How we collect, use, and protect your information.
Arnis ("we," "us," or "our") is committed to protecting the privacy of our clients and their contacts. This Privacy Policy explains how we collect, use, store, and protect information when you use the Arnis platform ("Service").
This policy applies to two categories of individuals:
If you are a Contact who has received messages through the Arnis platform, the Client who uploaded your information is the data controller for your personal data. Please reach out to the business that contacted you for questions about how your data is used.
When you create an account and use the Service, we collect:
Clients upload contact information to the platform, which may include:
The platform processes and stores communication records, including:
We maintain detailed activity logs for all contact interactions, including:
We use the information collected to:
Within each Client's isolated instance, we use data to:
We may use your email address to send:
The platform uses OpenAI's language models to generate conversational responses. When processing conversations:
The AI is designed with strict information boundaries. It will only use information explicitly provided in campaign context, service descriptions, and answered question templates. It will not fabricate information, make commitments, or discuss prohibited topics.
When the AI encounters questions it cannot answer, those questions are logged within your instance. Answered questions become templates used exclusively within your installation to improve future conversations. Question template data is not shared across client installations.
Arnis uses a single-tenant architecture where each Client receives their own dedicated installation. This means:
We do not share, aggregate, or cross-reference data between client installations. Each instance is a self-contained environment. Contact data, conversation histories, campaign configurations, question templates, and all other data remain exclusively within your dedicated installation.
We share data with the following third-party service providers as necessary to deliver the Service:
If you configure webhooks, event data (such as call completions, appointment schedules, or opt-outs) is sent to your specified webhook URLs. You are responsible for the security and privacy practices of your webhook endpoints.
We may disclose information if required by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
We do not sell, rent, or trade personal information to third parties for their marketing purposes.
When we provide telephony services, we manage the carrier accounts and are responsible for the secure handling of telephony data within those accounts. Phone number usage, call records, and SMS logs are maintained within your dedicated instance.
When you provide your own carrier credentials (e.g., Twilio Account SID, Auth Token), those credentials are stored securely (encrypted at rest) within your instance. We use your credentials solely to provide the Service. You are responsible for the security of your carrier accounts and for complying with your carrier's data handling policies.
Regardless of the carrier arrangement, all communication data processed through the platform is stored within your isolated instance and subject to the same data protection standards.
We implement appropriate technical and organizational measures to protect your information, including:
While we take reasonable measures to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.
We retain your data for as long as your account is active and as needed to provide the Service. This includes:
Upon termination of your service agreement, you may request a data export within 30 days. After this period, your data may be permanently deleted from our systems, including all backups, within a reasonable timeframe.
The platform uses Redis for short-term caching (session data, rate limiting, conversation context, campaign settings). Cached data expires automatically based on configured time-to-live values, typically ranging from 1 minute to 24 hours.
As a Client, you have the right to:
If you are a Contact who has received communications through the Arnis platform:
Clients are responsible for honoring data subject requests from their contacts in accordance with applicable privacy laws.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information.
Clients are the data controllers for all contact and lead data they upload to the platform. Clients are responsible for:
We process contact data on behalf of Clients as a data processor. We only use contact data as instructed by the Client through their campaign configurations and platform settings. We do not independently use contact data for our own purposes.
The Arnis marketing website may use cookies and similar technologies for analytics and functionality. The Arnis platform application uses session-based authentication stored in Redis rather than persistent cookies.
A debug mode setting (configurable by Super Admin) may enable browser console logging for troubleshooting purposes. This does not transmit additional data to our servers.
The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us so we can take appropriate steps to remove that information.
The Service is primarily designed for use within the United States and is optimized for U.S. phone numbers, area codes, and TCPA regulations. If you use the Service from outside the United States, you acknowledge that your data may be transferred to and processed in the United States.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you through the platform or via email. The "Last updated" date at the top of this page indicates when this policy was last revised.
If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:
Arnis
Email: [email protected]
For data subject requests or privacy-related inquiries from Contacts, please reach out to the business that contacted you directly.
By using the Arnis platform, you acknowledge that you have read and understood this Privacy Policy.