PrivacyPolicy

We use the information we collect for the following purposes:

• Service delivery: To provision your workspace, execute evaluation runs, generate reports, and provide customer support.

• Security and fraud prevention: To detect, investigate, and prevent security incidents, abuse, and unauthorised access.

• Product improvement: To analyse usage patterns, diagnose technical issues, and develop new features.

• Communications: To send service notifications, billing information, security alerts, and product updates.

• Compliance: To meet our legal obligations, enforce our terms of service, and respond to lawful data requests.

We process your data on the legal bases of contractual necessity (to deliver the service you subscribed to), legitimate interest (to improve and secure our platform), consent (for optional analytics and marketing), and legal obligation (to comply with applicable laws).

We do not sell your personal information. We share data only in the following circumstances:

• Service providers: With trusted third-party vendors who process data on our behalf (cloud hosting, payment processing, email delivery) under strict data processing agreements.

• Legal requirements: When required by law, regulation, legal process, or governmental request.

• Business transfers: In connection with a merger, acquisition, or sale of assets, with appropriate notice to affected users.

• With your consent: When you explicitly authorise us to share your information with a third party.

• Aggregated data: We may share anonymised, aggregated statistics that cannot identify individual users.

Your data is stored in the AWS region you selected during workspace provisioning. We support regions across Europe, North America, and Asia Pacific to help you meet data residency requirements.

We implement industry-standard security measures including encryption at rest (AES-256) and in transit (TLS 1.2+), network isolation, role-based access controls, audit logging, and regular penetration testing.

Workspace data is logically isolated per tenant. No customer data is shared across workspaces.

We retain your data for the following periods:

• Account information: For the duration of your subscription plus 90 days after account closure.

• Evaluation data (runs, transcripts, reports): Retained according to your plan tier — 30 days for Individual plans, 90 days for Enterprise plans, or as specified in your service agreement.

• Audit logs: Retained for 12 months for compliance and security purposes.

• Payment records: Retained for 7 years as required by financial regulations.

You may request earlier deletion of your data subject to our legal and contractual obligations.

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you.

• Rectification: Request correction of inaccurate or incomplete data.

• Erasure: Request deletion of your personal data ("right to be forgotten").

• Portability: Request your data in a structured, machine-readable format.

• Restriction: Request that we limit processing of your data in certain circumstances.

• Objection: Object to processing based on legitimate interest or for direct marketing purposes.

• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior lawful processing.

To exercise these rights, contact us at privacy@ariaeval.io. We will respond within 30 days (or as required by applicable law).

When we transfer personal data outside the European Economic Area (EEA) or the United Kingdom, we rely on approved transfer mechanisms including Standard Contractual Clauses (SCCs), adequacy decisions, or other lawful bases as required by applicable data protection legislation.

Our cloud infrastructure is deployed within the region you select. Cross-region data transfers are limited to operational necessities such as billing and account management.

GDPR (EU/EEA/UK): We act as the data controller for personal data processed through the platform. Our Data Protection Officer can be reached at dpo@ariaeval.io.

CCPA (California): California residents have the right to know, delete, and opt out of the sale of personal information. We do not sell personal information. You may submit a verifiable consumer request via privacy@ariaeval.io.

LGPD (Brazil): Brazilian users may exercise their rights under the LGPD by contacting privacy@ariaeval.io.