Privacy Policy

Our commitment to privacy

Arrouya Inc. (“Arrouya”, “we”, “us”, or “our”) is committed to protecting your personal information and being transparent about how personal information is collected, used, stored, shared, and safeguarded.

This Privacy Policy (“Policy”) explains how Arrouya collects, uses, shares, and protects personal information in contexts where Arrouya determines the purposes and means of processing, including when individuals visit our website, request a demo, subscribe to communications, communicate with us, create or administer an account, use Arrouya’s service (the “Services”) as an authorized user, or interact with us in a sales, marketing, support, billing, security, or administrative capacity.

This Privacy Policy does not govern Customer Data that Arrouya processes on behalf of a customer under a subscription agreement, data processing addendum, or other written data processing terms. Where Arrouya processes Customer Data on behalf of a customer, Arrouya acts as a processor/service provider, and that processing is governed by the applicable customer agreement and DPA, not this Privacy Policy. In those cases, the customer is responsible for providing any required notices, obtaining any required rights or consents, and responding to individual privacy rights requests, subject to Arrouya’s obligations under the applicable DPA.

If there is any conflict between this Privacy Policy and a customer agreement or DPA with respect to Customer Data, the customer agreement or DPA will govern.

Context of use and intended users

Arrouya is primarily designed for professional and commercial use by municipalities, government agencies, and organizations to support parks and recreation management, municipal operations, and related workflows. Users access the Services as authorized representatives of business entities. In the contexts covered by this Policy, the personal information Arrouya collects and processes primarily relates to professional or workplace identities, including customer administrators, authorized users, billing and support contacts, prospective customers, job applicants, government and agency representatives, and other business contacts who interact directly with Arrouya.

We also collect and process limited personal information from individuals who visit our website, request demonstrations, subscribe to updates, or otherwise interact with Arrouya in a consumer or exploratory capacity. This may include prospective customers, independent professionals, or individuals evaluating the Services for future use.

This Policy applies to personal information Arrouya processes in contexts where Arrouya acts as a controller/business, including when individuals browse our website, request a demo, subscribe to communications, create or administer an account, communicate with us, apply for a job, or otherwise interact with Arrouya directly as well as account administration, customer relationship management, billing, support, security, analytics, service improvement, legal compliance, and general business operations.

Definitions

“Personal Information” means any information that identifies or can reasonably be linked to an identifiable individual, directly or indirectly. This includes, for example, professional identifiers, contact details, online identifiers, device information, behavioral data, and information collected through website interactions such as form submissions or analytics tools.

Who this Policy applies to

This Policy applies to you when you:

• Access or browse the Arrouya website
• Submit inquiries, demo requests, or newsletter sign-ups
• Create or manage an Arrouya account
• Use Arrouya on behalf of an organization
• Communicate with Arrouya via email, messaging, or support channels
• Apply to Arrouya for a job

This Policy covers both registered platform users and individuals who interact with Arrouya through its public-facing website or marketing channels. It does not apply to third-party platforms or services you may access through Arrouya, which are governed by their own privacy policies and terms. We encourage you to review their policies separately, as Arrouya does not control how those third parties collect or use your information.

Age restrictions

The Services are intended for professional use and are not designed for children or minors. Users must be at least 16 years of age (or older where required under applicable law) to use the Services. If Arrouya becomes aware that personal information relating to a minor has been collected without valid legal consent, reasonable steps will be taken to delete such information promptly.

If you are a parent or legal guardian and believe your child has submitted information to Arrouya without your consent, please contact us at support@arrouya.com so we can take appropriate action.

Information we collect

Personal information collected from website visitors and prospective users

When you interact with the Arrouya website (even without creating an account), we may collect:

• Name and contact details submitted through forms
• Professional contact information provided for demo or sales inquiries
• Browser and device identifiers
• IP address and location data (approximate)

This information may be used to respond to requests, provide marketing communications, or improve the website experience.

Personal information collected from platform users

We may also collect personal information associated with registered accounts, including:

• Name and professional identity
• Business email address and phone number
• Company name, department, and job title
• Login credentials and account identifiers
• IP address, device identifiers, and session identifiers
• Billing, invoicing, and payment details

Technical and usage information

We automatically collect technical and usage data when you interact with the Services or website, such as:

• Device type, browser, and operating system
• Access dates, session length, and login times
• Pages viewed and features used
• Click behavior and workflow interactions
• Error logs and diagnostic data

This information helps us monitor platform performance, optimize functionality, understand visitor behavior, and improve both user experience and marketing effectiveness.

Personal information

We may collect personal information that you voluntarily provide or that is associated with your account, including:

• Name and professional identity
• Business email address and phone number
• Company name, department, and job title
• Login credentials and account identifiers
• IP address, device identifiers, and session identifiers
• Billing, invoicing, and payment details

This information allows us to establish your account, authenticate access, deliver services, and maintain communication.

Arrouya does not collect sensitive personal information.

How we collect information

Information provided directly

We collect information you provide when you:

• Register for or manage an account
• Subscribe to Arrouya services
• Communicate with Arrouya representatives
• Upload data, contacts, or content

Automatically collected information

Information may be collected using cookies, tracking technologies, log files, and similar tools that monitor usage patterns and system interactions.

