Privacy Policy

1. Introduction

Aristiun BV ("Aristiun", "we", "us", or "our"), registered in the Netherlands, is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, store, share, and protect information when you visit our website (aristiun.com), use our platform and services (including the Ayurak AI engine, Aribot, the Security Workbench, CSPM, ASPM, and all related tools), or interact with us in any other way.

By using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this policy, please do not use our Services.

2. Data Controller

The data controller responsible for processing your personal data is:

• Aristiun BV
• Registered Address: Amsterdam, The Netherlands
• Data Protection Contact: privacy@aristiun.com

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, Aristiun BV acts as the data controller under the General Data Protection Regulation (GDPR).

3. Information We Collect

3.1 Information You Provide Directly

• Account Registration: Name, email address, company name, job title, phone number, and password when you create an account or request a demo.
• Payment Information: Billing address, payment method details (processed via PCI DSS-compliant payment processors — we do not store full card numbers).
• Communications: Information you provide when contacting support, submitting feedback, participating in surveys, or subscribing to newsletters.
• User Content: Architecture diagrams, threat models, compliance documents, configuration data, and other content you upload to or create within the platform.
• Integration Credentials: OAuth tokens, API keys, and repository access permissions you grant for CI/CD integrations (GitHub, Azure DevOps, Jenkins, Bitbucket).

3.2 Information Collected Automatically

• Usage Data: Pages visited, features used, actions taken within the platform, session duration, click patterns, and search queries.
• Device & Browser Information: IP address, browser type and version, operating system, device type, screen resolution, and language preference.
• Log Data: Server logs including access times, error logs, and referral URLs.
• Cookies & Tracking Technologies: We use cookies, web beacons, pixels, and similar technologies as described in Section 8 below.

3.3 Information from Third Parties

• Single Sign-On Providers: If you sign in via Google, Microsoft, or other SSO providers, we receive your name, email, and profile picture.
• Cloud Infrastructure Metadata: When you connect AWS, Azure, or GCP accounts for CSPM scanning, we collect infrastructure configuration metadata (resource inventories, IAM policies, network configurations). We do not access the content of your data stored in those environments.
• Business Contact Data: We may receive business contact information from partners, events, or publicly available professional directories.

4. How We Use Your Information

We process your personal data for the following purposes:

5. AI & Machine Learning Data Processing

Our platform uses AI and machine learning (including the Ayurak AI engine) to deliver threat modeling, compliance mapping, risk scoring, and remediation recommendations. Important information about AI data processing:

• Tenant Isolation: Your data is processed in isolated environments. Your threat models, architecture diagrams, and compliance data are never used to train models for other customers.
• No Cross-Customer Training: We do not use customer-specific data to train or fine-tune general AI models. AI improvements are based on aggregated, anonymized patterns only.
• Human Review: AI-generated threat findings and compliance mappings may be reviewed by authorized Aristiun security engineers for quality assurance purposes, subject to strict confidentiality agreements.
• Opt-Out: Enterprise customers can opt out of aggregated analytics via their account settings or by contacting privacy@aristiun.com.

6. Data Sharing & Disclosure

We do not sell your personal data. We share information only in the following circumstances:

• Service Providers: Trusted third-party vendors who assist with hosting (Google Cloud Platform), payment processing (Stripe), email delivery, analytics (Google Analytics, Microsoft Clarity), and customer support — all bound by data processing agreements.
• CI/CD Integration Partners: When you enable integrations, limited data flows to/from GitHub, Azure DevOps, Jenkins, or Bitbucket as required for the integration to function.
• Legal Requirements: When required by law, subpoena, court order, or governmental request, or when necessary to protect our rights, safety, or property.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your data may be transferred to the successor entity.
• With Your Consent: For any purpose not described above, we will obtain your explicit consent before sharing your data.

7. International Data Transfers

Aristiun is headquartered in the Netherlands with infrastructure hosted on Google Cloud Platform (europe-west regions by default). When data is transferred outside the EEA, we rely on:

• European Commission adequacy decisions
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all sub-processors

Enterprise customers may request data residency in specific regions. Contact sales@aristiun.com for details.

8. Cookies & Tracking Technologies

8.1 Types of Cookies We Use

• Strictly Necessary Cookies: Required for the platform to function (authentication, session management, CSRF protection). Cannot be disabled.
• Analytics Cookies: Google Analytics (GA4) and Microsoft Clarity help us understand how visitors interact with our website. These collect anonymized usage data.
• Marketing Cookies: Used to deliver relevant advertising and track campaign effectiveness. Only set with your consent.
• Preference Cookies: Remember your settings such as language, theme, and dashboard layout preferences.

8.2 Managing Cookies

You can manage cookie preferences through your browser settings or our cookie consent banner. Note that disabling certain cookies may limit platform functionality.

9. Data Retention

• Account Data: Retained for the duration of your active account plus 90 days after account closure to allow for reactivation.
• Platform Content: Threat models, compliance data, and architecture diagrams are retained for the duration of your subscription. Upon cancellation, data is deleted within 30 days (or exported upon request).
• Billing Records: Retained for 7 years as required by tax and financial regulations.
• Server Logs: Retained for 90 days for security monitoring and debugging.
• Marketing Data: Retained until you unsubscribe or withdraw consent.

10. Data Security

We implement comprehensive technical and organizational measures to protect your data:

• Encryption: TLS 1.3 for data in transit; AES-256 encryption for data at rest.
• Access Controls: Role-based access control (RBAC), multi-factor authentication (MFA), and least-privilege access principles.
• Infrastructure: SOC 2 Type II certified hosting on Google Cloud Platform with network isolation, intrusion detection, and DDoS protection.
• Monitoring: 24/7 security monitoring, automated vulnerability scanning, and regular penetration testing by independent third parties.
• Incident Response: Documented incident response plan with notification procedures compliant with GDPR (72-hour breach notification to supervisory authorities).
• Employee Security: All employees undergo background checks, security training, and sign confidentiality agreements.

11. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data ("right to be forgotten").
• Right to Restrict Processing: Request that we limit how we use your data.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.
• Right to Lodge a Complaint: File a complaint with your local data protection authority (e.g., Autoriteit Persoonsgegevens in the Netherlands).

To exercise any of these rights, please contact privacy@aristiun.com. We will respond within 30 days (or as required by applicable law).

11.1 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know what personal information we collect, use, and disclose.
• Right to delete personal information we hold about you.
• Right to opt out of the sale or sharing of personal information. We do not sell personal information.
• Right to non-discrimination for exercising your privacy rights.

12. Children's Privacy

Our Services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will delete it promptly. If you believe a child has provided us with personal data, please contact privacy@aristiun.com.

13. Third-Party Links

Our website and platform may contain links to third-party websites, services, or integrations (e.g., GitHub, Azure Marketplace, Jenkins Plugin Directory). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by:

• Posting a notice on our website
• Sending an email to registered users
• Displaying an in-platform notification

Continued use of the Services after changes become effective constitutes acceptance of the updated policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@aristiun.com
• General Inquiries: info@aristiun.com
• Postal Address: Aristiun BV, Amsterdam, The Netherlands

For data protection inquiries within the EU, you may also contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.