Privacy Policy

This Privacy Policy explains how Arpixa collects, uses, stores, shares, and protects personal data when you use our websites, applications, and related services. It also explains your choices and privacy rights, and is designed to align with major privacy regulations including the GDPR and CCPA.

Arpixa is an agency management platform for freelancers, studios, and agencies. The platform helps businesses manage clients, leads, projects, messaging, files, meetings, proposals, contracts, invoices, payments, and reporting from one workspace.

1. Who We Are

Arpixa ("Arpixa", "we", "us", "our") provides software services under the Arpixa brand. For privacy requests, contact us at hello@arpixa.io.

2. Scope of This Policy

This policy applies to:

• Visitors to Arpixa websites and landing pages.
• Users who create Arpixa accounts and workspaces.
• Team members and collaborators invited into workspaces.
• Clients and contacts whose information is added to Arpixa by workspace users.
• People who interact with us for support, billing, security, or legal matters.

This policy does not govern third-party services that you connect to Arpixa (for example Google, Stripe, Razorpay, Slack, Zoom, or Notion) beyond the data Arpixa receives from those services.

3. Roles and Responsibility for Data

Depending on context, Arpixa can act as a data controller or data processor:

• Controller: For Arpixa account, subscription, security, and operational data, Arpixa determines why and how processing happens.
• Processor: For client/customer data entered by a workspace (for example project, invoice, contract, meeting, and message records), Arpixa generally processes data on behalf of that workspace under our Data Processing Agreement (DPA).

4. Categories of Data We Collect

We may collect and process the following categories of personal data:

• Identity and profile data: name, username, avatar, role, and workspace membership details.
• Contact data: email address, phone number, business name, billing address, and communication preferences.
• Workspace and business records: client lists, projects, tasks, notes, proposals, contracts, invoices, and shared files.
• Integration and token metadata: integration status, granted scopes, and encrypted token material necessary to securely operate connected features.
• Scheduling and meeting data: booking inputs, event timing, and generated meeting links.
• Payment data: plan details, transaction references (Arpixa never stores full credit card numbers).
• Technical and usage data: IP address, user agent, session events, errors, and feature usage.
• Consent and compliance records: your cookie-consent choices and your acceptance of this Privacy Policy and our Terms of Service — including the policy version, the method of acceptance (checkbox or Google sign-in), a timestamp, IP address, and browser/user-agent — retained as proof of consent.

5. How We Collect Data

We collect data through multiple channels:

• Directly from you: when you sign up, configure your workspace, upload files, or contact support.
• Automatically: through logs, consented browser storage, and telemetry for security and diagnostics.
• From connected services: when you authorize integrations like Google APIs or Payment Gateways.

6. Why We Use Personal Data

We use personal data for legitimate business and service purposes, including to:

• Provide, operate, and maintain Arpixa services natively.
• Process invoices, subscriptions, and payment-related operations securely.
• Send service notices, security alerts, product updates, and support communications.
• Monitor performance, detect abuse, investigate incidents, and enforce policies.
• Comply strictly with overriding legal obligations.

7. Google API and Connected Account Data (Limited Use)

If you connect Google services, Arpixa may access Google account data according to scopes you authorize. This can include calendar, meeting, and drive functions needed for agency workflows.

We strictly comply with the Google API Services User Data Policy, including all Limited Use requirements.

• No Sale of Data: Arpixa emphatically does not sell Google user data to any third-party brokers.
• No Advertising: We do not use Google Workspace API data, connected files, or calendar data to serve or target advertisements.
• No AI Profiling: We do not use Google Workspace API data to train generalized AI or machine learning models.
• Limited Use: Any data extracted via restricted scopes is utilized solely to facilitate the core dashboard features directly requested by you, such as storing approved files or backing up generated PDFs to connected storage.

You can revoke access at any time from your Google account permissions and from Arpixa integration settings.

8. Artificial Intelligence (AI) Features, Providers, and Data Use

Arpixa offers AI-assisted features — including the AI assistant/chat, AI Drafts (for proposals, emails, briefs, and reminders), workflow "autopilot" actions, conversation summarization, and sentiment analysis of messages. When you use an AI feature, the text you submit together with the workspace context needed to fulfil your request is sent to third-party AI model providers, acting as our sub-processors, to generate a response. That context may include personal data about you, your team members, or your clients that you choose to include in a prompt or that forms part of the record you ask the AI to work on.

