Privacy Policy — Arvia

1. Who we are

Arvia ("we", "us", "our") is an AI agent platform operated from New Zealand. This policy explains how we collect, use, store, and disclose personal information when you use our website (arvia.nz) and platform (workspace.arvia.nz).

We are committed to complying with the New Zealand Privacy Act 2020.

2. Information we collect

Account information: name, email address, company name, and country provided at signup.
Usage data: messages sent to AI agents, session history, agent configurations, and uploaded documents you choose to share with your workspace.
Billing information: subscription plan and payment status. Card details are collected and stored solely by Stripe — we never see your card number.
Technical data: IP address, browser type, and access logs for security and debugging purposes.

3. How we use your information

To provide and operate the Arvia platform.
To process payments and manage your subscription via Stripe.
To authenticate your identity via AWS Cognito.
To power AI responses — your messages are sent to OpenAI's API for processing. OpenAI's Privacy Policy applies to that processing.
To send transactional emails (account setup, billing receipts). We do not send marketing emails without your explicit consent.
To improve the platform and diagnose technical issues.

4. Third-party services

We use the following third-party services which may process your personal information:

OpenAI — AI model inference (messages you send to agents).
AWS (Amazon Web Services) — authentication (Cognito), infrastructure, and file storage. Servers are located in the ap-southeast-2 (Sydney) region.
Stripe — payment processing and subscription management.

We do not sell your personal information to any third party.

5. Data retention

We retain your account and workspace data for as long as your account is active. If you delete your account, we will anonymise or delete your personal information within 30 days, except where we are required by law to retain it (e.g. billing records for tax purposes — retained for 7 years in accordance with NZ tax law).

6. Your rights (Privacy Act 2020)

Under the NZ Privacy Act 2020, you have the right to:

Access the personal information we hold about you.
Correct any inaccurate information.
Delete your account and associated personal data.

To exercise any of these rights, contact us at privacy@arvia.nz. We will respond within 20 working days as required by law.

You can also delete your account directly from within the Arvia workspace settings, which will immediately begin the anonymisation process.

7. Security

We use industry-standard security measures including TLS encryption in transit, encrypted storage, and access controls. However, no system is completely secure. If you believe your account has been compromised, contact us immediately at security@arvia.nz.

In the event of a privacy breach that is likely to cause serious harm, we will notify the NZ Privacy Commissioner and affected individuals as required by the Privacy Act 2020.

8. Cookies

Our marketing website uses only essential cookies required for navigation. Our platform uses session cookies for authentication. We do not use tracking or advertising cookies.

9. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or via a notice in the platform. Continued use of Arvia after changes constitutes acceptance of the updated policy.

10. Contact us

For any privacy-related questions or requests:
privacy@arvia.nz