Privacy Policy

ARIM Technologies S.R.L. (“ARIM”, “we”, “our”, or “us”), registered in Romania, is the data controller responsible for personal data processed in connection with the ARIM Call Center service (“Service”) available at arimcallcenter.com and app.arimcallcenter.com.

Contact: contact@arimtech.com — bd. Iuliu Maniu, nr. 17, bl. C1, sc. A, et. 4, ap. 20, Deva, Hunedoara, România.

Account data

• Name and email address provided when you register, plus time zone or locale preferences that you provide or that we infer for workspace configuration.
• Hashed one-time passwords (OTPs) used for email-based authentication — these are deleted after verification.
• Session tokens, stored server-side and used to maintain your authenticated session.

Workspace configuration

• AI agent settings: name, greeting message, system prompt, selected language, voice, and scheduling instructions.
• Configuration for the phone number allocated with the Service in Romania, the United States, or Canada, and allowed notification or redirect destinations.
• Knowledge base documents (PDFs) uploaded by you, stored in our secure Telnyx Cloud Storage in the European Union (Frankfurt region).
• OAuth tokens for connected Google and Microsoft accounts (access tokens, refresh tokens, granted scopes, account email). These tokens are encrypted at rest using AES-256-GCM.

Calendar integration data

When you connect Google Calendar or Microsoft Outlook, the agent can read calendar availability and manage events (create, modify, delete) on your behalf. We access:

• Calendar list (names and IDs) — to show you which calendars are available for selection.
• Event data in selected calendars — to check free/busy status and create bookings.
• We do not read event titles, descriptions, or attendee lists unless necessary to create or update a booking.

Spreadsheet integration data

When you connect Google Sheets or Microsoft Excel, the agent can read, add, and update rows with call data. We access:

• Spreadsheet / workbook list (names and IDs) — to show you which files are available for selection.
• Selected spreadsheets / workbooks — to read and manage rows containing call metadata (date, caller number, duration, agent name).
• We do not read existing sheet contents beyond what is necessary to manage rows.

Call data

• Call metadata: agent involved, caller and callee numbers, start time, duration, and language.
• Call recordings (audio) of conversations handled by your agents, securely stored in Telnyx Cloud Storage (Frankfurt, EU region).
• Full transcripts of those recordings, used for review, search, and analytics in the control panel.
• Actions the agent performed during the call, such as calendar look-ups, appointment bookings, email notifications, spreadsheet updates, and call redirects where enabled.
• Dashboard agent-test data includes real-time microphone audio streamed via WebRTC to Telnyx, temporary session identifiers, language, and diagnostic events. These browser sessions do not create persistent call recordings or transcripts. A dashboard test can use your saved agent, knowledge base, and connected integrations; actions executed may create or modify real business records.

Billing data

• Subscription identifiers, plan status, and renewal date received from our payment provider (Polar). We do not store payment card details on our servers; payments are processed directly by Polar.
• Usage and cost records: number of agents, monthly call volume, call duration, Telnyx telecom cost components (AI voice, inference, call control, SIP trunking, recording), the applicable service multiplier (1.5x), and the resulting metered amount reported to Polar.
• Referral source or affiliate code provided during signup, and Affonso referral identifiers when marketing cookies are accepted.

Technical data

• Server-side request logs (IP address, user agent, response status) retained for security and abuse prevention.
• Diagnostic logs from the voice processing system and dashboard agent testing — these do not contain stored call audio unless explicitly shown as a recording in your dashboard.

AI and voice processing

Agent prompts, call context, transcripts, relevant knowledge-base excerpts, and tool results are transmitted to Telnyx AI Voice Assistant infrastructure to generate agent responses in real time and execute configured actions. Speech recognition (Speech-to-Text), AI model inference, and high-fidelity speech synthesis (Text-to-Speech via Telnyx Ultra) are processed on secure carrier infrastructure provided by Telnyx. Audio snippets are processed in real time to sustain the conversation and are retained as recordings strictly according to the retention periods described in this policy.

