Privacy Policy

Last Updated: March 25, 2026

Privacy Policy

Aribot — Cloud Security & Compliance Platform

Effective Date: [EFFECTIVE DATE]

Last Updated: [EFFECTIVE DATE]

This Privacy Policy describes how Aristiun Samsad B.V. ("Aristiun," "we," "us," or "our"), a company incorporated under the laws of the Netherlands, collects, uses, stores, and protects personal data in connection with the Aribot cloud security and compliance platform ("Platform"), available at https://aribot.ayurak.com.

We are committed to protecting your privacy and processing personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Dutch Implementation Act (UAVG), and other applicable data protection laws.

1. Data Controller

The data controller for personal data processed through the Platform is:

Aristiun Samsad B.V. The Netherlands

  • Data Protection Officer (DPO): privacy@aristiun.com
  • General Contact: info@aristiun.com

For data processing activities performed on behalf of our customers (where we act as a data processor), please refer to our Data Processing Agreement.

2. Data We Collect

2.1. Account Information

When you register for the Platform, we collect:

  • Full name
  • Email address
  • Company name and details
  • Job title/role
  • Password (stored in hashed form only)
  • Phone number (optional)

2.2. Cloud Infrastructure Metadata

When you connect cloud accounts for security scanning, we collect:

  • Cloud resource metadata (resource types, names, configurations, regions, tags)
  • Network topology information
  • Security group and policy configurations
  • Compliance policy evaluation results
  • Resource relationships and dependencies

2.3. Code Snippets

When you use the code security review feature, we process:

  • Code snippets submitted for review (chunked and processed)
  • Code patterns and architectural structures
  • Note: Secrets, API keys, and credentials are automatically stripped before any AI analysis (see Section 5.2)

2.4. Network Traffic Metadata (Shadow AI Discovery)

For Shadow AI Discovery, we process:

  • Network traffic metadata (domains, endpoints, request patterns)
  • AI service endpoint detection data
  • Note: We do NOT inspect payload contents or intercept encrypted traffic

2.5. Usage Analytics

We collect Platform usage data, including:

  • Feature usage patterns and frequency
  • Performance metrics
  • Error logs and diagnostic data
  • Session duration and navigation paths
  • Browser type, operating system, and device information

2.6. Communication Data

  • Support tickets and correspondence
  • Feedback and survey responses

3. Data We Do NOT Collect

We want to be transparent about what we do not collect or store:

  • Customer PII: We do not scan, collect, or store personal data of your end-users or customers
  • Financial data: We do not access or store payment card numbers (handled entirely by Stripe)
  • Production secrets: Code review automatically strips API keys, passwords, tokens, and credentials before AI processing
  • Database contents: We do not access or replicate your production databases
  • Raw credentials: Cloud account credentials are stored encrypted and used only for API authentication

4. Legal Basis for Processing (GDPR Article 6)

We process personal data on the following legal bases:

| Purpose | Legal Basis | GDPR Article | |---------|-------------|--------------| | Providing the Platform and Services | Performance of a contract | Art. 6(1)(b) | | Account management and authentication | Performance of a contract | Art. 6(1)(b) | | Customer support | Performance of a contract | Art. 6(1)(b) | | Security monitoring and fraud prevention | Legitimate interest | Art. 6(1)(f) | | Platform improvement and analytics | Legitimate interest | Art. 6(1)(f) | | Marketing communications | Consent | Art. 6(1)(a) | | Legal compliance and regulatory obligations | Legal obligation | Art. 6(1)(c) |

Legitimate Interest Assessment: Where we rely on legitimate interest, we have conducted balancing tests to ensure our interests do not override the fundamental rights and freedoms of data subjects. You may request details of these assessments by contacting our DPO.

5. How We Use Your Data

5.1. Service Delivery

  • Providing cloud security scanning, threat modeling, and compliance analysis
  • Generating security reports and recommendations
  • Authenticating users and managing access permissions
  • Processing billing and subscription management (via Stripe)

5.2. AI-Powered Analysis

  • Code patterns are analyzed by AI providers for security vulnerabilities
  • Architecture metadata is processed for threat modeling
  • Compliance rules are evaluated through AI-assisted analysis
  • Safeguards: Secrets are stripped before AI processing; data is not used for model training (see our AI Usage Policy)

5.3. Platform Improvement

  • Analyzing usage patterns to improve features and performance
  • Identifying and fixing bugs and errors
  • Developing new features based on aggregate usage trends

5.4. Communication

  • Sending service notifications and alerts
  • Responding to support requests
  • Sending marketing communications (with your consent, which you may withdraw at any time)

6. Data Storage and Security

6.1. Infrastructure

All customer data is hosted on Google Cloud Platform (GCP) in the us-central1 region (Council Bluffs, Iowa, United States).

6.2. Encryption

  • At rest: All data is encrypted using AES-256 encryption
  • In transit: All data transmissions are protected using TLS 1.2 or higher
  • Key management: Encryption keys are managed through Google Cloud KMS

6.3. Access Controls

  • Role-based access control (RBAC) with five permission levels
  • Multi-factor authentication support
  • Audit logging of all administrative actions
  • Principle of least privilege for internal access

6.4. Security Measures

  • Regular security assessments and penetration testing
  • 24/7 infrastructure monitoring
  • Automated vulnerability scanning
  • Incident response procedures
  • Employee security training and background checks

7. Data Retention

| Data Category | Retention Period | |--------------|-----------------| | Account data (profile, settings) | Duration of active account + 90 days after account deletion | | Scan results and reports | 1 year from generation date | | Application and access logs | 30 days | | Billing records | As required by Dutch tax law (7 years) | | Support correspondence | 2 years after resolution | | Marketing consent records | Duration of consent + 3 years |

After the applicable retention period, data is securely deleted or anonymized. You may request earlier deletion subject to legal and contractual obligations (see Section 9).

