Privacy Policy

Last updated: 26 September 2026

ARIMA (“ARIMA”, “we”, “us”) runs the audit-readiness service at www.arima.live. This policy explains what information we collect when you use it, why, how long we keep it, who processes it for us, and the choices you have. Questions go to info@arima.live.

1. Information we collect

Information you give us

• Account details: your name, email address and a password (stored only as a one-way hash). If you sign in with Google, see section 3.
• Organisation details: your company name, website or domain, and the answers you give in ARIMA’s questionnaires.
• Content you add: documents and policies you upload or import, scanner output and other evidence you upload, notes, and the remediation work you record.
• Invitations: the email addresses of colleagues you invite to your workspace.

Information we generate

• Scan results: when you ask ARIMA to check your website, it reads public signals (for example TLS, security headers, DNS and email-authentication records) and stores the findings.
• Assessments: readiness scores, gap lists and reports built from your answers and evidence.

Information collected automatically

• Cookies that keep you signed in and protect sign-in flows (section 7).
• Usage analytics: Vercel Web Analytics records page views without advertising cookies. We strip invitation and application tokens from page addresses before anything is sent.
• Server logs: IP address, browser type and request times, used for security and troubleshooting.

2. How we use information

• To provide the service: create your account, run assessments, analyse the documents and evidence you supply, and produce reports.
• To send service emails, such as sign-up verification, invitations and account notices.
• To keep the service secure, prevent abuse and fix problems.
• To understand, in aggregate, which parts of the product are used, so we can improve it.

We do not sell your information, and we do not use it for advertising.

3. Information from Google

ARIMA uses Google in two optional ways.

Sign in with Google

If you choose it, Google shares your basic profile with us (scopes openid, email, profile). We keep only your name, email address and Google account ID, and use them only to create your account and sign you in.

Google Drive

If you connect Google Drive, ARIMA asks only for the drive.file scope. That lets ARIMA open the specific files you choose in Google’s own file picker, and files ARIMA itself creates in your Drive (for example a report you export). ARIMA cannot see, list or search the rest of your Drive.

• Use: we read a file you pick once, to import its text into your ARIMA workspace for analysis, and we write files only when you ask us to export.
• Storage: we store the text extracted from files you import, as part of your workspace. The access tokens Google issues us are stored encrypted.
• Sharing: Google user data is not sold, not used for advertising, not shared with anyone except the processors in section 5 that are needed to run the service, and not used to train generalised AI or machine-learning models.
• Control: you can disconnect Google Drive in ARIMA’s settings at any time, which deletes the stored tokens, and you can revoke ARIMA’s access at myaccount.google.com/permissions.

ARIMA’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. AI processing

Some features, such as document analysis and suggested remediation, send the relevant text to Google’s Gemini models through Google Cloud Vertex AI. That processing runs under Google Cloud’s enterprise terms, under which Google does not use your content to train its models. ARIMA does not use your content to train AI models either. AI output can be wrong; see our Terms of Service.

5. Who processes data for us

• Google Cloud — servers, database and AI processing (United States).
• Vercel — hosting of the website and privacy-friendly analytics.
• Resend — delivery of service emails.
• Google — Sign in with Google and Google Drive, only if you use them.
• Stripe — only if you connect your own Stripe account as compliance evidence; ARIMA’s access is read-only.

These providers process data only on our instructions. Because they operate internationally, your information may be processed outside your country; we rely on the providers’ contractual safeguards for those transfers. We may also disclose information if the law requires it, or to protect the rights and safety of our users or the service.

6. How long we keep information

We keep your account and workspace data for as long as your account is open. If you ask us to delete your account, we delete your account and workspace data within 30 days, except where we must keep something to meet a legal obligation. Server logs are kept for a limited period for security and then deleted.

7. Cookies

ARIMA uses only cookies it needs to work:

• arima_session — keeps you signed in.
• arima_oauth_state, arima_drive_state — protect Google sign-in and Drive connection against forgery; short-lived.
• arima_signup, arima_gp — carry you through sign-up and Google sign-up; short-lived.
• A language preference cookie; your theme choice is kept in your browser.

We do not use advertising or cross-site tracking cookies.

8. Security

Traffic is encrypted with HTTPS, passwords are stored only as hashes, and third-party access tokens are encrypted at rest. Access to production systems is restricted. No system is perfectly secure, so please tell us at info@arima.live if you find a problem.

9. Your rights and choices

Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to object to or restrict some processing. Email info@arima.live from the address on your account and we will respond within 30 days. You can also disconnect integrations yourself in ARIMA’s settings.

10. Children

ARIMA is a business service and is not meant for anyone under 16. We do not knowingly collect their information.

11. Changes to this policy

If we change this policy we will update the date at the top, and if a change is significant we will tell signed-in users before it takes effect.

12. Contact

Privacy questions and requests: info@arima.live.