Privacy Policy

This Privacy Policy describes how AROOGA LLC ("AROOGA", "we", "us") collects, uses, and discloses information when you visit our websites (arooga.ai, copilot.arooga.ai, scribe.arooga.ai) or use our products and services ("Services"). We drafted this policy to cover our obligations under the EU General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, the California Consumer Privacy Act (CCPA/CPRA), and comparable regulations in the markets we serve.

1. Information we collect

We collect information in three categories:

1.1 Information you provide

• Contact information — name, company, work email, phone when you request a demo or briefing, or sign an NDA with us.
• Account information — if you create an AROOGA CORTEX account via api.arooga.io, this includes your authentication identifier (Clerk-issued), organisation slug, and API keys you generate.
• Communications — emails, calls, meeting notes, and tickets exchanged with our team.

1.2 Information we collect automatically

• Log and device data — IP address, browser user-agent, pages visited, referrer, screen size, timestamp. Used for security and aggregated analytics.
• Cookies — see our Cookie Policy.

1.3 Customer content (product data)

When you use AROOGA products that process customer data (for example, AROOGA COPILOT handling calls, AROOGA SCRIBE processing clinical dictations, or AROOGA CORTEX storing agent memories), we handle that data strictly as a data processor under your instructions, as defined in your Master Services Agreement or Data Processing Addendum.

2. Legal bases (GDPR)

2.1 Your rights

Under GDPR, CCPA, and comparable laws you have the right to:

• Access — request a copy of personal data we hold about you.
• Rectify — correct inaccurate personal data.
• Erase — request deletion of your personal data (subject to legal retention obligations).
• Restrict processing — limit how we use your data.
• Data portability — receive your data in a structured, machine-readable format.
• Object — opt out of processing based on legitimate interest or direct marketing.
• Withdraw consent — for any processing based on consent, at any time.
• Lodge a complaint — with your local data protection authority.

To exercise any of these rights, email hello@arooga.ai with the subject line Privacy Request.

3. Data retention

• Lead and contact forms — 24 months from last interaction.
• Account data — for the life of your account plus 30 days, then purged.
• Customer content — per your service agreement or DPA; default 90 days post-termination.
• Aggregated analytics — indefinitely, in de-identified form.
• Legal / compliance records — as required by applicable law (typically 6–7 years).

4. International transfers

AROOGA operates from offices in Istanbul and Tbilisi, with expansion planned into Dubai and Austin. We transfer data internationally relying on:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable.
• Equivalent mechanisms under UK and other applicable law.
• Data-residency controls at the product layer — Enterprise tenants can enforce region-locked processing.

5. Sub-processors

We rely on a limited set of sub-processors to operate the Services. A current list is available on request from hello@arooga.ai. We require all sub-processors to meet data-protection standards equivalent to this Policy.

6. Security

We use technical and organisational measures appropriate to the risk, including encryption at rest (AES-256) and in transit (TLS 1.3+), RBAC, audit logs, and principle-of-least-privilege access. Enterprise customers may request our security questionnaire and SBOM under NDA.

7. Children

Our Services are not directed at children under 16, and we do not knowingly collect personal data from them.

8. Changes to this Policy

We may update this Policy from time to time. Material changes will be announced via email to active account holders and on this page at least 30 days before they take effect.

9. Contact

AROOGA LLC · hello@arooga.ai