Privacy Policy

1. Who we are

Aroli is operated by TC Ecom LLC, a limited liability company registered in Wyoming, USA. Contact details are at the end of this policy. Privacy questions and requests can be sent to [email protected].

2. Controller or processor?

We play two different roles, depending on whose data it is:

• Our customers and website visitors. For data about the businesses that use Aroli, their team members, and visitors to this website, we decide how and why it is processed. We are the controller for this data and this policy applies.
• Our customers' end users. When a customer's software uses Aroli to register or sign in its users, issue licenses or bind devices, we process that data on the customer's behalf and according to their instructions. The customer is the controller and we are their processor (or “service provider”). Our Data Processing Agreement governs that processing. If you are an end user of software that uses Aroli, please contact the software's publisher first; we will assist them with your request.

3. Data we process

Account and organization data (we are controller)

• Name, email address and password hash (Argon2id) of dashboard users.
• Organization name, team memberships and roles, invitations.
• Two-factor authentication secrets (encrypted) and hashed recovery codes, if you enable MFA.
• Billing records such as plan, subscription status and Stripe customer identifiers. We do not receive or store full card numbers.
• Support conversations and messages you send through our contact form.
• Security and audit information: IP addresses, timestamps and the actions taken in your organization.

End-user data processed on behalf of customers (we are processor)

• Usernames and, if the customer collects them, email addresses.
• Password hashes (Argon2id) - never plaintext passwords.
• Hashed device identifiers and optional platform labels.
• IP addresses in request logs and audit logs.
• License, activation and entitlement records, session metadata and any variables or files the customer stores.

Website visitors

When you visit this website, our servers process technical data such as your IP address, browser user agent and the pages you request, in order to deliver the site and protect it from abuse. We do not use analytics or advertising trackers.

4. Purposes and legal bases

• Providing the Service - creating and securing accounts, running the dashboard and APIs, billing. Legal basis where GDPR-style laws apply: performance of a contract.
• Security and abuse prevention - rate limiting, audit logs, fraud and abuse investigation. Legal basis: legitimate interests in keeping the Service and its users safe.
• Communicating with you - transactional emails such as verification, password resets, billing notices and answers to your messages. Legal basis: contract and legitimate interests.
• Legal obligations - accounting, tax and responding to lawful requests. Legal basis: legal obligation.

We do not sell personal data and do not use it for advertising.

5. Cookies

We use a single strictly necessary cookie to keep you signed in to the dashboard. Details are in our Cookie Policy.

6. Service providers

We rely on the following categories of providers to run Aroli:

• Hosting and database provider - runs our application servers and databases. Provider and region to be confirmed.
• Stripe - payment processing and subscription management for Aroli plans.
• Resend - delivery of transactional email.
• S3-compatible object storage provider - storage of files customers upload. Provider to be confirmed.

7. International transfers

TC Ecom LLC is based in the United States, and our providers may process data in the United States or other countries. Where data protection law requires it, we use appropriate safeguards for transfers, such as standard contractual clauses.

8. Retention

• Account and organization data: for as long as your account exists, then deleted or anonymized after closure.
• End-user data: as instructed by the customer, and deleted when the customer deletes it or their account ends.
• Audit and security logs: for a limited period to investigate incidents and abuse.
• Billing records: for as long as required by tax and accounting law.
• Contact form messages: for as long as needed to handle your request and any follow-up.

9. Security

We protect data with measures including Argon2id password hashing, storing tokens and API keys only as hashes, AES-256-GCM encryption at rest for signing keys, webhook secrets and MFA secrets, role-based access control, tenant isolation checks and audit logging. See our Security page. No system is perfectly secure, but we work to protect your data and will notify affected customers of personal data breaches as required by law.

10. Your rights

Depending on where you live, you may have rights to access, correct, delete or export your personal data, to object to or restrict certain processing, to withdraw consent, and to complain to a data protection authority. To exercise a right, email [email protected]. We may need to verify your identity. We will not discriminate against you for exercising your rights.

If you are an end user of a customer's software, the customer controls your data. Please contact them; if you contact us, we will forward your request or help the customer respond.

11. Children

Aroli is a business service and is not directed at children. Customers are responsible for the age requirements of their own applications.

12. Changes

We will update this policy when our practices change and post the new version here. For material changes, we will notify customers by email or in the dashboard.

13. Contact