Privacy Policy

Arrio (Arran AB)
Effective date: 1 August 2026. Last reviewed: 1 August 2026.

What this policy covers

This policy covers the arrio.ai website only: what happens when you visit it, send us an enquiry through it, or write to us about a job.

It does not cover the Arrio platform. When an enterprise customer uses Arrio to analyse their own software development, that customer decides what is processed and why, so they are the data controller and Arrio acts only on their documented instructions as their processor. Everything about how the platform handles data, which sub-processors are involved, where processing happens and what the Data Processing Agreement says lives in our documentation at docs.arrio.ai, which is kept continuously up to date. If your question is about the product rather than this website, that is where the answer is.

1. Who we are

For everything described in this policy, the data controller is:

• Arran AB, trading as Arrio
• Organisation number: 559562-6812
• Registered in Sweden, based in Motala
• Privacy contact: david@arrio.ai

We have not appointed a Data Protection Officer, which we are not required to do. The CEO is accountable for this policy and we keep that decision under review.

Your supervisory authority is Integritetsskyddsmyndigheten (IMY) in Sweden, imy.se.

2. What we collect, why, and on what basis

Technical data. Your IP address, browser and device type, the pages you visit and when, recorded in server logs. We use this to operate the site, keep it available and protect it from abuse. Lawful basis: our legitimate interest in running and securing our own website.

Enquiry data. Your name, email address, company and whatever you choose to write, when you use a form on this site or email us. We use it to answer you and to take the conversation forward if you want one. Lawful basis: steps taken at your request before entering into a contract, and our legitimate interest in responding to people who contact us. Giving us this information is entirely voluntary, but we cannot reply to an enquiry without it.

Job applications. If you write to us about working at Arrio, we handle what you send: your name, contact details, career history and anything else you include. Lawful basis: steps taken at your request before entering into a contract, and our legitimate interest in recruiting.

We do not use your personal data to make any automated decision about you, and we do not profile you. We do not sell personal data.

3. Cookies and analytics

Analytics run only if you accept them. Nothing analytical is loaded until you do, and the site works fully if you decline.

If you accept, we use Google Analytics 4 and Microsoft Clarity to understand how the site is used: pages visited, clicks, scrolling and approximate location at city level. Text you type into forms is masked in Clarity session recordings. Lawful basis: your consent, which you can withdraw at any time using “Analytics choices” in the footer.

Spam protection on our forms (Cloudflare Turnstile) is strictly necessary for the form to work at all and does not track you across other websites.

4. Who we share it with

Only the service providers that run this website, and only so far as they need it:

• Cloudflare, for hosting and delivering the site, processing the enquiry form and spam protection.
• Resend, for delivering enquiry emails to us.
• Google (Analytics) and Microsoft (Clarity), for website analytics, and only with your consent.

We may also share personal data with our professional advisers, or with an authority where the law requires it.

Sub-processors used by the Arrio platform are a separate matter and are listed in our documentation and annexed to the Data Processing Agreement. They are not involved in this website.

5. Transfers outside the EEA

Some of the providers above are established outside the European Economic Area. Where personal data is transferred outside the EEA, that transfer is covered by the European Commission’s Standard Contractual Clauses and, where the provider is certified under it, the EU-US Data Privacy Framework.

6. How long we keep it

• Enquiries: while we deal with your request and for up to 24 months afterwards, then deleted, unless a business relationship continues.
• Job applications: up to 12 months, then deleted, unless you ask us to keep them on file for longer.
• Server logs: about 90 days. Security and audit logs: up to 12 months.
• Analytics data: up to 14 months.
• Accounting records, where an enquiry becomes a business relationship: seven years, as the Swedish Bookkeeping Act requires.

7. Your rights

Under the GDPR you have the right to ask for a copy of your personal data, to have it corrected or erased, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on your consent, you can withdraw it at any time, which does not affect anything done before you withdrew it.

To exercise any of these, email david@arrio.ai. We respond within one month.

If you are not satisfied, you have the right to complain to Integritetsskyddsmyndigheten (IMY), the Swedish supervisory authority, at imy.se.

8. How we protect it

Data is encrypted in transit and at rest, credentials are held in an encrypted vault and access is granted on a least-privilege basis. We maintain a personal data breach procedure and notify the supervisory authority, and you where required, within 72 hours of becoming aware of a notifiable breach.

9. Children

This website and our services are intended for businesses. They are not directed at children and we do not knowingly collect personal data from them.

10. Changes

We may update this policy. The version published on arrio.ai is the current one, and the effective date above tells you when it took effect.

11. Contact

Questions about this policy or about your personal data: david@arrio.ai.

Questions about this policy: david@arrio.ai