Privacy Policy

arosis is operated by Tran Binh Nguyen, an individual (sole proprietor) trading as “arosis”, of An Nhon Ward, Go Vap, Ho Chi Minh City, Vietnam(“arosis”, “we”, “us”). We are the data controller for the personal data described in this policy, except where we act as a processor on your behalf (see section 4).

You can reach us about anything in this policy at success@arosis.ai.

Account data. Your name, email address, and authentication details, collected when you sign up. Authentication is handled by Clerk; we do not store your password.

Business data (your “Golden Record”). The canonical record of the business you manage in arosis: business name, address, phone number, website, opening hours, service areas, services and descriptions, categories, FAQs, images, and related content. Some of this may be personal data — for example a sole trader’s name, home-based business address, or personal phone number.

Connected-account data. When you authorize a connection, we access and store data from that provider: Google Business Profile (listing content, posts, reviews metadata), Google Analytics (aggregated traffic and referral metrics), Google Search Console (sitemap and indexing status), your website or CMS via our plugin, and directory and listing platforms. We also store the OAuth access and refresh tokens needed to maintain the connection.

Audit data. If you run a free audit, we collect the website URL you submit, your email address, the content our crawler retrieves from that public website, and the resulting scores and analysis.

Monitoring data. The prompts run against AI engines on your behalf, and the responses returned — including whether your business was mentioned, its position, and competitor names appearing alongside it.

Billing data. Subscription status, plan, and transaction records. We do not collect or store your card details — payment details are collected and held by Paddle, our Merchant of Record.

Usage and technical data. Log data, IP address, browser and device information, pages viewed, feature usage, API and MCP access logs, and error diagnostics.

• To provide the Service: publishing your business record to directories and Google Business Profile, injecting schema into your website, generating and publishing content, submitting URLs for indexing, and running monitoring.
• To generate reports, dashboards, audit results, and alerts for you.
• To operate your account, take payment through Paddle, and provide support.
• To send service and transactional email — monitoring alerts, billing notices, and security notices.
• To secure, debug, maintain, and improve the Service, including aggregated and anonymized analysis that does not identify you or your customers.
• To comply with legal obligations and enforce our terms.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We do not use your business data to train third-party AI models — see section 5.

• Contract — to provide the Service you have subscribed to and to take payment.
• Legitimate interests — to secure and improve the Service, prevent abuse, and communicate about your account, balanced against your rights.
• Consent — for optional marketing email and for non-essential cookies, where used. You may withdraw consent at any time.
• Legal obligation — for tax, accounting, and compliance records.

Where the business data you upload includes personal data about other people (for example, customer details you add to your Knowledge Base), you are the controller for that data and arosis acts as your processor, processing it only on your documented instructions.

We use the following providers to operate the Service. Your account and business data is processed by them for the purposes shown, under contracts requiring appropriate confidentiality and security:

Directory syndication is, by design, publication: the business record you give us is distributed to public directories and is then publicly visible. Do not put anything in your Golden Record that you do not want published.

We may also disclose data where required by law, to enforce our terms, or in connection with a merger or acquisition (with notice to you). Our sub-processor list may change; we will update this page.

arosis accesses Google user data through Google’s OAuth APIs when you, the business owner, connect your own Google Business Profile, Google Analytics, Google Search Console and Google Site Verification.

arosis’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We request only the scopes needed to deliver the features you have enabled: reading your Business Profile listing and review link and updating the fields you approve; reading your Google Analytics traffic (read-only); submitting your sitemap to Search Console; and verifying your website with Google Site Verification.
• Google Analytics (read-only, only if you click Connect GA4): we list the Analytics properties you can access so you can pick one, then read weekly session counts by traffic source and channel for that property, to show how many visits came from AI assistants such as ChatGPT or Perplexity. We do not read data about individual visitors.
• Search Console (when you connect Google): we submit your website’s sitemap so Google finds new pages. Site Verification (only if you click Connect Search Console): we request a verification token for your own website, which our WordPress plugin adds to your site as a meta tag, and then ask Google to verify that site so you don’t have to do it by hand. We do not read other sites in your Google account.
• We use Google user data only to provide and improve those user-facing features.
• We do not send Google user data to AI providers (such as OpenAI or Anthropic), and it is never included in the questions we ask AI assistants.
• We do not transfer Google user data to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition.
• We do not use Google user data for advertising, and we do not use it to develop, improve, or train generalized AI or machine-learning models.
• We do not allow humans to read Google user data except with your explicit consent for specific messages, where necessary for security or to comply with law, or on aggregated and anonymized data used for internal operations.

You can revoke arosis’s access at any time from the arosis dashboard or from your Google Account permissions page. When you click Disconnect Google in Settings (or on the Google Business page), we ask Google to revoke our access and delete the OAuth tokens we stored. If you revoke from your Google Account instead, our access stops immediately and we delete the stored tokens when you disconnect, cancel or delete your account.

