Privacy Policy

Your privacy matters to us

Last updated: January 22, 2026

At Aarohaa AI Inc. ("Aarohaa," "we," "us," or "our"), we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our AI-powered services (including Anvayaa and Saige), or engage with us in any capacity.

1. Information We Collect

We collect information to provide and improve our services, communicate with you, and ensure the security of our platforms.

Information You Provide Directly

Account Information: Name, email address, company name, job title, and contact details when you create an account or request a demo.
Communication Data: Information you provide when contacting us, including support requests, feedback, and inquiries.
Payment Information: Billing details processed through secure third-party payment processors. We do not store complete payment card information.
User Content: Data, documents, queries, and other content you submit to our AI services for processing.

Information Collected Automatically

Device Information: Browser type, operating system, device identifiers, and hardware settings.
Usage Data: Pages visited, features used, click patterns, session duration, and interaction with our services.
Log Data: IP addresses, access times, referring URLs, and system activity logs.
Cookies and Tracking: We use cookies, pixels, and similar technologies to enhance your experience and analyze usage patterns.

Information from Third Parties

Business Partners: Information from integration partners when you connect third-party services.
Public Sources: Publicly available business information to enhance our services.
Analytics Providers: Aggregated insights from analytics services about website traffic and user behavior.

2. How Our AI Services Process Data

Understanding how we handle data in our AI systems is fundamental to our transparency commitment.

AI Processing Principles

Purpose Limitation: Your data is processed only for the specific purpose you intended, such as document analysis, query processing, or generating insights.
Data Minimization: We process only the data necessary to deliver the requested service functionality.
No Unauthorized Training: Customer data submitted to our production AI services is NOT used to train our base models without explicit consent.
Isolation: Enterprise customer data is processed in isolated environments and is not commingled with data from other customers.

Anvayaa Platform

Document Processing: When you upload documents to Anvayaa, they are processed to extract insights, generate summaries, and enable intelligent querying.
Query Handling: Your queries are processed in real-time and are not retained beyond the session unless you explicitly save them.
Output Generation: AI-generated outputs are created based on your inputs and our trained models, with full audit trails for governance.

Saige Platform

Conversational AI: Saige processes your conversational inputs to provide contextual responses and assistance.
Context Management: Session context may be maintained to provide coherent multi-turn conversations but is cleared upon session termination.
Integration Data: When Saige integrates with your enterprise systems, data flows are governed by your configured permissions and our security protocols.

Model Training and Improvement

Aggregate Analytics: We may use anonymized, aggregated usage patterns to improve our services and develop new features.
Opt-in Training: If you choose to participate in model improvement programs, your data may be used for training purposes with your explicit consent.
Feedback Processing: When you provide feedback on AI outputs, this may be used to improve model performance, subject to your consent settings.

3. How We Use Your Information

We use the information we collect for the following purposes:

Service Delivery

Provide, maintain, and improve our AI platforms and services.
Process your requests, transactions, and deliver the functionality you request.
Personalize your experience and provide tailored recommendations.
Enable collaboration features and integrations you configure.

Communication

Send service-related notices, updates, and security alerts.
Respond to your inquiries, support requests, and feedback.
Provide information about new features, products, or services you may find valuable.
Send marketing communications (with your consent, where required).

Security and Compliance

Detect, prevent, and address fraud, security threats, and technical issues.
Enforce our terms of service and other applicable policies.
Comply with legal obligations and respond to lawful requests.
Maintain audit logs for governance and compliance requirements.

Analytics and Improvement

Analyze usage patterns to improve our products and services.
Conduct research and development for new features and capabilities.
Generate aggregated, anonymized insights about service usage.

4. Your Rights and Choices

We respect your rights regarding your personal information. Depending on your location, you may have the following rights:

GDPR Rights (European Economic Area)

Right to Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete personal data.
Right to Erasure: Request deletion of your personal data under certain circumstances.
Right to Restriction: Request limitation of processing of your personal data.
Right to Data Portability: Receive your data in a structured, machine-readable format.
Right to Object: Object to processing based on legitimate interests or direct marketing.
Rights Related to Automated Decision-Making: Request human review of automated decisions that significantly affect you.

CCPA Rights (California Residents)

Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected.
Right to Delete: Request deletion of your personal information, subject to certain exceptions.
Right to Opt-Out: Opt out of the sale of your personal information (note: we do not sell personal information).
Right to Non-Discrimination: You will not be discriminated against for exercising your privacy rights.
Right to Correct: Request correction of inaccurate personal information.

Exercising Your Rights

To exercise any of these rights, please contact us at privacy@aarohaa.ai.
We will respond to your request within the timeframe required by applicable law (typically 30-45 days).
We may need to verify your identity before processing your request.
Some requests may be subject to certain limitations and exceptions under applicable law.

