Aaraik Privacy Policy

1. Scope & Who We Are

This policy applies to personal information collected through https://www.aaraik.com/ and any related online services, mobile applications, APIs, and offline interactions where this policy is referenced (collectively, the "Services").

Controller: Aaraik (the legal entity operating the Services). If you need to contact our privacy team: contact@aaraik.com

2. What Personal Information We Collect

We collect only what we need to provide and improve Services. Categories include:

3. Sources of Data

• Directly from you (forms, account creation, communications).
• Automatically through technologies (cookies, logs).
• From third parties you authorize (social logins, payment processors).
• From partners and analytics providers (aggregate/anonymized where possible).

4. Why We Collect Data — Purposes & Legal Bases

We collect personal data for specific, legitimate purposes and only to the extent necessary. Example purposes and legal bases (where applicable):

• To provide and operate the Services — performance of a contract.
• To manage accounts and payments — performance of a contract; compliance with legal obligations.
• To communicate with you (support, updates, marketing if you opt in) — consent for marketing; legitimate interests for transactional messages.
• To improve and personalize the Services — legitimate interests (product improvement) balanced against your rights.
• Security, fraud prevention, and legal compliance — legitimate interests and legal obligations.
• Analytics and research — consent or legitimate interests (with opt-outs and anonymization options).

When relying on legitimate interests, we perform and document balancing tests and give you clear opt-out options where required.

5. Cookies & Tracking Technologies

We use cookies and similar technologies. Categories:

• Strictly necessary — required for the site to function.
• Performance & analytics — helps us understand usage (you can opt out).
• Functional — remember preferences.
• Advertising & personalization — only with your consent; we do not "sell" personal data without clear disclosure and controls.

You can manage cookie preferences via our cookie control banner, your browser settings, or by visiting your account privacy settings.

6. Third Parties, Processors & International Transfers

We use carefully vetted third-party providers for hosting, payments, analytics, email, and security. Examples: cloud hosting, payment processors, and identity providers. When we share personal data with processors, we require contractual safeguards (data processing agreements, confidentiality, security measures).

If personal data is transferred internationally, we use appropriate safeguards (EU Standard Contractual Clauses, Binding Corporate Rules, or other lawful transfer mechanisms) and will inform you of the transfer status where required.

7. Data Retention

We retain personal data only as long as necessary for the purpose collected, or to comply with law, resolve disputes, enforce agreements, and for record-keeping. Typical retention ranges (examples):

• Account data: until you delete your account + 90 days for recovery + anonymized historic records for analytics.
• Transaction records / financial data: 7 years (or longer if required by law).
• Support communications: retained while needed to resolve the issue, then archived 2–5 years.
• Logs & analytics: aggregated/anonymized as soon as feasible; raw logs retained short term (e.g., 30–90 days) unless needed for security investigations.

8. Your Rights & Controls

We provide robust controls. Depending on your jurisdiction, you may have rights including:

• Access your personal data.
• Correction of inaccurate or incomplete data.
• Deletion (right to be forgotten) where legal exceptions do not apply.
• Data portability — receive your data in a common machine-readable format.
• Restriction & objection to processing, including profiling and direct marketing.
• Withdraw consent at any time (without affecting processing done while consent was active).
• Opt out of sale/sharing (e.g., California: "Do Not Sell or Share My Personal Information" link).

How to exercise rights: Contact contact@aaraik.com or use the privacy controls in your account. We verify requests to protect your privacy and will respond in accordance with applicable law (typically within 30 days; if we need more time we will notify you).

9. Security & Data Protection Practices

We apply best-in-class technical and organizational measures, including:

• Encryption in transit (TLS) and strong encryption at rest where feasible.
• Role-based access controls, least privilege, multi-factor authentication for staff.
• Regular security testing, vulnerability scanning, and third-party audits.
• Data minimization, pseudonymization and anonymization where possible.
• Incident response program with breach notification processes (we will notify affected users and regulators as required by law).

We maintain an internal privacy program that includes training, DPIAs (Data Protection Impact Assessments) for high-risk processing, recordkeeping, and appointed privacy leads.

10. Automated Decisions & Profiling

We may use automated processing to improve personalization, recommendations, and fraud detection. Where such processing has legal or similarly significant effects, you will have the right to obtain human review, express your point of view, and contest the decision, subject to applicable law. We explain the logic and effects on request.

11. Children's Privacy

Our Services are not intended for children under 16 (or the age applicable in your jurisdiction). We do not knowingly collect personal data from children without parental consent. If we learn we have collected data from a child without appropriate consent, we will delete it promptly.

12. Responding to Law Enforcement & Legal Requests

We may disclose personal data to comply with lawful requests, legal processes, or to protect the rights, property, or safety of Aaraik, our users, or the public. We push back on overly broad requests and will notify you when permitted unless prohibited by law.

13. Transfers in Mergers, Acquisitions & Corporate Events

If Aaraik is involved in a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction. We will notify you and provide choices where required.

14. Transparency, Audits & Accountability

We commit to independent audits and transparency reports summarizing law enforcement requests and data practices (to the extent permitted). We maintain logs of processing activities and publish summaries of our privacy program, certifications, and third-party audits where available.

15. How We Notify You of Changes

We will post updates to this policy on https://www.aaraik.com/privacy and highlight material changes via email or site notice prior to change, except where immediate changes are required for security or legal reasons. Each version will show an effective date.

16. How to Contact Us & Lodging Complaints