AI sub-processors we use:

• Google Cloud Vertex AI (Gemini models) — our primary AI model provider.
• Groq, Inc. and Cerebras — used to run open models (such as Llama-family models) for certain features and for additional capacity and failover.

How we handle AI data:

• Processing location: AI requests are processed primarily on infrastructure located in the United States. Cross-border transfers are covered by the safeguards described in Section 11 (International Data Transfers).
• No training of our own models: Arpixa does not use your inputs or AI outputs to train, fine-tune, or build our own AI or machine-learning models.
• Limited to your request: Your inputs are transmitted to the providers above only to generate the output you requested, and are not used by Arpixa for advertising or profiling. Each provider's own handling of data submitted through its API is governed by that provider's terms; we encourage you to review the terms of Google Cloud (Vertex AI), Groq, and Cerebras.
• Human access: We do not routinely read your AI inputs or outputs. Limited access may occur for security, debugging, abuse prevention, or when you submit feedback on an AI response.
• History and deletion: Your AI chat and action history is stored in your workspace so you can review or delete it; deleting a session removes it from your workspace.
• AI output is not professional advice and may be inaccurate or incomplete. You remain responsible for reviewing AI-generated content before relying on it or sending it to a client. AI features are optional.
• Please do not enter special-category data (such as health information) or restricted data (such as full payment-card numbers) into AI features.

9. Cookies, Local Storage, and Consent Matrix

Arpixa utilizes a robust, user-configurable Cookie Consent Manager. We categorize our browser storage into strictly necessary technologies (which cannot be disabled as they govern security) and optional technologies.

No non-essential storage before consent: Optional technologies, including Google Analytics, are never loaded or activated until you provide explicit opt-in consent through our consent banner. Declining or ignoring the banner means only strictly necessary technologies are used.

You can review or change your consent preferences at any time using the "Cookie Settings" link in our website footer, which reopens the consent manager. Withdrawing consent is as easy as granting it. Because preferences are stored in your browser's local storage, you may alternatively clear your browser site data to reset all choices and re-trigger the banner.

When you make a consent choice (either here or via the Privacy Policy and Terms acceptance during sign-up/sign-in), we keep a durable record of that choice — including the policy version, the method, a timestamp, and limited technical metadata — so that we can demonstrate, as required under the GDPR and India's DPDP Act, that consent was obtained.

10. How We Share Personal Data

We share data only when operationally strictly necessary to run the service:

• Infrastructure providers: Firebase/Google Cloud for encrypted data storage and identity routing.
• Payment processors: Stripe and Razorpay, which are PCI-DSS-compliant payment processors; Arpixa never stores full card numbers.
• AI model providers: Google Cloud Vertex AI (Gemini), Groq, and Cerebras process the inputs you submit to AI features in order to generate responses, as described in Section 8.
• Legal and compliance: Regulators or law enforcement only when compelled by a valid subpoena or overriding legal mandate.

Arpixa does not sell personal information to data brokers.

A current list of our sub-processors — including our hosting, AI, payment, email, and meeting providers — is maintained in Annex III of our Data Processing Agreement. Where Arpixa acts as a processor, we give advance notice of material changes to that list and an opportunity to object, as described in the DPA.

11. International Data Transfers

Arpixa and its providers may process data cross-border (e.g., US, EU, India). We rely on legally recognized transfer mechanisms, including Standard Contractual Clauses (SCCs), to safeguard your data.

12. Data Retention and Deletion

We retain personal data only as long as needed for operational, security, and legal requirements.

• If you request account deletion, we process primary deletion as soon as reasonably possible.
• Backup and log data may persist for an encrypted recovery window (up to 90 days) before automatic catastrophic deletion.
• Financial and tax records: Invoices, payment records, and related transaction data are retained for the period required by applicable tax and accounting law — for example, financial records under Indian tax law (including GST and TDS records) must be kept for several years — even after you delete your account or exercise your right to erasure. We delete such records once the statutory retention period ends.

13. Security Measures & Breach Notification

We maintain administrative, technical, and organizational safeguards (including data encryption at-rest and in-transit) to protect personal data.

