Contents · 9 sections
Who we are
ArmsLength AI sp. z o.o. ("ArmsLength AI", "we", "our", "us") is a company registered in Poland under KRS 0001130933 (REGON 529860865, NIP 676-267-86-89).
Registered office: ul. Komuny Paryskiej 2/13, 30-389 Kraków, Poland.
Questions about this notice? Email privacy@armslength.ai or write to the address above.
Personal data we process
| Data category | What we collect | Purpose | Retention |
|---|---|---|---|
| Account details | Name, business-email address, password hash | Create and secure user accounts; essential service emails | Deleted within 90 days of account closure |
| Usage logs | IP address, timestamps, browser metadata, in-app actions | Fraud prevention, service analytics, incident response | 30 days (raw), then anonymized |
| Support data | Content of tickets or emails you send us | Resolve technical issues | Up to 24 months, then deleted/anonymized |
Account details
- What we collect
- Name, business-email address, password hash
- Purpose
- Create and secure user accounts; essential service emails
- Retention
- Deleted within 90 days of account closure
Usage logs
- What we collect
- IP address, timestamps, browser metadata, in-app actions
- Purpose
- Fraud prevention, service analytics, incident response
- Retention
- 30 days (raw), then anonymized
Support data
- What we collect
- Content of tickets or emails you send us
- Purpose
- Resolve technical issues
- Retention
- Up to 24 months, then deleted/anonymized
Note: Benchmarking inputs are public-domain company data, not personal data.
Legal bases
- Contractual Necessity (Art. 6 (1)(b) GDPR) to deliver the service you subscribe to.
- Legitimate Interest (Art. 6 (1)(f)) for security logging and product analytics.
- Consent (Art. 6 (1)(a)) for optional marketing emails (you can withdraw anytime).
Where and how we store data
All production data is hosted exclusively in Germany:
- Microsoft Azure – Germany West Central (Frankfurt)
- Supabase – AWS eu-central-1 (Frankfurt)
- Vercel Frontend & Edge Functions – EU edge (primary Frankfurt POP)
Each provider applies AES-256 encryption at rest and TLS 1.2+ in transit and holds independent security attestations (ISO 27001, SOC 2 Type II, CSA STAR, as applicable).
Core platform data (accounts, benchmarking results) is stored exclusively within the EEA. When you consent to analytics and marketing cookies, data may be transferred to providers located outside the EEA (e.g., the United States). These transfers rely on Standard Contractual Clauses (SCCs) or equivalent safeguards required by the GDPR.
Your rights
You may access, correct, erase, restrict, port or object to the processing of your personal data at any time and can lodge a complaint with your supervisory authority (in Poland: UODO).
Contact privacy@armslength.ai; we respond within 30 days.
Security
We enforce:
- Strong encryption in transit and at rest
- Role-based access control
- Multi-factor authentication on admin accounts
- Continuous vulnerability scanning
- 24 × 7 infrastructure monitoring
Production data is never used to train AI models.
Changes
Future updates will appear here. For material changes we will notify registered users by email at least 30 days before they take effect.