You already have the sensors. What's missing is the cockpit.

Aranis takes privacy seriously. This policy clearly explains what data we collect, why we collect it, and how you can exercise your rights. If you have any questions, contact us: privacy@aranis.ai

1. Who we are

Aranis is a risk centralization and intelligence platform operated by Aranis Tecnologia em Desenvolvimento de Software Não Customizável Ltda., a Brazilian company headquartered in Piracicaba, SP, registered under CNPJ No. 68.129.114/0001-70. For the purposes of this Policy, Aranis Tecnologia acts as the controller of the personal data collected through the Aranis platform, in compliance with the Brazilian General Data Protection Law (LGPD — Law No. 13.709/2018).

2. Data we collect

2.1 Registration and account data

Full name and email address
Company name and job title
Authentication data (processed via Supabase Auth — we never store passwords in plain text)
Payment data (processed exclusively by Stripe — Aranis does not store card data)

2.2 Platform usage data

Access, navigation, and feature-usage records
Logs of operations performed (creating assessments, sending invitations, generating reports)
Account configuration data and preferences

2.3 Assessed-vendor data

When you use Aranis to assess vendors, the data provided by respondents is collected and processed under your responsibility as the contracting party. Aranis acts as the processor of this data. This includes questionnaire responses, evidence and documents submitted, and respondents' contact data.

2.4 Exposed-surface scan data

The platform passively collects public information about the domains of assessed vendors (DNS, TLS, DMARC, reputation). This data is used exclusively for risk-assessment purposes and is not shared with third parties.

2.5 Data from site visitors (outside the platform)

This section covers people who visit aranis.ai without being platform users. There are four independent flows:

Contact form: name, e-mail, company, the message you write, the page language, your browser, and a hash of your IP address — never the address in clear. Purpose: to answer you and to record where the message came from. Legal basis: preliminary procedures at the data subject's request (art. 7, V, LGPD). Retention: for as long as the commercial contact is active; deletion on request at privacy@aranis.ai.
Report series subscription: name, e-mail, company and language. Purpose: to send each new edition of the report. Legal basis: consent (art. 7, I), which you may withdraw at any time through the unsubscribe link carried by every message on the list. Retention: until you unsubscribe.
Aranis for Startups application: your name, e-mail and job title; the startup's name, CNPJ and website; and the information you provide about the company in the application. Purpose: to review the application, to reply, and — if approved — to create the account. The company details are checked against the Receita Federal's public records, and the sender's e-mail domain is compared with the startup's website domain. Legal basis: preliminary procedures at the data subject's request (art. 7, V). Retention: if approved, the data becomes account data (section 2.1); if not approved, it is kept for 6 months to record the outcome of the review and then deleted, or earlier on request at privacy@aranis.ai.
Cookie consent record: when you answer the banner we store your choice, the date and time, your IP address, the approximate location derived from it, your browser and the page you were on. Purpose: to evidence consent, as the LGPD itself requires. Legal basis: compliance with a legal obligation (art. 7, II). Retention: for the period needed to evidence the consent.

3. Purpose of processing

Contract performance: provision of the contracted services, including assessments, reports, and platform features
Compliance with legal obligations: invoicing, tax and regulatory compliance
Legitimate interest: platform improvement, fraud prevention, and environment security
Consent: sending marketing communications and news (revocable at any time)

4. Data sharing

Aranis does not sell personal data. We share data only with subprocessors necessary to provide the services:

Supabase Inc.: database and authentication infrastructure
Stripe Inc.: payment processing
Resend Inc.: transactional email delivery
Amazon Web Services, Inc.: natural-language processing through Amazon Bedrock — the primary AI path (region us-east-1)
Anthropic PBC: natural-language processing when called directly
OpenAI, L.L.C.: natural-language processing for low-latency tasks
Vercel Inc.: application hosting (region gru1, São Paulo)
Cloudflare Inc.: CDN, network security, and attack protection
Google LLC: Google Analytics through Google Tag Manager, only when you allow the analytics category
Competent authorities: when required by law or court order

5. International data transfers

Your data is stored in the United States: the database and file storage run in Supabase's us-west-2 region, and AI processing in Amazon Bedrock's us-east-1 region. The application executes from São Paulo (Vercel, region gru1). These transfers are carried out based on equivalent mechanisms provided for in the LGPD (art. 33), ensuring an adequate level of protection.

6. Data retention

Aranis applies no automatic deletion after a set period. Your data remains for as long as the account exists and, after termination, for the period required to comply with legal and contractual obligations.

Export and deletion are handled on request, through a process carried out by our team. Write to privacy@aranis.ai asking to export or delete your data, specific assessments, or submitted evidence. We respond within 15 days, per article 19 of the LGPD, stating what was deleted and what must be retained under a legal obligation, with the applicable period.

7. Data security

Encryption in transit (TLS 1.2 or higher) and at rest
Role-based access control (RBAC) with Row Level Security
Multi-factor authentication available for all accounts
Automatic backups with configurable retention
Continuous monitoring of access and anomalies

8. Your rights (LGPD)

As a data subject, you have the right to confirm the existence of processing; access, correct, anonymize, block, or delete data; request portability; revoke consent; and petition the ANPD. To exercise these rights, contact privacy@aranis.ai. We will respond within 15 business days.

9. Cookies and tracking

The platform uses essential cookies to function (session, authentication, preferences). The aranis.ai site also loads Google Analytics through Google Tag Manager (Google LLC), and only after you allow the analytics category in the banner — decline it and it is never loaded. We use no advertising cookies. The cookie-by-cookie detail is in our Cookie Policy.

10. Data Protection Officer (DPO)

The officer responsible for personal data processing can be contacted at privacy@aranis.ai.

11. Changes to this policy

In the event of material changes, we will notify users by email at least 30 days in advance. The current version will always be available at aranis.ai/privacy.

12. Contact

Email: privacy@aranis.ai
Controller: Aranis Tecnologia em Desenvolvimento de Software Não Customizável Ltda. (CNPJ 68.129.114/0001-70)
Address: Piracicaba, SP, Brazil

Privacy Policy