Legal
Privacy Policy
Last updated: October 17, 2026
1. Who we are and what this policy covers
Arzana, Inc. (“Arzana,” “we,” or “us”) builds AI agents that take repetitive office work off manufacturers’ plates, such as quoting, order entry, scheduling, and invoicing. This policy explains how we handle personal information when you visit arzana.com, contact us, apply for a job, or use the Arzana services.
When a business customer uses Arzana, the information it sends through our services (“Customer Data”) is governed by that customer’s agreement with us, and we process it only on the customer’s behalf. Section 4 explains how we handle it.
2. Information we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Contact and business details | Name, work email, phone number, company, and job title | You, when you fill in a form, email us, or meet us at an event |
| Business contact data | Name, title, company, and work email of people at manufacturers we may work with | Public professional profiles and business data providers |
| Communications | Emails, messages, and call recordings and notes | You and our team; we ask permission before recording any call |
| Account data | Name, email, role, sign-in and multi-factor authentication records, and activity logs | Platform users and their company’s administrators |
| Usage and device data | Pages visited, browser, device type, and IP address | Collected automatically through cookies and server logs |
| Visitor identification | The company a visitor works for and, for some visitors, their name, title, and work email | A visitor identification service on our website, which matches IP addresses and cookies to business data providers |
| Job applicant data | Resume, work history, references, and interview notes | Applicants, recruiters, and references |
| Customer Data | Orders, quotes, invoices, drawings, and supplier and pricing records, which can include names and contact details of a customer’s staff, customers, and suppliers | Our customers and the systems they connect to Arzana |
3. How we use information
- To provide, run, secure, and support the Arzana services
- To answer your questions and requests, and to schedule demos and site visits
- To send business communications and marketing to business contacts, with an unsubscribe link in every marketing email
- To evaluate job applicants
- To run and improve our website, using usage and device data
- To learn which companies, and in some cases which people, visit our website, so our team can follow up
- To detect and prevent fraud, abuse, and security incidents
- To meet legal obligations and enforce our agreements
We do not sell personal information.
4. Customer Data and AI
We use Customer Data only to provide the services to the customer it belongs to, following that customer’s instructions and agreement.
- Customer Data is stored and processed in a dedicated environment for each customer on Amazon Web Services (AWS) in the United States.
- Customer Data never trains, tunes, or informs any model or output used for another customer, and it is never pooled with other customers’ data.
- AI models run through AWS. Customer Data is not sent to AI model providers and is never used to train a third-party or public model.
- We collect operational metadata about how the services run (for example, request volumes, error rates, and feature usage) to operate, secure, and improve them. This metadata does not include the content of Customer Data.
- If you have a question about your personal information inside Customer Data, contact the company that uses Arzana. We help our customers answer those requests.
5. How we share information
- Service providers. Companies that host, run, or support our business (cloud hosting, email and productivity, messaging, payments, payroll, website analytics and visitor identification, and compliance monitoring), bound by contract to use the information only on our behalf.
- Customer Data. The only parties that handle Customer Data are AWS as our hosting provider and the email, ERP, or other business systems a customer tells us to connect.
- Legal requirements. When the law requires it, or to protect the rights, property, or safety of Arzana, our customers, or others.
- Business transfers. If Arzana is part of a merger, acquisition, or sale of assets, information may transfer with the business, and it remains subject to this policy and to each customer’s agreement.
- With your permission. In any other case, only when you ask us to or agree to it.
6. Cookies, security, and where data is stored
Our website uses cookies it needs to work, analytics cookies that show us how visitors use it, and visitor identification cookies that tell us which companies, and in some cases which people, visit. You can block or delete cookies in your browser settings, and the site still works without analytics or visitor identification cookies.
We protect information with encryption at rest (AES-256 through AWS Key Management Service) and in transit (TLS 1.2 or higher), a dedicated database for each customer, multi-factor authentication, and access limited to staff who need it. Only U.S. persons working in the United States can reach Customer Data or production systems. Our controls are monitored continuously in Vanta, and our SOC 2 examination is underway; arzana.com/security shows the current status.
We store and process information in the United States.
7. How long we keep information
| Information | How long we keep it |
|---|---|
| Contact, outreach, and communications data | Until you ask us to delete it, or until it is no longer needed for the business relationship |
| Account data | For the life of the customer’s agreement, then deleted with that customer’s data |
| Activity and audit logs | At least 12 months |
| Customer Data | For the term of the customer’s agreement. After it ends, the customer has 90 days to request a full export, and may then request permanent deletion of all its data, including backups and its custom model, which we confirm in writing within 30 business days |
| Job applicant data | As long as needed to complete hiring and meet legal recordkeeping requirements |
8. Your choices and rights
You can ask us what personal information we hold about you, and ask us to correct it, delete it, or stop using it for marketing. Depending on where you live, state privacy laws may give you more rights, and we honor them as those laws require. Email privacy@arzana.com to make a request; we may need to confirm your identity first, and we respond within 30 days. Every marketing email carries an unsubscribe link, and we never treat anyone differently for using these rights.
9. Children, changes, and contact
Our website and services are built for businesses, are not directed to anyone under 16, and we do not knowingly collect their information.
When we update this policy, we post the new version here with a new date. If a change affects how we handle Customer Data, we tell customers by email before it takes effect.
Questions about this policy or your information go to privacy@arzana.com, or by mail to Arzana, Inc., 12 E 49th St, 21st Floor, Suite 2112, New York, NY 10017.