Privacy Policy

This Policy covers two categories of data:

• Account Data - information about you as a Customer (billing info, login credentials, usage data).
• Customer Data - the contacts, leads, call logs, message content, and related records you upload to or generate through ARI (e.g., names, phone numbers, emails, notes, campaign activity).

You (the Customer) remain the data controller for Customer Data you upload. We act as a data processor/service provider with respect to that data, processing it only to provide the Service and as you direct.

From you directly:

• Account registration details (name, business name, email, phone)
• Billing and payment information (processed via our payment processor; we do not store full card numbers)
• Support communications

Automatically, through your use of the Service:

• Log data (IP address, browser type, device info, timestamps)
• Usage data (features used, campaign activity, login frequency)
• Cookies and similar tracking technologies (see Section 8)

Uploaded or generated through use of ARI:

• Contact/lead records you import or enter (names, phone numbers, emails, addresses, notes)
• Call recordings, call metadata, and transcripts (if calling features are used)
• SMS/text message content and delivery logs (if messaging features are used)
• Campaign automation sequences and engagement data (opens, clicks, replies)

We use Account Data to:

• Provide, maintain, and improve the Service
• Process billing and manage your subscription
• Communicate with you about your account, updates, or support requests
• Monitor for security, fraud, and abuse

We process Customer Data (contacts, calls, messages) solely to:

• Operate the features you use (campaign automation, calling, texting, CRM record-keeping)
• Enable integrations you connect (see Section 5)
• Provide analytics and reporting back to you within the Service

We do not use Customer Data to train models, sell to third parties, or use it for our own marketing purposes.

When you use AI drafting features, content you submit may be sent to configured AI providers (e.g., Anthropic or OpenAI) solely to generate output for your account.

ARI includes automation features for outbound calls and text messages. You, as the Customer, are solely responsible for:

• Obtaining valid consent from each Contact before enrolling them in a calling or texting sequence, consistent with the Telephone Consumer Protection Act (TCPA), CAN-SPAM, and applicable state telemarketing laws
• Maintaining records of that consent
• Honoring opt-out and Do-Not-Call requests promptly (see our separate TCPA Consent & Do-Not-Call Policy)

We provide tools to help capture and log consent and opt-outs, but we do not verify the lawful basis of any specific contact list you upload.

ARI integrates with third-party platforms you may choose to connect, including but not limited to:

• Clerk (authentication)
• Supabase (database and storage)
• Stripe (payment processing)
• Vercel (hosting and infrastructure)
• Twilio (SMS, when you send messages)
• Resend (email delivery, when configured)
• Slybroadcast (ringless voicemail, when you send drops)
• Google Calendar (when you connect OAuth from Settings)
• Dotloop (when you connect OAuth from Settings)
• Anthropic and/or OpenAI (AI drafting features, when configured)
• ElevenLabs (AI voice synthesis, when configured)

When you connect an integration, Customer Data flows between ARI and that platform according to your configuration. Each third-party service has its own privacy practices, and we encourage you to review them. We are not responsible for how connected third-party platforms handle data once it leaves ARI.

We may also share information with:

• Service providers who help us operate ARI (hosting, payment processing, customer support tools), under confidentiality obligations
• Law enforcement or regulators, if required by law, subpoena, or legal process
• A successor entity, in the event of a merger, acquisition, or sale of assets

We do not sell Account Data or Customer Data to third parties.

• Data is hosted on Vercel and associated database providers.
• We use industry-standard safeguards (encryption in transit, access controls, authentication) to protect data, but no system is 100% secure.
• Call recordings and message logs, if enabled, are retained according to your account settings and applicable legal requirements.
• You are responsible for the security of your own account credentials.

• Account Data is retained for as long as your subscription is active, plus a reasonable period after cancellation for legal/accounting purposes.
• Customer Data is retained per your account settings and deleted or anonymized within a commercially reasonable period after account termination, unless we are required to retain it for legal compliance.
• You may request earlier deletion of specific Customer Data by contacting us.

We use cookies and similar technologies for authentication, session management, and basic analytics. You can control cookies through your browser settings, though disabling them may affect Service functionality.

Depending on your location, you (or the Contacts in your account) may have rights to:

• Access, correct, or delete personal data
• Object to or restrict certain processing
• Request a copy of data in a portable format
• Withdraw consent for calling/texting (opt-out)

Customers: Contact us using the information in Section 13 to exercise these rights for your Account Data. Contacts/End Users: Requests regarding data uploaded by a Customer should generally go to that Customer directly, as they are the data controller. We will assist Customers in fulfilling such requests.

If you or your Contacts are located in the EEA/UK or California, additional rights may apply. See our separate Data Processing Agreement (DPA) for GDPR-specific terms, and contact us to request our CCPA disclosures if applicable.

The Service is not directed to individuals under 18, and we do not knowingly collect data from children.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notice. Continued use of the Service after changes take effect constitutes acceptance.

Questions or requests regarding this Privacy Policy:

Kikzeny Cartagena LLC
hello@myari.io