Privacy Policy

1. Introduction

Arvanic LLC, a Texas limited liability company ("Arvanic," "we," "us," or "our"), operates the Arvanic platform (the "Platform"). This Privacy Policy describes how we collect, use, store, share, and protect personal information when you use our Platform. It applies to Case Managers (registered users who create and manage investigations) and Participants (individuals invited to complete interviews through the Platform).

This Privacy Policy explains our data practices for both groups. Customer and Case Manager use is also subject to our Terms of Service.

2. Information We Collect

2.1 Information Provided by Case Managers

When you create an account and use the Platform as a Case Manager, we collect: your name and email address (through our authentication provider); organization name and professional role; purchase and payment information (processed by our third-party payment processor — we do not store full credit card numbers); investigation details, including investigation type, allegation summaries, and contextual descriptions; participant names, email addresses, and assigned roles; a timestamp and your user identifier when you confirm a participant is at least 18; and any exhibits or files you upload to the Platform.

2.2 Information Provided by Participants

When you access the Platform as a Participant through an invitation link, we collect: your name and email address (as provided by the Case Manager who invited you); an age-eligibility signal consisting of a timestamp recording that you confirmed you are 18 or older or, if applicable, that you indicated you are under 18; your interview responses, including answers to structured questions and follow-up questions; your browser timezone (for timestamp display purposes); and technical session information, including session identifiers and timestamps. We do not collect your date of birth or otherwise verify your age.

2.3 Information Collected Automatically

When you access the Platform, we automatically collect: IP addresses; browser type and version; device information; pages visited and actions taken within the Platform; timestamps of access and actions; and error and performance data (collected through our error monitoring service).

3. How We Use Your Information

We use the information we collect for the following purposes:

To provide the Platform: processing interview responses, generating investigation reports, evaluating response sufficiency, selecting follow-up questions, and conducting safety evaluations.

To manage accounts and purchases: authenticating users, processing payments, confirming access to purchased Matters, and communicating account-related information.

To maintain security and safety: monitoring for safety concerns in participant responses, enforcing rate limits and brute force protections, detecting and preventing fraud or unauthorized access, and maintaining audit trails.

To send transactional communications: invitation emails to participants, safety alert notifications to Case Managers, and account-related notices.

To improve the Platform: analyzing usage patterns, diagnosing technical issues, and improving Platform performance and features.

To comply with legal obligations: responding to lawful requests from governmental authorities and complying with applicable laws and regulations.

4. Pseudonymization Before AI Processing

Before any participant interview text is sent to our third-party AI provider for processing, we replace the names of known participants and the Case Manager with role-based placeholders (for example, "Complainant 1" or "Witness 2") and remove common email-address, phone-number, and Social Security-number patterns. This reduces identifying information but does not make the text anonymous: names or other identifying details that appear in free text, and people who are not participants in the Matter, may not be replaced. The mapping between real identities and placeholders is stored securely in our database and is never sent to the AI provider. After the AI provider returns its analysis, we restore the original identifiers for display to the Case Manager.

While we take reasonable measures to sanitize personally identifiable information, no automated process is perfect. We cannot guarantee that all personally identifiable information will be successfully removed in every instance.

5. Third-Party Service Providers

We rely on the following third-party service providers (sometimes called "subprocessors") to operate the Platform. Each provider receives only the minimum information necessary to perform its function and is bound by its own contractual and security obligations:

Authentication — Clerk: We use Clerk to manage Case Manager account creation, login, and multi-factor authentication. Clerk receives your name and email address. Participants do not have accounts and are not authenticated through Clerk.

Database and Storage — Supabase: We use Supabase to store Platform data, including investigation details, participant information, interview responses, exhibits, and generated reports. Data is held in a secure, access-controlled environment with database-level access controls and tenant-isolation safeguards.

Hosting — Vercel: We use Vercel to host and serve the Platform. Vercel processes Platform traffic in transit but is not a long-term store of your investigation data, which resides with our database and storage provider.

