Website policy

1. This policy covers the public site

This policy applies to the informational pages at rebelstack.app, including the homepage and legal pages. The public site has no registration, checkout, contact form, user uploads or authenticated account service. A limited server-side API at /api/enterprise/ reports routing status; sign-in and session creation remain unavailable. It does not provide access to private workspaces or device controls.

The early-access page and homepage invitation panel are disabled previews. They do not accept, transmit, validate or save invitation codes, and they do not create accounts. There is no hidden waiting-list registration. We will update the relevant privacy information before activating account creation or collecting enrolment details.

The enterprise API currently returns status information and rejects login, callback and session requests. It does not validate supplied credentials, redeem invitation codes, issue session cookies or create accounts. Please do not submit passwords, passkeys, invitation codes or tokens to these closed endpoints. The application does not keep submitted bodies or credentials and does not write them to application logs; ordinary Azure traffic processing still applies.

It does not describe the data handling of private subdomains, installed apps, separately hosted services or the Aurorion product. Those services need their own relevant terms and privacy information. Reading this page does not create an account or accept a software licence on your behalf.

2. Who is responsible

Aurorion Tech Ltd operates this public website and is the controller for personal information it processes for the purposes described here.

View the company record at Companies House.

Privacy questions and rights requests: privacy@aurorion.app.
General, accessibility or licensing enquiries: hello@aurorion.app.

These are the company’s existing published contact addresses. Include “RebelStack website” so the request can be directed to the right service. You may also write to the registered office.

3. Information involved in a visit

Delivering a page requires technical information. Microsoft Azure, our hosting provider, receives your IP address and request details such as the requested URL, request time, browser-supplied headers and connection information. Such information may also be processed for service operation, diagnostics, reliability and security.

The public pages do not run advertising pixels, session recording, visitor analytics, fingerprinting code or third-party font and media embeds. They do not request your precise location, microphone or camera, and do not send page content or visitor input to an AI model.

If you choose to email or write to us, we receive your contact details and the information you provide. Please do not send passwords, access tokens or unnecessary sensitive information. Basic technical request information is needed to deliver the website; sending an enquiry is optional.

4. Purposes and legal bases

We use the minimum technical information needed to deliver and protect the public website. Our legitimate interests are operating a reliable informational website, identifying faults and preventing misuse, while limiting the impact on visitors through a static, tracker-free design.

We use correspondence to answer the enquiry, handle a rights request or investigate a reported problem. Ordinary enquiries are handled for our legitimate interests in responding appropriately. Where a request or record must be handled to meet a legal obligation, that obligation is the basis for the necessary processing.

We do not sell visitor information, use it for behavioural advertising, or make solely automated decisions about visitors with legal or similarly significant effects. We do not use the public pages to profile children.

5. Cookies and browser storage

The current public pages do not set analytics or advertising cookies and do not write to local storage, session storage or IndexedDB. A small first-party script provides web-app installation, offline status and update controls. A service worker uses the browser’s Cache Storage to save an explicit list of public pages, the app manifest, artwork, icons and styling for offline reading. It does not save API responses, login callbacks, account data, invitation codes, requests with query parameters or requests carrying an authorisation header. There is no account session or analytics identifier in this public-page cache.

The installation and offline features do not set cookies. Public offline copies may remain on your device until replaced by a newer version, removed with the “Remove saved offline pages” control, cleared in your browser’s site-data settings, or evicted by the browser. A later visit can enable offline reading again. Removing an icon alone may not clear every browser data store. That describes the checked browsing path, not every unrelated service your browser may use. Your browser, email provider and any external site you choose to open have their own practices.

We will update this notice and provide any legally required choices before introducing storage, tracking or new data uses that need them. A cookie banner is not used as a substitute for those safeguards.

6. Hosting, recipients and international processing

Microsoft Azure Static Web Apps hosts and delivers these pages using distributed infrastructure. Its managed Azure Functions backend handles the limited enterprise API on the same domain. Microsoft and its authorised service providers may process technical data to supply and protect the service. Access to correspondence is limited to the people and service providers needed to handle it; advisers or authorities may receive relevant information where necessary for legal obligations or claims.

Technical processing may take place outside the United Kingdom. We do not promise UK-only storage or routing. Microsoft’s applicable Products and Services Data Protection Addendum sets out its processing and security terms. Where a restricted transfer requires safeguards, the applicable contractual or other lawful transfer mechanism must be used. Contact us for information about the safeguards relevant to your request.

See Microsoft’s privacy commitments. External links are ordinary links, not embedded services; opening them takes you to a separate website.

7. Retention

There is no visitor-account database or separate visitor-analytics store in this site. Offline public-page copies are stored locally in your browser rather than in an account. Older versions of this PWA’s own cache are removed when an updated worker activates; unrelated browser or application data is not deleted. Microsoft-managed delivery and security records follow the applicable hosting arrangements. We do not claim that all platform records are deleted immediately, or promise a fixed hosting-log retention period that has not been verified for this service.

For enquiries and reports we handle, retention is based on the purpose: the time needed to resolve the matter, document the outcome, meet a legal duty or manage a relevant dispute. Information that is no longer needed should be removed or anonymised. A justified legal hold may require relevant records to be kept longer. Contact us about a particular record or retention decision.

8. Your rights and complaints

Depending on the information, legal basis and applicable law, you may ask to access or correct personal information, have it erased, restrict its use, object to processing based on legitimate interests, or receive eligible information in a portable form. These rights have conditions and exceptions; we will explain any that affect your request.

Send requests to privacy@aurorion.app. We may ask only for information reasonably needed to identify the relevant records and protect them. We will respond within the applicable statutory time limit and explain any permitted extension. Where processing relies on consent, you can withdraw that consent without affecting earlier lawful processing.

You may complain to the Information Commissioner’s Office, the UK data protection regulator. Contacting us first may help resolve the matter, but does not remove your right to complain to the regulator.

9. Acceptable use and access

You are welcome to browse, link to, and use accessibility tools with the public pages. Do not deliberately disrupt the service, introduce malicious code, impersonate the company or attempt to enter private systems without permission. Permission to view this website is not permission to test, operate or automate private infrastructure.

Report a suspected security problem privately to the general contact above, sharing only the minimum information needed to explain it. This notice does not grant a testing authorisation or promise a reward. Read the licence and ownership notice before reusing material.

The site describes a product in development. Features, availability and public information may change; this page does not offer a subscription, a service-level commitment or guaranteed support. Nothing in this policy excludes liability or consumer rights that cannot lawfully be excluded, or replaces a separately agreed contract.

10. Updates and scope changes

This is RBL-WEB-POL-001, version 1.3, effective 10 October 2026. Changes will carry a new version or effective date. Material changes to data use will be explained before they take effect, with consent sought where required. Merely publishing revised wording does not create retroactive consent.

This version is for the installable public web app, its public-page offline cache, the disabled invitation preview and the routing-only enterprise API. Offline views can be older than the live site; they do not show a live sign-in or account state. Accounts, payments, analytics, AI features or new embedded services require their own review and updated information before launch.