What we store, and for how long:

• Encrypted OAuth tokens, and which Business Profile location, Analytics property and Search Console site you connected: kept while you’re connected; deleted when you disconnect, when a cancellation takes effect, or when you delete your account.
• A copy of your Business Profile description and services taken before each change we make, so you can restore them: kept with your account data (see Data retention below).
• Weekly totals of website visits from AI assistants, from Google Analytics: kept with your account data (see Data retention below).

We keep your data for as long as your account is active and you are subscribed.

When your plan ends: your account becomes inactive, scheduled actions stop running, and the WordPress plugin stops publishing your business details. Your data is kept for 90 days after your plan ends, then deleted — so you can reactivate without losing your history within that period. When a cancellation takes effect, we revoke our access to your Google account and delete the stored Google OAuth tokens. We do the same if you delete your arosis account.

Accounts without a plan: if you sign up for the free audit and never start a plan, we delete your account after 12 months with no sign-in and no audit.

Before any deletion we email you 14 days ahead. A deletion removes your account data and your sign-in.

On request: you can ask us to delete your data at any time by emailing success@arosis.ai. We will action verified requests within 30 days.

What we may keep: billing and tax records for the period required by law (typically 6–7 years, held by Paddle as Merchant of Record), plus security logs and aggregated anonymized statistics that cannot identify you.

What deletion does not reach: information already published on your behalf to public destinations — directories, your Google Business Profile, and your own website — is controlled by you or by those platforms. Deleting your arosis account does not remove it. We will tell you what was published where so you can remove it, or remove what we still have access to if you ask before cancelling.

We protect your data with encryption in transit (TLS) and at rest, access controls and per-account ownership checks on every record, scoped API credentials, and infrastructure hosted with reputable providers. No system is completely secure, and we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the relevant regulator where the law requires it. Report a suspected vulnerability to success@arosis.ai.

arosis and its sub-processors operate internationally, and your data may be processed in the United States and other countries outside the UK and EEA. Where data is transferred out of the UK or EEA, we rely on appropriate safeguards — such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, or an adequacy decision. Contact us for details of the safeguards applying to a specific transfer.

If you are in the UK or EEA, you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected.
• Erasure — have your data deleted (“right to be forgotten”).
• Restriction — limit how we process your data.
• Portability — receive your data in a structured, machine-readable format, or have it sent to another provider.
• Object — object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent — where processing is based on consent, without affecting prior processing.

Exercise any of these by emailing success@arosis.ai. We will verify your identity and respond within one month. You will not be charged, and we will not treat you differently for exercising a right.

You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner’s Office (ICO); in the EEA, your local data protection authority.

If you are a California resident, you have the right to:

• Know what personal information we collect, the sources, the purposes, and the categories of third parties we disclose it to — all set out in sections 2–5 above.
• Access a copy of the specific pieces of personal information we hold.
• Delete your personal information, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of the “sale” or “sharing” of personal information, and limit the use of sensitive personal information.
• Non-discrimination — we will not deny service, charge a different price, or provide a different quality of service because you exercised a right.

We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we have not done so in the preceding 12 months. We also do not knowingly collect personal information from anyone under 16.

Submit a request by emailing success@arosis.ai with “CCPA request” in the subject line. We will verify your identity before responding and will respond within 45 days. You may use an authorized agent, with proof of authorization.

We use cookies and similar technologies for:

• Strictly necessary — keeping you signed in (authentication session cookies set by Clerk), security, and load balancing. These cannot be turned off without breaking the Service.
• Analytics — understanding how the site and product are used, so we can improve them. We use PostHog for this.
• Advertising and measurement — Google Analytics 4, the Meta Pixel and the TikTok Pixel, which measure how our advertising performs and may be used by those providers for cross-site advertising.

Analytics and advertising cookies are set only if you accept them in the cookie banner. If you reject, those scripts are never loaded at all. You can change your mind by clearing this site’s data in your browser, which makes the banner ask again. You can also block or delete cookies in your browser settings; blocking necessary cookies will prevent you from signing in.

Server-side ad measurement. When you sign up, start a free trial or make a payment, we may tell Meta and TikTok that the event happened, so we can measure which ads work. We send your email address only in hashed form (SHA-256), plus the event type and, for payments, the amount and currency. We never send your card details.

• If you signed up from the UK, the EU/EEA or Switzerland (or, when we don’t know where you signed up from, if your billing address is there or unknown), we send these events only if you clicked Accept in the cookie banner.
• Everywhere else, we send them unless you clicked Reject.

Clicking Reject stops these events from being sent. We record your choice in a first-party cookie and on your account (with the date and the country you signed up from) so we can honour it.

The Service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact success@arosis.ai and we will delete it.

We may update this policy as the Service and our sub-processors change. We will update the “Last updated” date above and, for material changes, notify you by email or in the dashboard before they take effect.

To exercise a right, or to ask anything about this policy:

• Tran Binh Nguyen, an individual (sole proprietor) trading as “arosis”
• An Nhon Ward, Go Vap, Ho Chi Minh City, Vietnam
• success@arosis.ai

arosis has not currently appointed a data protection officer or a UK/EU representative. For any data-related request, contact success@arosis.ai. This will be revisited as the UK/EU customer base grows.