AI Processing — Anthropic (and, in some cases, AWS Bedrock): We use Anthropic's Claude models for textual analysis of participant responses after pseudonymization as described in Section 4. In some cases the same pseudonymized request may instead be processed by Anthropic's Claude models hosted on Amazon Web Services (AWS) Bedrock. In both cases the provider receives text processed as described in Section 4, subject to the limitation stated there, and the mapping between placeholders and real identities is not sent to the AI provider.

Payment Processing — Stripe: We use Stripe to process one-time Matter purchases. Stripe receives your email address and payment details. We do not store full card numbers or banking details on our systems.

Email Delivery — Resend: We use Resend to send transactional emails, including participant invitations, safety alert notifications, and account-related notices. Resend receives recipient email addresses and email content. We do not transmit raw interview responses by email.

Error Monitoring — Sentry: We use Sentry to detect and diagnose technical issues. We configure Sentry to scrub personally identifiable information from error reports before transmission.

Rate Limiting — Upstash: We use Upstash to operate rate-limiting and abuse-prevention controls that protect the Platform. Upstash processes only technical request metadata, such as IP addresses; it does not receive your name, email content, or interview responses.

Support Email — Google Workspace (Gmail): We use a Google Workspace mailbox to receive and send customer support email. Messages you send to support, and our replies, are processed and stored in Gmail. Do not send investigation content or participant details by email; our support mailbox is not the place to share Matter data.

6. When We Share Your Information

We do not sell, rent, or trade your personal information. We share information only in the following circumstances:

With service providers: As described in Section 5, to third-party providers that help us operate the Platform.

Within the Platform: Case Managers can view the responses, reports, and data associated with their own investigations. Participants can view only their own interview questions and responses. No cross-tenant data access is permitted.

For safety purposes: Arvanic runs automated language screening on participant responses. If the screening flags a response, it may create a Safety Review item for the Case Manager and, for the most severe automated flags, send that Case Manager a notice. Automated screening is an aid for human review, not a factual, clinical, legal, emergency, or crisis service; it can over-flag or miss language.

To comply with law: We may disclose information if required to do so by law, regulation, legal process, or governmental request.

To protect rights: We may disclose information when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Arvanic, our users, or the public.

In a business transfer: If Arvanic is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control.

7. Data Security

We implement reasonable administrative, technical, and physical security measures to protect your information, including: encryption of data in transit using TLS/HTTPS; database-level access controls and tenant isolation policies; cryptographic protection of sensitive tokens; time-stamped activity logging with controlled anonymization during governed deletion; pseudonymization before AI processing; rate limiting and brute-force protections; and error monitoring configured to scrub personally identifiable information.

No method of electronic transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee its absolute security.

8. Data Retention

Our retention practices are tied to the type and status of the data:

Open investigations: Investigation data, interview responses, reports, and activity records are retained while the investigation remains open, subject to any applicable legal or preservation hold and the administrative-closure process described below.

Matter data: We retain the data for a Matter for thirty-six (36) months after the Matter is closed. Closure occurs when the Case Manager closes the Matter or when it is closed administratively after a sustained period of inactivity. Before the 36-month period ends we give notice and an opportunity to export the Matter's reports. At the end of the period, unless a legal or preservation hold applies, the data is deleted through our governed deletion process. A Case Manager may also request earlier deletion of a closed Matter, which runs after a seven-day pending period as described in our Terms.

Deleted accounts: Following account deletion, data is retained for thirty (30) days to allow for dispute resolution or data recovery. After the grace period expires and no legal hold is in place, the platform owner may initiate a permanent data purge.

Audit trail: Audit trail entries are anonymized (not deleted) when associated investigation data is purged, preserving a record of platform activity without retaining personally identifiable information.

