This Privacy Policy explains how Aduro Creative Ltd ("Aduro", "we", "us") collects and uses personal data when you visit aduro.io, subscribe to our communications, or use the Blaze portal and related services. We aim to be clear and straightforward — please contact us if anything is unclear.
Who we are and our role
Aduro Creative Ltd is registered in England and Wales (company number 11200639). Registered office: LU 226, 10 Spectrum Way, London, SW18 4RH, United Kingdom.
For website visitors and Blaze account holders, Aduro is the data controller of your personal data under UK GDPR. Your employer or client organisation is our customer when you use Blaze on their behalf. We do not sell, rent, or share your personal data with other third parties except as described below.
Privacy enquiries: legal@weareaduro.com.
Where your data is stored
Personal data we process for Blaze is stored and processed exclusively in the United Kingdom, in UK datacentres. Your portal data does not leave the UK. Website infrastructure may use UK and EU providers with appropriate safeguards.
Information security
Aduro is accredited to ISO 27001. We use technical measures such as encryption of sensitive tokens, access controls, and monitoring. No online service can be completely secure; we work to reduce risk in line with the nature of the data we hold.
Data we collect
Depending on how you interact with us, we may process:
Contact details you submit (name, email, company, message content) via forms or email.
Newsletter subscription email addresses when you opt in.
Account details for Blaze: name, email, password (stored hashed), and role.
Organisation profile information (company name, registered number, billing address).
OAuth connection data when you connect GitHub (tokens encrypted at rest).
Repository and issue metadata synced from GitHub where you connect repositories.
Session and usage data: agent sessions, task history, token usage, and operational logs.
Product analytics in Blaze (for example page views and feature usage via Mixpanel, where enabled).
Website analytics and campaign measurement on aduro.io (for example Google Analytics and Google Ads, where you consent).
Payment references: Stripe customer identifiers and payment method metadata — not full card numbers.
Technical data: IP address, browser type, device type, and cookies (see our Cookie Policy).
How we use your data
We use personal data to:
Provide and operate our website, Blaze portal, and services you request.
Respond to enquiries and send communications you have opted into.
Authenticate you and maintain secure sessions.
Connect to services you authorise (GitHub, Slack where applicable, payment providers).
Bill your organisation and manage balances or credit terms.
Understand how our website and Blaze are used and improve them (analytics).
Measure marketing effectiveness and reach relevant audiences (where you consent).
Meet legal obligations, enforce our terms, and protect security.
Contact you about your account or important changes to this policy.
Legal basis (UK GDPR)
We rely on the following legal bases, depending on the processing:
Contract — to provide services and accounts you sign up for.
Legitimate interests — to secure and improve our services, prevent misuse, and run our business, balanced against your rights.
Legal obligation — where we must retain or disclose data to comply with law.
Consent — where required (for example optional marketing or non-essential cookies). You may withdraw consent at any time.
Sub-processors and analytics providers
We use carefully selected service providers who process data on our instructions. These include cloud hosting (UK-based for Blaze), payment processing (Stripe), email providers, identity services, and AI providers when you run agent tasks you initiate.
Analytics, consent, and marketing tools we use or plan to use include:
Cookiebot (Cybot A/S) — cookie consent management on aduro.io.
Google Tag Manager — loads tags on aduro.io only after consent where required.
Google Analytics — website usage analytics (statistics cookies, consent required on aduro.io).
Google Ads — advertising and conversion measurement (marketing cookies, consent required on aduro.io).
Mixpanel — product analytics within the Blaze portal to understand feature usage and improve the product.
Google analytics and advertising services may process data in the United States or other countries under appropriate safeguards. Mixpanel data for Blaze is configured for product improvement; we do not sell your personal data.
Retention
We keep personal data only for as long as needed for the purposes above. Blaze account data is generally retained while your account is active and for a reasonable period afterwards. When your account closes or your organisation’s MSA ends, we delete or anonymise personal data within a reasonable period, except where law requires longer retention.
Your rights
Under UK GDPR you have the right to access, rectify, erase, restrict, object, and port your data in certain circumstances, and to lodge a complaint with the ICO at ico.org.uk.
To exercise your rights, email legal@weareaduro.com. We may need to verify your identity before responding.
Children
Our services are for business users and are not directed at children under 18. We do not knowingly collect data from children.
Changes
We may update this policy from time to time. We will post the revised version on this page and update the "Last updated" date. Material changes may be notified through Blaze or by email where appropriate.
Governing law
This policy is governed by the laws of England and Wales. Disputes about your personal data are subject to the courts of England and Wales.