Privacy Policy
Arvisflows LLC is a US company that serves businesses in Europe and the Americas. This policy explains what data we process, why we are allowed to do so, who else sees it and how you can control it.
Translation. This English version is provided for convenience. The Spanish version is the only binding text and prevails in the event of any discrepancy. Leer la versión en español.
On this page
- Who the controller is
- Who this applies to
- Two different roles
- Purposes and legal basis
- Where the data comes from
- How long it is kept
- Who else has access
- YouTube API Services
- International transfers
- Artificial intelligence and automated decisions
- Security
- Your rights
- Notice for California residents
- Minors
- Changes to this policy
1. Who the controller is
| Entity | Arvisflows LLC, a Limited Liability Company of the State of New Mexico (United States) |
|---|---|
| Registration identifier | Entity ID 0008126909, New Mexico Secretary of State |
| Address | 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, United States |
| Privacy contact | info@arvisflows.com |
| Supervisory authority | The data protection authority in your country of residence or work |
| Data protection officer | Not appointed. None of the cases in Article 37 of the Regulation that require one applies. |
| Representative in the European Union | Appointment pending. |
2. Who this applies to
This policy is addressed to four groups of people:
- Website visitors. Anyone browsing the public Arvisflows site at arvisflows.com without logging in.
- People who write to us. Anyone who fills in the contact form or requests a free trial.
- Customer businesses and the people in charge of them. Anyone who subscribes to a plan and uses the Manager Panel.
- End customers of those businesses. People who write to the business on WhatsApp or through the web chat, or call it by phone, and are served by the artificial intelligence agent. Their situation is explained in the next section.
3. Two different roles
Arvisflows holds two different positions depending on whose data it is, and it is worth distinguishing them because your rights and whom you should contact depend on it.
| Data | Arvisflows' role | Whom to contact |
|---|---|---|
| That of website visitors, people requesting information and the people in charge of customer businesses | Controller. Arvisflows decides what it is used for and how | Arvisflows directly, with this policy as the reference |
| That of the end customers who contact a business: name, phone number, appointments, content of messages and calls | Processor. Arvisflows only processes it following the business's instructions | The business you contacted, which is the controller. The terms are in the Data Processing Addendum |
| End customers' operational data: delivery address, orders and their line items, and transport journeys with pick-up point, destination, date, time and passengers | Processor. Arvisflows processes it only to manage the transaction following the business's instructions | The seller or transport-offering business, which is the controller. The terms are in the Data Processing Addendum |
4. Purposes and legal basis
We only process personal data when there is a basis that makes it lawful. This table lists each purpose with its legal basis under Article 6 of the General Data Protection Regulation.
| What for | What data | Legal basis |
|---|---|---|
| Handling requests for information and for a free trial | Name, email address, phone number, name and sector of the business, and whatever you write in the message | Taking steps prior to entering into a contract at the request of the data subject (Art. 6.1.b) |
| Setting up the account, creating access to the panel and providing the service purchased | Identification and contact details of the business and of the person in charge, login credentials, agent configuration | Performance of the contract (Art. 6.1.b) |
| Collecting the subscription, issuing invoices and managing non-payment | Billing details, customer identifier at the payment gateway, payment history. Arvisflows does not store the card number | Performance of the contract (Art. 6.1.b) and compliance with legal accounting and tax obligations (Art. 6.1.c) |
| Sending operational notices: end of the trial period, payment problems, pending configuration, service incidents | Email address and phone number of the person in charge of the business | Performance of the contract (Art. 6.1.b) |
| Sending news and marketing communications about our own services | Email address and name | Consent (Art. 6.1.a) for non-customers. Legitimate interest in promoting services similar to those already purchased (Art. 6.1.f) for customers, who may object at any time |
| Keeping the service secure, preventing fraud and abuse, and keeping technical logs | IP address, timestamps, access and error logs | Legitimate interest in protecting the service and its users (Art. 6.1.f) |
| Handling rights requests and responding to competent authorities | Whatever is needed to identify the requester and prove the response | Compliance with legal obligations (Art. 6.1.c) |
Providing the data marked as mandatory in the forms is necessary to handle the request or provide the service. If it is not provided, we will not be able to do so.
5. Where the data comes from
Most of the data comes from the data subject, when filling in a form, subscribing to the service or writing to us. For the people in charge of customer businesses, some data is generated while using the service, such as panel access logs or usage history. We do not buy databases or obtain data from third-party sources for commercial purposes.
6. How long it is kept
| Type of data | Period |
|---|---|
| Requests for information that do not end in a subscription | 12 months from the last contact |
| Account data and service configuration | For as long as the contractual relationship lasts |
| Account data after cancellation | 30 days, to allow the service to be restored in the event of a mistake or of a non-payment that is settled. It is then deleted or anonymised |
| Invoices and payment records | 6 years from issue, because of the accounting and tax obligations that apply to the company |
| Technical and security logs | 12 months |
| Consent to marketing communications | Until it is withdrawn, and then the record of the withdrawal for as long as needed to prove that it was respected |
| Conversations between the businesses' customers and the assistant (WhatsApp, phone and web chat) | 6 months from each message. Here Arvisflows acts as processor; the controller is the business |
Once those periods have passed, the data is blocked for as long as legal liabilities may arise and, once the limitation periods have expired, it is deleted.
