Privacy Policy

1. Information We Collect

We collect information you provide directly to us when you create an account, including your name, work email address, organization name, and billing information. We also collect information about how you use Arvia, including conversations with our AI agents, tickets you create, assessments you complete, and usage patterns.

We do not collect or store the content of employee conversations you reference beyond your session history. All guidance is generated in real time.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Arvia platform
• Process your subscription and billing through Stripe
• Send you service-related communications including welcome emails, trial reminders, and HR ticket notifications
• Track message usage for billing and audit purposes
• Ensure the security and integrity of your account
• Comply with applicable legal obligations

We do not sell your personal information to third parties. We do not use your conversation data or uploaded documents to train AI models.

3. Legal Basis for Processing (GDPR)

Where GDPR or similar laws apply, we process your personal data on the following legal bases:

• Contract performance — processing necessary to provide the Arvia service you have subscribed to
• Legitimate interests — processing necessary for security, fraud prevention, and platform improvement
• Legal obligation — processing required by applicable law, such as retaining billing records
• Consent — where you have provided explicit consent, such as for non-essential communications

4. Data Storage, Security, and International Transfers

Your data is stored securely using a SOC 2 compliant database provider. All data is encrypted in transit and at rest. Each organization's data is isolated and accessible only to authorized users within that organization.

Arvia is operated from the United States. If you are located outside the United States, your data will be transferred to and processed in the United States. By using Arvia, you consent to this transfer. We ensure appropriate safeguards are in place for international data transfers in compliance with applicable law, including Standard Contractual Clauses where required for EU/UK data transfers.

We implement industry-standard security measures including encryption, access controls, and regular security reviews to protect your information from unauthorized access, disclosure, or destruction.

5. Third-Party Services

Arvia uses trusted third-party service providers to operate the platform, including:

• An AI service provider for generating responses — your data is not used for model training
• A semantic search and document retrieval provider
• A PCI-DSS Level 1 certified payment processor
• SOC 2 compliant providers for database, authentication, and hosting infrastructure
• A transactional email delivery provider

Each provider has its own privacy policy governing the use of your information. We select providers who meet high standards for data security and privacy. A list of specific subprocessors is available to enterprise customers upon request as part of our Data Processing Agreement.

6. Data Retention

We retain your data as follows:

• Account information — retained while your account is active and for 30 days after account deletion, after which it is permanently deleted
• Conversation history — retained for the duration of your subscription and deleted within 30 days of account cancellation
• Employee relations tickets — retained while your account is active and for 30 days after cancellation. Organizations are responsible for exporting and retaining their own employment records in compliance with applicable law. Arvia provides CSV export functionality for this purpose.
• Uploaded documents — retained while your account is active and deleted within 30 days of account cancellation
• Message usage records — retained for audit and billing purposes for the duration of your account and 30 days after cancellation
• Billing records — retained for 7 years as required by applicable tax and financial regulations

The retention periods above describe how long Arvia retains data within the platform. Separately, your organization has its own legal obligations to retain certain employment records under the laws of the countries where you operate — these obligations exist independently of Arvia and are your organization's responsibility. See Section 9 of our Terms of Service for a general overview by country.

7. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

• Right to access — request a copy of the personal information we hold about you
• Right to correction — request correction of inaccurate or incomplete data
• Right to deletion — request deletion of your personal data ("right to be forgotten")
• Right to portability — request your data in a structured, machine-readable format
• Right to object — object to processing of your data for certain purposes
• Right to restrict processing — request that we limit how we use your data
• Right to withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at hello@arviahr.com. We will respond within 30 days. EU and UK users may also lodge a complaint with their local data protection authority.

8. Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and relevant regulatory authorities as required by applicable law. EU and UK users will be notified within 72 hours of us becoming aware of a breach, as required by GDPR. US users will be notified in accordance with applicable state breach notification laws.

9. Cookies

Arvia uses essential cookies to maintain your login session and ensure the platform functions correctly. We do not use advertising or tracking cookies. You can control cookie settings through your browser, but disabling essential cookies may affect your ability to use the platform.

10. Children's Privacy

Arvia is intended for use by business professionals and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us at hello@arviahr.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email and by posting the new policy on this page and updating the "Last updated" date. Your continued use of Arvia after any changes constitutes your acceptance of the updated policy.

12. Contact Us and Data Controller

SKW Strategies LLC, operating as Arvia, is the data controller for personal data processed through the Arvia platform.

For any questions about this Privacy Policy, to exercise your privacy rights, or to report a privacy concern, please contact us at:

SKW Strategies LLC (Arvia)
Seattle, WA
hello@arviahr.com