8. Third-Party Processors

We engage the following categories of sub-processors:

8.1. Infrastructure

8.2. Payment Processing

  • Stripe, Inc.: Subscription billing and payment processing — Stripe Privacy Policy
  • Stripe is PCI DSS Level 1 certified. We do not store payment card data.

8.3. AI Analysis Providers

  • Google (Vertex AI / Gemini): Security analysis and threat modeling
  • Anthropic: Security analysis via Claude models
  • xAI: Security analysis via Grok models
  • OpenAI: Security analysis

AI Provider Data Commitments:

  • No customer data is used for model training (contractually guaranteed)
  • Data is not retained by AI providers beyond the duration of request processing
  • Data is transmitted encrypted and processed in secure environments
  • See our AI Usage Policy for comprehensive details

8.4. Sub-Processor Updates

We maintain an up-to-date list of sub-processors. Under our Data Processing Agreement, customers are notified of changes and have the right to object to new sub-processors.

9. Your Rights (Data Subject Rights)

Under the GDPR, you have the following rights regarding your personal data:

9.1. Right of Access (Art. 15)

You may request a copy of the personal data we hold about you.

9.2. Right to Rectification (Art. 16)

You may request correction of inaccurate or incomplete personal data.

9.3. Right to Erasure (Art. 17)

You may request deletion of your personal data, subject to legal retention obligations.

9.4. Right to Data Portability (Art. 20)

You may request your personal data in a structured, commonly used, machine-readable format.

9.5. Right to Object (Art. 21)

You may object to processing based on legitimate interest, including profiling and direct marketing.

9.6. Right to Restriction (Art. 18)

You may request that we restrict processing of your personal data in certain circumstances.

9.7. Right to Withdraw Consent (Art. 7)

Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

9.8. Exercising Your Rights

To exercise any of these rights, contact our DPO at privacy@aristiun.com. We will respond within thirty (30) days. We may request verification of your identity before processing your request. If we cannot comply with a request, we will explain the reasons.

9.9. Right to Lodge a Complaint

You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or any other competent EU supervisory authority:

Autoriteit Persoonsgegevens Website: https://autoriteitpersoonsgegevens.nl Phone: +31 (0)70 888 8500

10. International Data Transfers

10.1. Transfer Mechanisms

As our infrastructure is hosted in the United States (GCP us-central1), personal data is transferred outside the European Economic Area (EEA). We rely on the following transfer mechanisms:

  • EU-U.S. Data Privacy Framework (DPF): For transfers to U.S.-based processors certified under the DPF
  • Standard Contractual Clauses (SCCs): EU Commission-approved SCCs (Module 2: Controller-to-Processor) for transfers to processors not covered by adequacy decisions
  • Adequacy Decisions: Where the European Commission has determined that a third country provides an adequate level of data protection

10.2. Safeguards

In addition to legal transfer mechanisms, we implement supplementary measures including encryption, access controls, and contractual data protection obligations on all processors.

11. Cookies and Tracking

11.1. Essential Cookies Only

The Platform uses essential cookies only, specifically:

  • Authentication tokens (JWT): Required for user session management
  • Session cookies: Required for Platform functionality
  • CSRF tokens: Required for security (cross-site request forgery protection)

11.2. No Tracking

We do not use:

  • Third-party tracking cookies
  • Advertising cookies or pixels
  • Social media tracking buttons
  • Cross-site tracking of any kind

11.3. No Cookie Consent Banner Required

Because we only use strictly necessary cookies, no cookie consent banner is required under the ePrivacy Directive. However, this is documented here for transparency.

12. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

12.1. Right to Know

You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purposes, and the categories of third parties with whom we share it.

12.2. Right to Delete

You have the right to request deletion of your personal information, subject to certain exceptions.

12.3. Right to Correct

You have the right to request correction of inaccurate personal information.

12.4. Right to Opt Out of Sale/Sharing

We do not sell or share personal information for cross-context behavioral advertising purposes. No opt-out is necessary.

12.5. Right to Non-Discrimination

We will not discriminate against you for exercising your CCPA rights.

12.6. Categories of Personal Information Collected

Under CCPA categories:

  • Identifiers: Name, email address, IP address
  • Professional information: Company name, job title
  • Internet activity: Usage data, log data
  • Geolocation: Approximate location derived from IP address

12.7. Exercising California Rights

California residents may exercise their rights by contacting us at privacy@aristiun.com or by using the data export features within the Platform.

13. Children's Privacy

The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child has provided personal data, we will take steps to delete it promptly.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

  • Posting the updated policy on our website with a revised "Last Updated" date
  • Sending an email notification to the address associated with your account

We encourage you to review this Privacy Policy periodically. Continued use of the Platform after changes constitutes acceptance.

15. Contact Us

For any questions, concerns, or requests related to this Privacy Policy or our data practices:

Aristiun Samsad B.V. The Netherlands

  • Data Protection Officer: privacy@aristiun.com
  • General inquiries: info@aristiun.com
  • Support: support@aristiun.com
  • Security incidents: security@aristiun.com
  • Website: https://aribot.ayurak.com

This Privacy Policy was last updated on [EFFECTIVE DATE].