7. Who else has access
Arvisflows does not sell or disclose personal data to third parties for commercial purposes. To provide the service it uses the providers listed below, which act as processors on behalf of Arvisflows and are bound by contract and by a duty of confidentiality.
| Provider | What for | Where the processing takes place |
|---|---|---|
| Contabo GmbH | Server hosting the service's application and database | European Union, data centre in Lauterbourg (France) |
| Stripe | Payment processing, subscriptions and invoicing | Ireland and United States |
| Twilio | Phone numbers and handling of phone calls | United States, with nodes in the European Union |
| Anthropic | Backing up the agents when the main provider is not available, and reading material provided to configure the service | United States |
| OpenAI | Main provider of the agents' replies, transcription and voice | United States |
| Resend | Sending transactional email | United States, with sending infrastructure in Ireland |
| Zoho | Email service for the info@ and support@ mailboxes | European Union |
| WhatsApp Ireland Ltd. and Meta Platforms | WhatsApp messaging service and connection of the business's Meta account for social media advertisements and posts | Ireland and United States |
| Font server from which the website loads its typefaces. It receives the visitor's IP address | United States |
In addition, data may be disclosed to judges, courts, public administrations and law enforcement authorities where there is a legal obligation, and to professional advisers bound by secrecy where necessary to defend a right.
7 bis. YouTube API Services
Arvisflows uses YouTube API Services solely to publish videos on its own channel (@Arvisflows). It does not access, store or share data from YouTube accounts belonging to customers, businesses or visitors. The only information stored is the authorization for its own channel, on its restricted-access server, and the identifier of each published video.
Use of YouTube API Services is governed by the YouTube Terms of Service and the Google Privacy Policy. Access can be revoked at any time from the Google permissions page.
If access is revoked or Arvisflows stops using the service, the authorization is deleted within a maximum of 30 days.
8. International transfers
The service's application and database are hosted in the European Union. However, Arvisflows is a US company and several of the providers above process data in the United States, so there are international transfers.
Those transfers rely on one of the following mechanisms, depending on the provider:
- Standard contractual clauses approved by the European Commission, supplemented by any additional measures found necessary after the transfer impact assessment.
- The adequacy decision for the EU-US Data Privacy Framework, where the provider is certified under it.
- The transfer being necessary for the performance of the contract requested by the data subject, where applicable.
You can ask for information about the safeguards applied to a specific transfer by writing to info@arvisflows.com.
9. Artificial intelligence and automated decisions
The Arvisflows service is based on language models that generate replies automatically. You should know exactly what that means:
- The content of messages and the transcription of calls are sent to the model provider involved in each case —Anthropic or OpenAI— to generate the reply.
- Arvisflows does not use that content to train its own models and does not authorise its providers to use it to train theirs.
- The agent can book, change or cancel appointments automatically. These are routine management operations that do not produce legal effects or significantly affect people within the meaning of Article 22 of the Regulation.
- Replies generated by a language model may contain errors. It is always possible to ask for a person from the business to step in.
10. Security
Arvisflows applies technical and organisational measures proportionate to the risk, including: encryption of communications using TLS, storage of passwords using salted derivation functions, access control through individual credentials and time-limited session tokens, separation of each customer business's data, regular backups and access logging.
No system is invulnerable. If a security breach occurs that poses a risk to your rights, Arvisflows will notify the competent supervisory authority and, where the risk is high, also the people affected, within the deadlines set by law.
11. Your rights
You can exercise the following rights at any time:
- Access. To know whether we process your data and obtain a copy.
- Rectification. To correct inaccurate data or complete it.
- Erasure. To ask for it to be deleted when it is no longer needed or when you withdraw your consent.
- Restriction. To ask for it to be kept but not used while a dispute is resolved.
- Objection. To object to processing based on legitimate interest, and in any case to direct marketing.
- Portability. To receive your data in a structured, commonly used format, or to have it sent to another provider.
- Withdraw consent at any time, without affecting the lawfulness of prior processing.
To exercise them, write to info@arvisflows.com stating the right you wish to exercise. We may ask you to prove your identity if there is reasonable doubt. We will reply within one month, which may be extended by two further months if the request is complex, in which case we will let you know. If you have connected a Meta account, also see the instructions for deleting Meta data.
If you consider that we have not handled your request properly, you can lodge a complaint with the data protection authority in your country of residence or work.
12. Notice for California residents
If you live in California, the California Consumer Privacy Act and its amendments give you additional rights: to know the categories of personal information collected and their purpose, to request its deletion, to correct it, to limit the use of sensitive information and not to be discriminated against for exercising these rights.
Arvisflows does not sell or share personal information within the meaning that law gives to the terms sell and share. We do not disclose data to third parties in exchange for consideration or for cross-context behavioural advertising. For that reason there is no opt-out mechanism to activate, and a Do Not Sell or Share My Personal Information request is handled by confirming in writing that no such sale or sharing takes place.
To exercise any of these rights, write to info@arvisflows.com stating that you are acting under California law.
13. Minors
The service is aimed at businesses and professionals. It is not intended for minors and we do not knowingly collect data from children under 16 through the website. If we find that we have received data from a minor without the authorisation of the person holding parental responsibility or guardianship, we will delete it. If you believe this has happened, please let us know.
The content of the conversations a customer business has with its own end customers may include data of minors. In that case, obtaining the necessary authorisation is the responsibility of the business, as controller.
14. Changes to this policy
We may update this policy to reflect changes in the service or in the law. The version in force is always the one published on this page, with its date of update. If the change substantially affects how we process your data, we will notify customers by email at least thirty days in advance.