How we use your information

We use collected information to:

• Create and manage user accounts
• Respond to demo requests and inquiries
• Deliver and maintain the Services
• Process subscriptions and billing
• Provide technical support and customer assistance
• Improve website content and functionality
• Send service-related communications
• Send marketing or promotional communications (where permitted)
• Maintain platform security and monitoring
• Conduct internal analytics and business planning
• De-identify or aggregate personal information so that it no longer identifies an individual and use such information for any lawful business purpose.

Arrouya does not sell personal information and does not use it for unrelated third-party marketing purposes.

Legal basis for processing

Where applicable, Arrouya relies on the following legal bases for processing:

• Performance of a contract
• User consent for optional features
• Compliance with legal obligations
• Legitimate business interests. Where we rely on legitimate interests, those interests include operating, securing, improving, and promoting the Services; communicating with business contacts; preventing fraud and misuse; managing customer, vendor, and applicant relationships; and enforcing legal rights.

Data roles in an enterprise context

When the Services are used by business customers:

• The business entity acts as the controller / business
• Arrouya acts as a processor / service provider
• Arrouya may act as an independent controller/business for account administration data, website data, billing data, security data, support communications, usage data, operational telemetry, and other Service Data collected for Arrouya’s own business purposes.

Arrouya processes data solely in accordance with documented instructions provided by the business customer and as governed by the applicable subscription agreement and any applicable Data Processing Addendum (DPA). Organizations remain responsible for ensuring lawful collection and use of data uploaded to the platform.

Arrouya does not sell personal information or share personal information for cross-context behavioral advertising, as those terms are defined under applicable U.S. state privacy laws.

Customer websites and portals

Arrouya may build, host, or operate public-facing websites, portals, or registration pages on behalf of its customers (for example, a municipality’s parks and recreation website). Personal information submitted through those customer sites is collected by or on behalf of the applicable customer, which acts as the controller/business, and Arrouya acts solely as a processor/service provider under its agreement with that customer. This Privacy Policy does not apply to personal information collected through customer sites; the customer’s own privacy notice governs that information, and privacy inquiries or rights requests relating to a customer site should be directed to the applicable customer. Arrouya will refer any such requests it receives to that customer.

Cookies and tracking technologies

Arrouya uses essential and non-essential cookies and similar technologies to support secure operation and optimize performance. Essential cookies are necessary for authentication, system security, and core functionality. Non-essential cookies support analytics, user experience enhancement, and performance monitoring.

Where legally required, Arrouya requests user consent before deploying non-essential cookies. Users may manage cookie settings via browser controls or consent tools. Cookies include first- and third-party cookies, pixels, and local storage used for authentication, security, preferences, analytics, and performance measurement (including analytics providers such as Google Analytics). You can manage or delete cookies through your browser settings, though disabling certain cookies may affect functionality; we do not currently respond to “Do Not Track” signals.

How we share information

Personal information may be shared with:

• Authorized service providers (hosting, analytics, communications, payment processors)
• Legal or regulatory authorities where required
• Corporate successors in the event of restructuring or acquisition
• Other parties when you direct us to share the information, authorize an integration, or otherwise consent

All third parties are contractually required to implement confidentiality and security safeguards.

Data security

Arrouya employs administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, alteration, loss, or disclosure. These include encryption, controlled access protocols, monitoring systems, and incident response procedures. Despite these measures, no system can guarantee complete security.

Data retention

Arrouya retains personal information only for as long as necessary to fulfill operational, contractual, or legal purposes. When no longer required, data is securely deleted or anonymized. Retention periods may vary depending on the nature of the data and applicable regulatory obligations.

Data hosting and storage location

Personal information processed by Arrouya under this Policy is hosted and stored on cloud infrastructure provided by third-party providers, including Vercel Inc. (application hosting), Render Services, Inc. (backend hosting), and Google LLC (“Google Cloud”) (data storage), in data centers located within the United States. These providers maintain industry-standard physical, technical, and organizational safeguards and are contractually obligated to protect the information they process on Arrouya’s behalf.

Cross-border transfers

Personal information may be processed or stored outside your jurisdiction depending on where our infrastructure and service providers are located. Where required, Arrouya implements appropriate safeguards such as:

• Standard Contractual Clauses (SCCs)
• Data Processing Agreements (DPAs)
• Encryption and access controls

These measures ensure your information remains protected regardless of where it is processed.

Your privacy rights and choices

Depending on your location, you may have rights to:

• Confirm whether we process your personal data
• Access your personal information
• Correct inaccuracies
• Request deletion (subject to legal limits)
• Restrict or object to certain processing
• Request data portability
• Withdraw consent where applicable
• Lodge a complaint with a supervisory authority

Opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting us. We may still send service, security, legal, billing, or administrative communications.

Residents of certain U.S. states and users in the EEA, UK, or Switzerland benefit from broader rights under applicable privacy laws. Canadian residents also have rights of access and correction under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including Quebec’s private-sector privacy legislation. Requests may be submitted to support@arrouya.com, and we may verify your identity before responding.

Where Arrouya acts as a processor on behalf of a business, such requests should be directed to the relevant organization.

Policy updates

Arrouya may update this Policy periodically to reflect changes in operations, technology, or legal obligations. Material changes will be communicated through reasonable channels. Continued use of the Services constitutes acceptance of updated terms.

Contact information

If you have questions about this Policy or wish to exercise your privacy rights, please contact: