Privacy

This notice explains how information is handled on Aureqo's public website and enquiry forms. It covers website enquiries only; it does not describe operational data in AureqoLab or AureqoEq.

Notice updated: 11 September 2026.

Who operates this site

Aureqo is operated by CEOFlowStudio, ABN 84 347 045 037, Australia. Privacy questions can be sent to privacy@aureqo.com.au.

Information you provide

A product-walkthrough request asks for your name, work email, organisation and product interest. You may add a description of what you would like to improve. The form asks for permission to contact you about that request. For new requests, the server records the permission wording, privacy-notice version, permission method and receipt time with the enquiry. This permission is limited to the request and does not add you to a newsletter or general marketing programme.

The general Contact form asks for your name, email and message. Organisation is optional. We record that you requested a response and the notice version, without treating it as marketing consent. Earlier enquiry forms also asked for laboratory size, country, role, phone or preferred contact method; previously submitted records may contain those details.

Do not include patient, clinical or regulated data, laboratory results, credentials or confidential laboratory records in these forms or enquiry emails.

Why the information is used

Enquiry information is used to respond by email, understand the product or question you are asking about, arrange a walkthrough and discuss any potential pilot separately. Technical request information is also used for validation, abuse prevention and troubleshooting. The server uses the network address supplied by the hosting platform to enforce shared enquiry limits. The marketing database receives short-lived, daily pseudonymous digests rather than raw network addresses; expired counters may remain until a later accepted request or operator cleanup.

Bot protection

Enquiry forms use Cloudflare Turnstile to check for automated abuse. Your browser connects to Cloudflare for verification, which processes technical browser and network information. Our server sends the verification token to Cloudflare and checks the result before accepting an enquiry. We do not send the enquiry fields to Cloudflare or retain verification tokens in the marketing database. This provider processing is separate from enquiry storage and is not a promise of Australian-only processing. See Cloudflare’s privacy policy.

Visit attribution

The website uses browser session storage to keep a limited record of the first landing-page path, an external referring hostname and recognised campaign source, medium and campaign values. This record is attached to an enquiry to help understand how visitors found Aureqo. It excludes the full referring URL and unrelated query parameters. This session record operates separately from aggregate analytics.

Aggregate analytics

Vercel Web Analytics is inactive in this website configuration. The limited enquiry attribution described above still operates.

The website implementation does not add advertising cookies or cross-site advertising trackers.

Service providers and processing locations

Vercel hosts the public website; its enquiry-processing functions are configured in Washington, DC, United States. The dedicated marketing Supabase project stores the primary enquiry database in Sydney, Australia. Resend processes notification and acknowledgement email content and logs in the United States. Business correspondence is held in VentraIP Axigen mailboxes; VentraIP states that its customer data is stored on Australian infrastructure.

Australian business ownership and database location do not mean all processing occurs only in Australia. Provider support, security and subprocessor arrangements may involve further processing described in their policies. Outlook or another email application may also keep copies under the operator’s device and account configuration. Contact us if your organisation requires a specific data-location arrangement before sharing details.

Protection and retention

Enquiry requests are validated on the server, and enquiry limits are enforced server-side. Provider credentials remain server-side and are not sent to the browser. These measures are operational controls; they are not a security guarantee, certification or statement about the security of either laboratory product.

Our operating schedule is to review and delete new website enquiry records after 12 months from receipt, unless a continuing enquiry or a specific legal or dispute need justifies a documented, time-limited hold. Related mailbox correspondence is reviewed for deletion 12 months after the last substantive exchange. Reviews occur monthly; deletion is an authorised operator action, not immediate automatic expiry. Older records may be reviewed separately.

Provider logs and backups have separate expiry periods. Vercel’s published runtime-log window depends on the plan: one hour on Hobby or one day on Pro without extended observability. Resend’s published non-Enterprise email/log retention is 30 days, with seven-day backups; different contractual settings can apply. VentraIP Business Email backup rotation includes daily copies for seven days, weekly copies for four weeks and monthly copies for two months. Deleting active records does not immediately remove every backup. Completed deletions must be reapplied after restoration before records are reused.

The marketing database uses Supabase Free. This notice does not promise paid daily-backup or point-in-time recovery features. Product or pilot recovery arrangements are assessed separately.

Questions, corrections and deletion requests

Email privacy@aureqo.com.au to ask about information handling, raise a concern, or request access, correction or deletion of your enquiry information. Include only enough business-contact information to identify the enquiry. We may need to verify the request before responding. No automatic deletion outcome or response deadline is promised here.

You can also use the Contact page. Product or pilot data handling must be explained and agreed separately before access; this website notice is not a product data-processing agreement.