Privacy Policy
What personal data AROS handles, why, and the rights you have over it.
1. Who is responsible
SnxwFairies operates AROS. For personal data a customer puts into the service, the customer is the Data Fiduciary and SnxwFairies acts as a Data Processor on its instructions.
2. What is collected
Account details of named users (name, email, role and, where a user links them, a WhatsApp number or a Google account identifier); sign-in security records (the network address and email involved in recent failed sign-in or code requests, kept only as long as the short lockout window needs and swept daily); operational records created by using the service; and business information a customer records about its own prospects and counterparties. Messages sent through the public contact form are stored as the form states, without the sender's network address.
3. Why it is processed
To operate the service, authenticate users, run the workflows a customer asks for, keep an audit trail of decisions, and meet legal obligations. Data is not used for advertising and is not sold.
4. Consent and lawful basis
Personal data is processed on the basis of the customer's instructions and, where the DPDP Act requires it, the data principal's consent. Consent may be withdrawn. For communications, a recorded stop instruction suppresses further messages to that recipient and is re-checked at the moment of sending.
5. Your rights as a data principal
You may ask what personal data is held about you, ask for it to be corrected, and ask for it to be erased. AROS implements both access and erasure: an erasure removes personal data and pseudonymises the governance audit trail so that it no longer identifies you, while remaining intact as a record. Requests are handled through the grievance contact below.
6. Sharing and transfers
Personal data is shared only with sub-processors necessary to run the service (hosting, AI processing, connected platforms a customer authorises), and only for that purpose. Restricted and authorised-source information is never released into a shared pool between customers.
7. Security
Passwords are stored only as salted hashes, and integration credentials and authentication secrets are encrypted at rest; AROS never stores a one-time code in readable form. Access is per user with immediate revocation, every significant action is recorded in an append-only audit trail, and secrets are redacted before anything is written to it.
8. Retention
Data is retained while an account is active. After termination it is deleted on request, except records the law requires us to keep, such as tax records and the audit trail, which are kept for the period the law sets. No automated deletion on termination is built yet, so deletion is carried out on request. After an erasure request, audit records are retained for governance in pseudonymised form.
9. Grievance redressal
Complaints about the handling of personal data, and complaints about content on the service, may be addressed to the Grievance Officer named below. As our own service commitment, and not as a period the Rules set, we acknowledge every grievance within 24 hours of receiving it and aim to resolve it within 15 days. Where the law requires us to act faster, we do: on actual knowledge that content is unlawful, which arises only from an order of a court of competent jurisdiction or a written, reasoned intimation from an authorised government officer (a Joint Secretary or above; a Deputy Inspector General of Police or above, for the police), we act on that content within 36 hours, as rule 3(1)(d) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 requires, and our safe harbour under section 79(1) of the Information Technology Act, 2000 depends on our doing so. If you are not satisfied with the Grievance Officer's decision, you may appeal to the Grievance Appellate Committee within 30 days; for a personal-data grievance you may also complain to the Data Protection Board of India.
10. Cookies and analytics
AROS sets essential cookies only. The aros_session cookie keeps you signed in, and while a signed-in user connects an integration a short-lived (10-minute) aros_oauth_state cookie protects that exchange; nothing else is required for the service to function. Where enabled, we use Cloudflare Web Analytics, a cookieless measurement service that sets no cookies. No other analytics runs.