms, Inc. in the United States are protected by the UK Extension to the EU-US Data Privacy Framework and the UK International Data Transfer Addendum (IDTA) / Standard Contractual Clauses. Advertising loads nothing and sends nothing to Meta unless you allow it, and you can withdraw your consent at any time. TikTok advertiser onboarding is complete but its website integration is deferred — no TikTok Pixel or web event source is configured, and nothing is sent to TikTok. The linked cookie policy sets out the Meta cookies (_fbp/_fbc, up to 90 days), joint-controller details, purposes, retention, and international-transfer safeguards.

Security

We use access restrictions, a dedicated waitlist database scope, rate limits and purpose-bound, expiring, single-use links. Secret link values are stored only as one-way hashes. We take reasonable measures to protect the information from loss, misuse and unauthorised access, disclosure, alteration or destruction, but no internet transmission or storage system can be guaranteed completely secure.

How long we keep it

• Pending, unconfirmed signup records are deleted after 30 days.
• Campaign attribution, IP address and browser/user-agent fields are removed after 12 months.
• Confirmed waitlist profiles are kept until you unsubscribe, or for 24 months after the latest consent or confirmation when there has been no renewed engagement.
• On unsubscribe, interests, attribution, IP address, browser details and other profile fields are scrubbed. We keep only the minimum email address, unsubscribed status and opt-out evidence for as long as Auriatorium conducts direct marketing, solely to honour the opt-out.
• Confirmation and unsubscribe links expire after 72 hours. Their token records are deleted promptly after use or expiry.
• Resend currently states 30-day data retention across its standard plans for email content and metadata. See Resend's plan information.

Access, correction, deletion and withdrawal

You can ask to access, correct or delete your waitlist information, or withdraw consent at any time, by emailing privacy@hodfords.com. You may alternatively use info@hodfords.com. We may need to verify that the address belongs to you. A deletion or withdrawal request may leave only a minimal suppression record where needed to ensure we do not contact you again. The free unsubscribe mechanism below withdraws waitlist marketing consent.

Cookies and analytics

With your prior consent, this teaser uses Google Analytics 4 analytics cookies (_ga and _ga_<container-id>); they load only after you choose “Accept analytics” (or “Allow analytics”) and are not set if you decline or make no choice. Strictly necessary browser localStorage (auriatorium_privacy_choices) is used only to remember your consent preference. GA4 Measurement ID G-96F3JKGX83 is used directly; Tag Manager container GTM-KWKNDB33 is not used. Advertising cookies and the Meta pixel load only with your separate advertising consent. Read the exact settings and manage or withdraw your choice at any time in our Cookie, analytics and advertising policy.

Meta business portfolio 1678040803743082 and Meta Pixel 2307684030055231 are active for advertising measurement on a strict opt-in basis (browser Pixel + server-side Conversions API), setting the _fbp cookie and reading or setting _fbc (up to 90 days) only after you allow advertising. TikTok advertiser onboarding is complete for https://hello.auriatorium.com, with United Kingdom as the account country and Hodfords Solutions Limited as its invoice/business name, but no TikTok Pixel or web event source is configured and its website integration is deferred. No customer-list integration is enabled. Campaign source and UTM values can still be stored when someone submits the waitlist form, as disclosed in “What we collect and why”. Meta advertising requires a separately informed and affirmative choice before activation; email or analytics consent is not reused for it.

Changes to this notice

We may update this notice when the waitlist or its service providers change. We will post the revised notice here with a new date and version. If a change materially affects the consent requested from waitlist members, we will seek a fresh choice rather than treating an older consent as agreement to the new purpose. This includes activating the selected analytics provider or activating a configured advertising provider: its identity, measurements and storage must be disclosed before its consent-controlled loader is enabled.