Breach Notification: If a personal data breach occurs, we respond as follows. Where Arpixa acts as a controller and the breach is likely to result in a risk to individuals, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware (as required under the GDPR); where the breach is likely to result in a high risk to individuals, we also notify the affected individuals without undue delay. Under India's DPDP Act, 2023, we notify the Data Protection Board of India and the affected Data Principals in the manner and within the timelines prescribed. Where Arpixa acts as a processor, we notify the affected workspace (our customer) without undue delay so it can meet its own notification obligations. Each notice describes the nature of the breach and the remediation steps taken.

14. Your Privacy Rights

Depending on your jurisdiction, you unequivocally have the right to:

• Access: Obtain a structured copy of your personal data.
• Rectification: Correct inaccurate information.
• Erasure (Right to be Forgotten): Request deletion of your personal data. This right is subject to data we must keep to meet legal obligations — in particular invoices and other financial records we are required to retain under tax and accounting law (see Section 12) — which we hold for the required period and then delete.
• Restriction: Object to or restrict specific processing activities.
• Portability: Demand data in a machine-readable format.

To exercise rights, email hello@arpixa.io from your registered account. We will respond within 30 days.

15. Region-Specific Notices (GDPR & CCPA)

European Economic Area (GDPR): If you reside in the EEA or UK, Arpixa processes your data according to lawful bases established under the General Data Protection Regulation. You have the right to lodge a complaint with your local supervisory authority.

EU/UK Representative (Article 27). Where Arpixa is required under Article 27 of the GDPR or UK GDPR to designate a representative in the EU and/or the UK, our designated representative(s) and their contact details are:

• EU representative: [To be appointed — name, EU postal address, and email]
• UK representative: [To be appointed — name, UK postal address, and email]

Until a representative is formally designated, EEA and UK individuals may contact us directly at hello@arpixa.io about their personal data, and may also lodge a complaint with their local supervisory authority.

California (CCPA/CPRA): Under the California Consumer Privacy Act, California residents have the right to know, access, and delete their data, and protect themselves against discrimination for exercising these rights. We confirm: Arpixa has not "sold" or "shared" personal information for cross-context behavioral advertising within the last 12 months.

India (DPDP Act, 2023 & IT Rules): If you are in India, Arpixa processes your personal data in accordance with the Digital Personal Data Protection Act, 2023. You may give, manage, and withdraw consent, request access and correction, nominate another individual to exercise your rights, and lodge a grievance with our Grievance Officer (see Section 20) before approaching the Data Protection Board of India. Individuals under 18 are treated as children whose data is processed only with verifiable parental/guardian consent.

16. Children's Privacy and Minimum Age

Arpixa is a business-to-business platform intended exclusively for professional use by individuals who are at least 18 years of age and who have the legal capacity to enter into a binding contract. We do not knowingly direct the Service to, or knowingly collect personal data from, anyone under 18.

We set the minimum age at 18 (rather than 13) because using Arpixa involves forming a binding contract and processing payments. Under the Indian Contract Act, 1872, an agreement with a minor is void, and under India's DPDP Act, 2023, any individual under 18 is a "child" whose personal data may be processed only with the verifiable consent of a parent or lawful guardian. The 13-year threshold associated with laws such as the U.S. Children's Online Privacy Protection Act (COPPA) applies to consumer/child-directed services and is not appropriate for a contract-based B2B product like Arpixa. If we learn that we have collected personal data from a person under 18 without the required parental consent, we will delete it promptly.

17. Third-Party Links and Services

Our platform integrates with third-party tools. Their privacy practices are governed by their own policies.

18. Changes to This Privacy Policy

We may refine this Policy to reflect operational evolutions. Material changes will be highlighted to active users via service notifications prior to taking effect.

19. Contact Us

For privacy compliance, access requests, or regulatory concerns, contact our DPO team at hello@arpixa.io.

20. Grievance Officer (India)

In accordance with the Information Technology Act, 2000, the rules made thereunder, and India's Digital Personal Data Protection Act, 2023, the contact details of our Grievance Officer are provided below. The Grievance Officer addresses questions, complaints, and requests regarding the processing of your personal data and your rights.

• Grievance Officer: Alokkumar Rajnish Barai (Founder, Arpixa)
• Address: Kalyan, Thane District, Maharashtra – 421306, India
• Email: hello@arpixa.io

We aim to acknowledge grievances within 24 hours and resolve them within the timelines prescribed by applicable law (and in any case within 30 days). If you are not satisfied with the resolution, you may escalate to the relevant supervisory authority — for example, the Data Protection Board of India.