Account Controls

Access and update your account information through your account settings.
Configure notification preferences and communication settings.
Manage cookie preferences through our cookie consent tool.
Request account deletion by contacting our support team.

5. Data Retention and Security

We implement robust measures to protect your data and retain it only as long as necessary.

Retention Periods

Account Data: Retained for the duration of your account and a reasonable period thereafter for legal and business purposes.
Transaction Records: Retained as required by applicable tax and financial regulations (typically 7 years).
AI Processing Data: Session data is typically deleted within 30 days unless you explicitly save it or longer retention is required for service delivery.
Log Data: Security and access logs are retained for 12-24 months for security and compliance purposes.
Marketing Data: Retained until you withdraw consent or request deletion.

Security Measures

Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
Access Controls: Role-based access control, multi-factor authentication, and principle of least privilege.
Infrastructure Security: Our services are hosted on SOC 2 Type II certified cloud infrastructure with continuous monitoring.
Security Testing: Regular penetration testing, vulnerability assessments, and security audits.
Incident Response: Documented incident response procedures with notification protocols.

Data Deletion

Upon account termination or deletion request, we will delete or anonymize your personal data within 90 days.
Some data may be retained longer if required by law or for legitimate business purposes (e.g., fraud prevention).
Backup copies may persist for a limited additional period as part of our disaster recovery procedures.

6. Third-Party Services and Sharing

We work with trusted partners to provide our services. Here is how we share information:

Service Providers

Cloud Infrastructure: We use leading cloud providers (AWS, GCP) for hosting, storage, and computing services.
Payment Processing: Payment transactions are handled by PCI-DSS compliant payment processors.
Analytics: We use analytics services to understand and improve our products.
Communication: Email delivery, customer support tools, and communication platforms.

Business Partners

Integration Partners: When you connect third-party services, data may be shared as necessary for the integration to function.
Resellers and Distributors: If you engage with us through a partner, relevant information may be shared for service delivery.

Legal and Compliance

We may disclose information when required by law, legal process, or government request.
We may share information to protect our rights, privacy, safety, or property, or that of our users or the public.
In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

What We Do NOT Do

We do NOT sell your personal information to third parties.
We do NOT share your data with advertisers for targeted advertising purposes.
We do NOT use your enterprise data to train AI models for other customers without explicit consent.

7. International Data Transfers

Aarohaa operates globally, and your information may be transferred to and processed in countries other than your own.

Transfer Mechanisms

For transfers from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses approved by the European Commission.
We implement supplementary measures where necessary to ensure adequate protection.
Our data processing agreements with sub-processors include appropriate transfer mechanisms.

Data Localization

Enterprise customers may have options for regional data processing and storage.
Contact our sales team for information about data residency options for your organization.

8. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience.

Types of Cookies

Essential Cookies: Required for basic site functionality and security. Cannot be disabled.
Performance Cookies: Help us understand how visitors interact with our site by collecting anonymous information.
Functional Cookies: Remember your preferences and settings for a better experience.
Marketing Cookies: Track your activity across sites to deliver relevant advertisements (used only with consent).

Managing Cookies

Use our cookie preference center to manage your cookie settings.
Browser settings can be configured to block or delete cookies.
Note that blocking certain cookies may affect site functionality.

9. Children's Privacy

Our services are not directed to individuals under 16 years of age.

We do not knowingly collect personal information from children under 16.

If we become aware that we have collected personal information from a child under 16, we will take steps to delete that information.

If you believe we have inadvertently collected information from a child, please contact us immediately.

We do not knowingly collect personal information from children under 16.
If we become aware that we have collected personal information from a child under 16, we will take steps to delete that information.
If you believe we have inadvertently collected information from a child, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.

We will notify you of material changes by posting a notice on our website or sending you an email.

Your continued use of our services after the effective date of changes constitutes acceptance of the updated policy.

We encourage you to review this policy periodically to stay informed about how we protect your information.

We will notify you of material changes by posting a notice on our website or sending you an email.
Your continued use of our services after the effective date of changes constitutes acceptance of the updated policy.
We encourage you to review this policy periodically to stay informed about how we protect your information.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Contact Information

Email: privacy@aarohaa.ai
Address: Aarohaa AI Inc., Delaware, United States
For EU/UK inquiries, you may also contact our Data Protection representative.

Response Time

We aim to respond to all privacy-related inquiries within 5 business days.
For formal rights requests, we will respond within the timeframes required by applicable law.

Complaints

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.
EU residents may contact their national Data Protection Authority.
UK residents may contact the Information Commissioner's Office (ICO).

Questions about your privacy?

Our team is here to help with any questions about how we handle your data.

privacy@aarohaa.ai