• To create and manage your workspace and authenticate users.
• To run your AI phone agent: routing calls, answering questions from your knowledge base, booking appointments, and producing recordings and transcripts.
• To read availability and manage events in connected Google or Microsoft calendars when a caller requests an appointment.
• To read and manage rows containing call metadata in connected Google Sheets or Microsoft Excel files for your record-keeping.
• To send email notifications (via Resend) and perform live call redirects to destinations you configure, where those features are supported for your number setup.
• To operate dashboard agent testing and create temporary WebRTC voice sessions through Telnyx.
• To enforce subscription limits and bill Pay as you Go (platform fee plus 1.5x actual Telnyx call costs) or the applicable Enterprise plan correctly.
• To attribute partner referrals and administer our affiliate program.
• To send transactional emails such as OTP codes and subscription notifications.
• To display call activity, recordings, transcripts, and usage metrics in your dashboard.
• To detect, investigate, and prevent fraudulent or abusive use of the Service.
• To comply with legal obligations applicable to ARIM.

By default, we do not use your data for AI training. Call recordings, transcripts, and knowledge base documents are not used by ARIM to train or improve foundation AI models unless you explicitly opt in. Enterprise-grade API services used through Telnyx AI and associated infrastructure providers do not use customer call data, API requests, or uploaded documents to train public models, in compliance with strict commercial privacy terms and zero-data-training commitments.

If you enable AI training consent in your account settings:

• We may use anonymised call data — stripped of personal identifiers such as names, phone numbers, and precise timestamps — to improve ARIM-operated speech recognition, text-to-speech, routing, and conversation-quality systems.
• Anonymisation is performed before any data is used for training purposes.
• You can withdraw your consent at any time from your account settings. We will cease using your data for training within 30 days of withdrawal.
• Withdrawing consent does not affect the lawfulness of processing that occurred before the withdrawal.

We process your personal data on the following legal bases under the General Data Protection Regulation (EU) 2016/679 (“GDPR”):

• Performance of a contract (Art. 6(1)(b)): processing necessary to provide the Service you have registered for, including agent operation, call handling, and account management.
• Legitimate interests (Art. 6(1)(f)): maintaining service security, preventing abuse, and aggregated internal analytics to improve the Service.
• Legal obligation (Art. 6(1)(c)): retaining certain records where required by Romanian or EU law.
• Consent (Art. 6(1)(a)): where we explicitly ask for your consent (for example, AI training consent, marketing/tracking cookies, or when you connect a Google or Microsoft integration via OAuth).

When your agents handle calls with third parties (for example, your customers), the personal data of those third parties (voice audio, transcripts, names, phone numbers, and any information they share during the call) is processed by ARIM as a data processor on your behalf. You are the controller for that data and are responsible for the lawful basis and for informing call participants that the call may be recorded and that they are speaking with an AI agent. To assist you in complying with these legal transparency requirements, the Service automatically prepends a prior notice in the configured call language to the agent's greeting message (“This call is answered by an AI agent and is recorded. By continuing this call, you agree.”), unless your custom greeting already includes an equivalent legal disclosure.

By using the Service you instruct ARIM to process this data solely to provide the Service, in accordance with these terms and our Terms of Use.

A Data Processing Agreement (DPA) is available upon request at contact@arimtech.com.

• Account data (name, email, time zone): retained for the lifetime of your account. Deleted within 30 days after account deletion.
• Session tokens: deleted upon logout or expiry.
• OTP codes: deleted immediately after successful verification or upon expiry (typically 10 minutes).
• Agent configuration and knowledge base documents: retained for as long as the workspace is active. Deleted from Telnyx Cloud Storage and from our systems within 30 days after workspace deletion.
• ARIM-provided phone numbers: released when the subscription ceases to be active; associated allocation records are deleted within 30 days of release.
• OAuth tokens for Google/Microsoft calendars: retained while the integration is connected. Revoked and deleted when you disconnect the integration or delete your workspace.
• Call recordings and transcripts: retained for up to 90 days by default in Telnyx Cloud Storage and our secure database, then permanently deleted unless a longer retention is contractually agreed.
• Dashboard agent-test session data: processed transiently to provide the test and retained only in diagnostic logs needed for security, abuse prevention, and troubleshooting.
• Call metadata (logs): retained for up to 12 months for billing verification and dispute resolution, then permanently deleted.
• Server access logs: retained for up to 90 days for security purposes.
• Referral source and affiliate attribution records: retained while your account or subscription exists, and for the period needed for commission reconciliation and dispute resolution.
• Billing identifiers from Polar: retained for the duration required by applicable accounting and tax law (typically 5–10 years in Romania).
• Advertising delivery queue: event payloads are removed after successful delivery or after up to six days of failed delivery. Minimal deduplication records are retained for up to 90 days. Advertising providers apply their own retention policies to data already received.

We share data with the following categories of third-party processors where necessary to deliver the Service:

Polar (Polar Software Inc.)