Invitation tokens: Invitation tokens expire forty-eight (48) hours after creation and are automatically invalidated when an investigation is closed. Token hashes are purged with associated investigation data.

Residual copies and operational records: After deletion, residual copies may remain in encrypted backups until they age out on their ordinary schedule. We also retain a limited set of access-restricted operational records, such as payment, tax, security, legal-hold, and proof-of-deletion records, that do not contain investigation content.

9. Your Rights and Choices

9.1 Case Managers

As a Case Manager, you may: access and update your account information through your account settings; download investigation reports while they remain available to you; request deletion of a closed Matter using the Platform's deletion feature, subject to the seven-day pending period described in our Terms; and request deletion of your account by contacting us at support@arvanic.io.

9.2 Participants

As a Participant, you may: view the interview questions and your responses during your active interview session; contact the Case Manager who invited you for questions about your participation; and contact Arvanic at support@arvanic.io with privacy-related concerns. Participants do not have accounts on the Platform and cannot directly access, modify, or delete their interview data. Requests to access, correct, or delete participant data should be directed to the Case Manager who initiated the investigation.

9.3 State Privacy Rights

Residents of certain U.S. states, including California, Virginia, Colorado, Connecticut, and other states with comprehensive privacy laws, may have additional rights regarding their personal information, including the right to know what personal information we collect and how we use it; the right to request deletion of personal information; the right to opt out of the sale or sharing of personal information (Arvanic does not sell or share personal information for cross-context behavioral advertising); and the right to non-discrimination for exercising privacy rights.

To exercise any of these rights, please contact us at support@arvanic.io. We will respond to verifiable requests within the timeframes required by applicable law.

10. Cookies and Similar Technologies

The Platform uses cookies and similar technologies that are strictly necessary for the operation of the Platform, including: authentication cookies to maintain your login session; session cookies to bind participant interview sessions to their browser; and security cookies used by our authentication and rate limiting providers.

We do not use cookies for advertising, behavioral tracking, or cross-site tracking purposes. We do not use third-party analytics cookies. The Platform does not participate in any advertising networks.

11. Adults-Only Service and Age Signals

The Platform is an adult-only service and is not directed to, or intended for direct use by, anyone under 18. We do not collect dates of birth or verify age. Instead, we rely on two confirmations: the Case Manager confirms for each participant that the participant is at least 18, and before an online interview begins the participant independently confirms that they are 18 or older. For offline questionnaires, we rely on the Case Manager's confirmation and an adult-only notice on the form. We store these confirmations as timestamps and, for the Case Manager's confirmation, the confirming user's identifier. They are eligibility signals, not a date of birth or verified age.

If a person indicates that they are under 18 when opening an interview, we block the interview, record a timestamped eligibility event, revoke the outstanding invitation, and direct the person to contact the inviting employer for another way to participate. A Case Manager can correct a mistaken indication through a separately logged re-attestation; a new invitation is then required.

An adult participant may incidentally refer to a minor in an answer. We treat that information as part of the employer-directed investigation record; the reference does not mean the minor used the Platform and does not by itself make the Matter ineligible. If the minor becomes an intended participant, the employer must handle that person through a process outside Arvanic. If you believe a person under 18 directly provided information through the Platform, contact us at support@arvanic.io.

12. International Users

The Platform is operated from the United States. If you are accessing the Platform from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States and other jurisdictions where our service providers operate. By using the Platform, you consent to the transfer of your information to the United States and other jurisdictions that may not provide the same level of data protection as your home country.

13. Do Not Track Signals

The Platform does not track users across third-party websites and therefore does not respond to Do Not Track (DNT) signals. We do not engage in cross-site tracking or behavioral advertising.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Platform prior to the changes taking effect. We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after any changes constitutes acceptance of the updated Privacy Policy.

15. Contact Information

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

Arvanic LLC
3723 Greenville Ave, Ste 49036
Dallas, TX 75206
Email: support@arvanic.io
Phone: (888) 449-5859