Privacy Statement

Who we are

ArmsLength AI sp. z o.o. ("ArmsLength AI", "we", "our", "us") is a company registered in Poland under KRS 0001130933 (REGON 529860865, NIP 676-267-86-89).

Registered office: ul. Komuny Paryskiej 2/13, 30-389 Kraków, Poland.

Questions about this notice? Email privacy@armslength.ai or write to the address above.

Personal data we process

Legal bases

• Contractual Necessity (Art. 6 (1)(b) GDPR) – to deliver the service you subscribe to.
• Legitimate Interest (Art. 6 (1)(f)) – for security logging and product analytics.
• Consent (Art. 6 (1)(a)) – for optional marketing emails (you can withdraw anytime).

Where and how we store data

All production data is hosted exclusively in Germany:

• Microsoft Azure – Germany West Central (Frankfurt)
• Supabase – AWS eu-central-1 (Frankfurt)
• Vercel Frontend & Edge Functions – EU edge (primary Frankfurt POP)

Each provider applies AES-256 encryption at rest and TLS 1.2+ in transit and holds independent security attestations (ISO 27001, SOC 2 Type II, CSA STAR, as applicable).

Core platform data (accounts, benchmarking results) is stored exclusively within the EEA. When you consent to analytics and marketing cookies, data may be transferred to providers located outside the EEA (e.g., the United States). These transfers rely on Standard Contractual Clauses (SCCs) or equivalent safeguards required by the GDPR.

Sharing and transfers

We never sell or rent personal data. Access is limited to:

• ArmsLength AI personnel with need-to-know duties.
• The infrastructure sub-processors listed above (Azure, Supabase, Vercel) under GDPR-compliant Data Processing Agreements.
• Analytics and marketing sub-processors (loaded only with your consent), such as providers of website analytics, session replay, B2B visitor identification, and advertising (e.g. Google, Microsoft, LinkedIn).

No other third-party transfers occur unless required by law.

Your rights

You may access, correct, erase, restrict, port or object to the processing of your personal data at any time and can lodge a complaint with your supervisory authority (in Poland: UODO).

Contact privacy@armslength.ai—we respond within 30 days.

Security

We enforce:

• Strong encryption in transit and at rest
• Role-based access control
• Multi-factor authentication on admin accounts
• Continuous vulnerability scanning
• 24 × 7 infrastructure monitoring

Production data is never used to train AI models.

Cookies

We only set:

1. Essential cookies — required for authentication and storing your cookie-consent preference.
2. Analytics and marketing cookies (loaded only after you consent) — including website analytics, session replay, B2B visitor identification, and advertising measurement, provided by third-party services such as Google, Microsoft, and LinkedIn.

You can decline non-essential cookies via the consent banner or reopen cookie settings from the footer at any time.

Changes

Future updates will appear here. For material changes we will notify registered users by email at least 30 days before they take effect.

© 2025 ArmsLength AI sp. z o.o.