Our payment, subscription, and usage-billing provider. When you subscribe to a paid plan or choose usage-based billing, Polar processes your payment card data and billing information as an independent data controller. Polar is subject to its own Privacy Policy. We receive subscription status identifiers and a customer ID from Polar, and we may send metered usage events such as billable call seconds for invoicing.

Telnyx Voice & AI Infrastructure

To generate agent responses and conduct telephone conversations, the Service utilizes Telnyx AI Voice Assistant and Telnyx Ultra infrastructure. Speech recognition (Speech-to-Text), artificial intelligence model inference, and high-fidelity speech synthesis across 40+ languages (Telnyx Ultra Text-to-Speech) are securely processed across the Telnyx carrier network. Knowledge base documents are stored in Telnyx Cloud Storage (Frankfurt, EU region) and semantically indexed using Telnyx AI Embeddings. Telnyx operates as a carrier-grade sub-processor under commercial agreements and a Data Processing Agreement (DPA), ensuring the security and confidentiality of processed data.

Google & Microsoft (calendar and spreadsheet integrations)

When you connect a Google or Microsoft account, we exchange OAuth tokens with that provider and perform operations strictly within the scopes you granted. Tokens are stored encrypted at rest using AES-256-GCM and are revoked when you disconnect the integration or delete your workspace.

Google Calendar scopes: https://www.googleapis.com/auth/calendar.readonly (list calendars), https://www.googleapis.com/auth/calendar.events (manage events), openid, email, profile.

Google Sheets scopes: https://www.googleapis.com/auth/drive.file (access spreadsheets you select via Google Drive Picker), openid, email, profile.

Microsoft Outlook scopes: Calendars.ReadWrite, offline_access, openid, email, profile.

Microsoft Excel scopes: Files.ReadWrite, Sites.Read.All, offline_access, openid, email, profile.

We do not use Google or Microsoft user data for advertising, sale, or training AI models. We access only the minimum data necessary to provide the calendar and spreadsheet features you activate.

Telnyx Carrier Telephony

The voice connection between callers and the agent is provided directly through Telnyx's private carrier network. If you forward an existing phone number from another carrier, your current provider processes that stage under its own contractual terms.

Telnyx carrier infrastructure. ARIM uses Telnyx (Telnyx LLC) to procure and configure supported numbers, SIP signaling, Call Control, IP private network voice routing, call recording, and secure file storage (Telnyx Cloud Storage). We do not request your Telnyx API key or connect numbers from customer-owned Telnyx accounts.

Number provided with the Service. If ARIM allocates a supported national number in Romania, the United States, or Canada to your account, the number is provisioned through ARIM’s Telnyx account and remains under ARIM’s contractual relationship with Telnyx; ARIM acts as the data controller for the configuration data associated with that number.

Email Delivery Provider (Resend)

We use Resend (Resend, Inc.) for the secure delivery of transactional emails: authentication OTP codes, account notices, and call alert emails delivered to the email addresses configured in your workspace. Email addresses and message content are transmitted strictly for delivery purposes under a Data Processing Agreement (DPA).

Meta Platforms Technologies, LLC (Meta Conversions API)

When you consent to marketing cookies, we use Meta Pixel and Meta Conversions API to measure page visits, dashboard agent-test starts, signup requests, completed registrations, checkout and confirmed payments. Email addresses and internal user IDs are SHA-256 hashed when supplied. We may also send IP address, user agent, page URL, event details, and available click/browser identifiers; these technical fields are not all hashed and may constitute personal data. Hashing is not anonymisation. Meta processes the data under its own Privacy Policy.

Google Ads conversion tracking

When you consent to marketing cookies, we use the Google tag for Google Ads conversion measurement and remarketing. We may send conversion events such as demo starts, signup, checkout, subscription, and purchase events, together with page URL, technical identifiers, Google click identifiers such as gclid, gbraid, wbraid, first-party _gcl_* cookies where available, and customer-provided data such as email for enhanced conversions where appropriate. Google processes the data it receives under its own Privacy Policy.

TikTok Ads Pixel and Events API

When you consent to marketing cookies, we use the TikTok Pixel and TikTok Events API to measure visits, dashboard agent-test starts, signup, checkout, and subscription/payment events. We may send event metadata, page URL, TikTok click and browser identifiers such as ttclid and _ttp, IP address, user agent, and SHA-256 hashed email or internal user ID where available. TikTok processes the data it receives under its own Privacy Policy.

