Effective from 2026-09-30
This text is assembled from the boilerplate these documents conventionally use and has not yet been reviewed by Aurora World's legal adviser. Treat it as a working draft rather than as the agreement in force.
Aurora World Corporation ("Aurora World", "we") is the controller of the personal information described here. We collect it so that we can give named people at our partner organisations access to brand and product material, and so that we can tell who did what with it.
This policy covers Aurora Brand Studio at brandstudio.auroraworld.com (the "Site"). It does not cover Aurora World's consumer websites or storefronts, which publish their own policies.
Account information, given to us when a credential is issued
We do not ask for a home address, a telephone number, a date of birth, a photograph, or any special category of personal information. Your password is never stored — only a one-way scrypt hash of it, which cannot be read back.
Records created when you use the Site
An IP address is personal information under Korean and EU law, and we treat it as such. We use it to tell one sign-in from another when investigating suspected credential sharing or unauthorised access. We do not use it to locate you, to profile you, or for any marketing purpose. In particular we do not convert your address into a place: we compare one address with another to see whether a single credential is in use in two places at once, and no part of this is sent to a location service or to any other third party.
The session record exists so that you can see where your own credential is signed in, on your account page, and sign out a device you do not recognise. An Aurora World administrator can see the same list for the purpose of detecting a shared credential. We show the network rather than the full address on those screens, and the browser and operating system in general terms — "Safari on iOS" — rather than the full technical string.
| Purpose | Basis |
|---|---|
| Giving you access to the material your organisation is licensed to use | Performance of the agreement with your organisation; our legitimate interest in operating a credentialed library |
| Telling who downloaded what, to evidence supply under that agreement | Our legitimate interest, and our legal obligation to keep records |
| Detecting shared credentials and unauthorised access | Our legitimate interest in protecting unreleased material |
| Notifying you of changes to these documents or to your access | Performance of the agreement |
We do not use your information for advertising, we do not build profiles, and we make no automated decision that has a legal or similarly significant effect on you.
We do not sell your personal information and we do not share it for anyone else's marketing.
We share it only with:
If material is licensed to Aurora World by a third-party rights holder, we may have to tell that rights holder which organisation accessed their material. Where we do, we share the organisation and the material, not your name, unless the rights holder's agreement requires otherwise.
We keep your name and email address only for as long as you hold a credential under your organisation's partnership with Aurora World. When the partnership ends, or when your credential is closed because you have changed role or left, we delete your account record — name, email, display name and group membership — within 90 days.
Other records are kept for a fixed period and then deleted:
| Record | Kept for |
|---|---|
| Account record: name, email, groups | Duration of the partnership, then deleted within 90 days |
| Sign-in and access records, including IP addresses | 12 months from the event |
| Session records for a device you are signed in on | Deleted when the session ends, and in any case within 30 days |
| Download records, for licence evidence | 24 months from the download |
| Change history of the library (who published what) | Retained for the life of the library, with your name replaced by "former user" once your account is deleted |
| Backups | Overwritten on a rolling cycle, and in any case within 35 days |
We keep sign-in records for twelve months because that is the minimum period Korean law expects for access records of a system holding personal information, and because a shorter window makes a credential-sharing investigation impossible. We keep download records longer because they are the evidence of what was supplied to a partner under an agreement.
Where the change history has to keep a record of an action for the integrity of the library, we keep the action and remove the person: the entry remains, the name does not.
On servers in the Asia Pacific (Seoul) region. Aurora World is a Korean company and access is administered from Seoul. If you are in the European Economic Area or the United Kingdom, this means your information is transferred outside it; the Republic of Korea has been found by the European Commission to provide an adequate level of protection, and we rely on that finding for the transfer.
You may ask us to:
Write to the address in section 10 and we will respond within 30 days. You may also complain to the Personal Information Protection Commission in Korea, or to your national data protection authority if you are in the EEA or the UK.
The Site sets a small number of cookies and none of them are for advertising or analytics:
| Cookie | What it does |
|---|---|
| Session cookie | Keeps you signed in. Deleted when it expires or when you sign out. |
| Language | Remembers whether you read the Site in English or Korean. |
| View preferences | Remembers how you like lists drawn, and which panels are open. |
There is no third-party tracking on the Site.
Access is credentialed and denied by default: a credential reaches only the material its access groups grant, every request for a file is checked against those groups before anything is read, and artwork is never served from a public address. Passwords are stored only as a one-way hash. Traffic is encrypted in transit. We record access as described in section 2 so that unauthorised use can be detected and investigated.
We may update this policy. The effective date at the head of this page changes when we do, and we will notify material changes to the email address on your account.
Privacy enquiries and requests under section 7: privacy@auroraworld.com Aurora World Corporation, Seoul, Republic of Korea.