Privacy statement

1. Who the controller is

Arnes is the controller of the data it collects directly: website data, demo requests, and platform user accounts. Its contact details are at the end of this statement.

When a customer organization uses the platform and uploads information about people (for example, control owners, third parties, or employees), that organization is the controller of that data and Arnes acts as a processor: it processes the data only to provide the service and on the customer’s instructions.

2. What data we process

Depending on how you interact with Arnes, we may process:

• Demo requests: name, work email, company, and the message you write.
• Platform accounts: name, email, organization, role and permissions, and the identifiers assigned by your identity provider.
• Sign-in with Microsoft: when you sign in with your Microsoft Entra ID account, we receive the basic profile data (name, email, and identifier) you authorize on Microsoft’s consent screen.
• Microsoft 365 documents: if your organization connects OneDrive or SharePoint, Arnes accesses documents with the delegated permissions you or your administrator grant, and only what each person can see.
• Content you upload: risks, controls, obligations, evaluations, attachments (PDF, Word, Excel, images), and conversations with the assistant.
• Audit log: who changed what, when, and what it looked like before, for auditing and security.
• Technical data: IP address, browser, dates, and requested pages, logged by our hosting providers to operate and protect the service.

The website does not use analytics or advertising cookies.

3. What we use it for

• Responding to your demo request and continuing the business conversation you start.
• Creating and managing accounts, authenticating users, and enforcing their permissions.
• Providing the platform’s features, including the AI assistant, at the user’s request.
• Keeping the audit log, securing the service and its continuity, and preventing abuse.
• Providing support, meeting legal obligations, and responding to requests from competent authorities.

We do not sell personal data or use it for advertising.

4. The AI assistant

When you ask the assistant for something, the content needed to answer (your instruction and the relevant documents and records you can see) is sent to AI model providers acting as Arnes’s processors. The assistant proposes changes; nothing is saved until a person approves it, and the approval is recorded in the audit log.

5. Who we share it with

Only with processors we need to provide the service, under confidentiality and security obligations:

• Cloud infrastructure and content delivery providers.
• Microsoft, when you use Microsoft sign-in or the Microsoft 365 integrations.
• AI model providers, for the assistant.
• Email and support providers.

We may also disclose data when required by law or by a competent authority. On request, we will tell you which processors handle your data.

6. International transfers

Some of these providers process data outside Colombia, including in the United States. In those cases we require adequate protection safeguards, in accordance with Colombian regulations.

7. How long we keep it

We keep data for as long as it is needed for the purpose for which it was collected, for the duration of the customer relationship, and for the periods required by law. Demo requests that do not move forward are deleted once they are no longer useful for replying to you. When a contract ends, customer content is returned or deleted as agreed.

8. Security

We apply technical, human, and administrative measures to protect data: encrypted communications, permission-based access control, human approval of AI-proposed changes, and a complete activity log. No system is infallible; if an incident affects your data, we will inform you as required by law.

9. Your rights

As a data subject, you can:

• Know, update, and correct your data.
• Request proof of the authorization you gave us.
• Be informed about how we use it.
• Revoke your authorization or request deletion of your data when there is no legal or contractual duty to keep it.
• Access your data free of charge.
• File complaints with Colombia’s Superintendence of Industry and Commerce (SIC), after first submitting your request to us.

Write to the contact email with your name, the right you want to exercise, and how to reply to you. We answer inquiries within 10 business days and claims within 15 business days; if we need more time, we will tell you why before the deadline. If your data is on the platform because a customer organization uploaded it, please direct your request to that organization; we will help process it.

To revoke Arnes’s access to your Microsoft account, you can withdraw consent in your Microsoft account’s app settings or ask your administrator.

10. Minors

Arnes is a service for organizations and is not directed at minors.

11. Changes to this statement

We may update this statement. We will publish the new version on this page with its date and, if the change is material, notify customers before it takes effect.

Contact

The controller’s contact details will be published here.