LinkedIn Conversions API

With marketing consent, our servers may send LinkedIn events for demo starts, signup requests, completed registrations, checkout starts and confirmed payments. Matching uses a SHA-256 hashed email address and/or a LinkedIn click identifier when available. We do not install the LinkedIn Insight Tag. A first-party cookie named arim_li_fat_id retains a LinkedIn click identifier for up to 30 days across our website and application. Checkout attribution and the consent recorded at checkout may be passed to Polar to report confirmed payments. Non-purchase events do not represent revenue. We do not send call recordings, transcripts, agent prompts or integration content to LinkedIn. You can withdraw marketing consent in Cookie settings. LinkedIn processes received data under its Privacy Policy: https://www.linkedin.com/legal/privacy-policy.

Affonso (ZASolution)

Our affiliate and referral tracking provider. Affonso is loaded in consent mode. Before marketing consent, it must not set the full referral cookie and may use URL-based continuity parameters for privacy-preserving attribution. When you consent to marketing cookies, Affonso may set a first-party referral cookie and process referral identifiers, click metadata, signup or checkout attribution, and subscription attribution data to calculate partner commissions and prevent affiliate fraud. Affonso acts as our processor for this tracking data and is subject to its own Privacy Policy.

Cloud Infrastructure & Hosting

The Service is hosted on enterprise cloud infrastructure: Amazon Web Services (AWS) in the Frankfurt region (eu-central-1), Supabase (PostgreSQL database and edge functions hosted in the EU), and Telnyx Cloud Storage (Frankfurt region, eu-central-1) for audio recordings and knowledge base documents. All primary account, call, and document data is stored on servers located within the European Economic Area (EEA).

We do not sell or rent your personal data. With the marketing consent described above, we share limited advertising measurement data with Meta, Google, TikTok and LinkedIn. We do not send call recordings, transcripts, knowledge-base documents or connected calendar/spreadsheet content through our advertising conversion integrations.

ARIM's use and transfer of information received from Google APIs for Google Calendar and Google Sheets adheres to the Google API Services User Data Policy, including strict Limited Use requirements. Specifically:

• We use Google user data strictly to provide and maintain the Google Calendar and Google Sheets features that you explicitly request and activate.
• We do not sell Google user data to third parties.
• We do not use Google user data for advertising purposes or for training any artificial intelligence or machine learning models.
• We do not transfer Google user data to third parties except to the extent technically necessary to provide the Service (storing OAuth tokens encrypted at rest using AES-256-GCM in our secure database).
• Human team members do not access user Google calendar or spreadsheet data unless strictly necessary for technical support, upon your request and with your explicit consent.

Where personal data is transferred outside the EEA (for example, to Polar, Telnyx, or other infrastructure providers), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or we rely on adequacy decisions such as the EU-U.S. Data Privacy Framework where applicable.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These include:

• All data in transit is encrypted using TLS.
• Database access is restricted to authorised systems and workspaces are logically isolated.
• Knowledge base files and call recordings are stored in object storage with access restricted to the workspace that owns them.
• OAuth tokens are stored encrypted and revoked on disconnect.

No method of transmission or storage is 100% secure. If you become aware of a security vulnerability affecting the Service, please disclose it responsibly at contact@arimtech.com.

As a data subject under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): request deletion of your personal data (“right to be forgotten”), subject to legal retention obligations.
• Right to restriction of processing (Art. 18): request that we restrict processing of your data in certain circumstances.
• Right to data portability (Art. 20): receive your personal data in a structured, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

If you are a call participant (not a registered user), the controller for your data is the workspace that operated the agent you spoke with — please direct rights requests to that workspace owner. We will assist them with fulfilling your request.

To exercise any of these rights as a registered user, including requesting account deletion, contact us at contact@arimtech.com from the address associated with your account. We will respond within 30 days.

You have the right to lodge a complaint with the Romanian data protection supervisory authority:

ANSPDCP — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal
www.dataprotection.ro

The Service uses cookies and local storage for core functionality, analytics and advertising measurement. Use the Cookie settings link in the website footer or the cookie preferences in your account settings to review or withdraw optional permissions.

Essential cookies

• Session cookie: strictly necessary to maintain your authenticated session. Deleted when you log out or your session expires.
• Cookie consent preference: stores your choices about non-essential cookies. Retained for one year so we do not ask you on every visit.
• UI preferences: limited use of localStorage to remember sidebar state and similar interface settings.

Analytics cookies

• Google Analytics 4: used to understand how visitors interact with the Service, which pages they visit, and how they navigate the site.
• These cookies are placed only when you consent to analytics cookies.
• Google Analytics 4 does not store full IP addresses by default.
• We use Google Consent Mode v2 to communicate your choices to Google services and to enable cookieless measurement when consent is not granted.

Marketing cookies and server-side measurement

• Meta Conversions API: used to measure the effectiveness of advertising campaigns. When you consent to marketing cookies, we send event data (such as dashboard agent tests, signup, and subscription events) directly from our server to Meta.
• Email addresses and internal user IDs supplied to Meta are SHA-256 hashed. IP addresses, user agents, page URLs and click/browser identifiers may also be transmitted without hashing. Hashed identifiers can still be personal data.
• We may also send a first-party click identifier (fbc) and browser identifier (fbp) if they are available, to help Meta attribute conversions to ad interactions. These identifiers are stored in first-party cookies named _fbc and _fbp only when you consent to marketing cookies.
• This tracking may be performed through the Meta Pixel in your browser and through the Meta Conversions API on our server, for more reliable measurement and browser/server deduplication.
• Google Ads conversion tracking: when you consent to marketing cookies, we may send conversion events such as signup, checkout, subscription, purchase, and dashboard agent-test start to Google Ads. Where available, we may use Google click identifiers such as gclid, gbraid, wbraid, and first-party _gcl_* cookies to attribute conversions.
• Affonso affiliate tracking: Affonso runs in consent mode. When you consent to marketing cookies, Affonso may set affonso_referral and affonso_data cookies for up to 30 days to attribute signups, subscriptions, and any referral incentives to partners. If you do not consent, these cookies are removed; you may still voluntarily provide a referral source during signup.
• TikTok Ads tracking: when you consent to marketing cookies, we may use the TikTok Pixel and TikTok Events API to measure visits, dashboard agent-test starts, signup, checkout, and subscription/payment events. Where available, we may use TikTok click and browser identifiers such as ttclid and _ttp, plus hashed email or internal user ID, to attribute conversions. TikTok processes the data it receives under its own Privacy Policy.
• LinkedIn Conversions API: with marketing consent, we report eligible demo, signup, checkout and confirmed-payment events from our servers, without a LinkedIn Insight Tag. The arim_li_fat_id cookie retains an available LinkedIn ad click ID for up to 30 days across arimcallcenter.com and app.arimcallcenter.com. Matching may also use SHA-256 hashed email. Anonymous events without a supported identifier are not sent.

Managing and withdrawing consent

• You can accept, reject, or manage individual cookie categories through the cookie banner displayed on your first visit.
• You can reopen your cookie preferences at any time by clicking the Cookie settings link in the footer of any page.
• Registered users can also manage cookie preferences from the Privacy section of their account settings.
• Changing consent updates this browser's preferences and the consent signals used for subsequent browser activity. Google Consent Mode may continue limited cookieless measurement when permission is denied. Server-side payment events use the consent recorded at checkout, as explained above; contact us for account-wide privacy requests.
• You can also manage or delete cookies through your browser settings.

The Service is not HIPAA compliant and is not designed to process Protected Health Information (PHI) as defined by HIPAA. We do not currently offer a Business Associate Agreement (BAA). Covered entities and business associates must not upload, transmit, or store PHI using the Service.

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We collect publicly available professional contact details (such as the clinic or business name, email address, phone number, and role) from public websites, Google Maps, and public directories, in order to contact businesses directly with offers about our B2B services.

The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in promoting our services to professionals and businesses for whom they are relevant. We have carried out and documented a legitimate interest assessment (LIA). Data is kept only until you object, or for a limited period without a response from you, after which it is deleted.

Every such communication includes our identity, the source from which we obtained your data, and a simple, free way to unsubscribe. You may object at any time to processing for direct marketing purposes (Art. 21 GDPR) at contact@arimtech.com or via the unsubscribe link in the email; objections are honored immediately, and your address is added to our suppression list so you are not contacted again.

We do not sell or share this data with third parties for marketing purposes.

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will update the “Last updated” date and, for material changes, notify you by email at least fourteen (14) days before the changes take effect. We encourage you to review this page regularly.

For any privacy-related questions, requests, or concerns:

ARIM Technologies S.R.L.
bd. Iuliu Maniu, nr. 17, bl. C1, sc. A, et. 4, ap. 20
Deva, Hunedoara, România
contact@arimtech.com