Privacy Policy

1. Overview

E-ARI is an AI governance and evidence platform covering readiness assessments, registered systems, evidence records and compliance workflows. This policy describes data processing across the website, APIs and associated services.

E-ARI is operated by Aymen Boudebouz, an individual established in Porto, Portugal; E-ARI is a trading name, not an incorporated company. For the processing this policy describes, the controller is Aymen Boudebouz. Write to support@e-ari.com; a postal address for legal notices will be published here.

By accessing or using E-ARI, you agree to the data practices described in this policy. If you are using E-ARI on behalf of an organization, you represent that you have the authority to bind that organization to this policy. We encourage you to read this document carefully and review it periodically, as we may update it from time to time. When we make material changes, we will notify you through the platform or by email before the changes take effect.

Our approach to privacy is guided by the same principles that underpin our assessment methodology: transparency, rigor, and accountability. We do not sell your data. E-ARI does not itself train models on assessment responses; provider processing conditions are described below. And we design our data architecture so that only the minimum information necessary is processed at each stage of the assessment pipeline.

2. Information We Collect

We collect information that you provide directly, information generated through your use of the platform, and technical information collected automatically. Each category serves a distinct purpose in delivering the assessment experience and generating your results.

2.1 Information You Provide

Account information

Full name, email address, organization name, job title, industry sector, and password (stored as a bcrypt hash). This information is necessary to create and manage your account and to tailor assessment outputs to your organizational context.

Team roster data (AI literacy training)

If your organization uses the Article 4 literacy-compliance module, your administrator provides team members' names, work email addresses, and optionally job titles and departments so training can be assigned and completions recorded. Training links are personal, single-purpose, and expire after 30 days; completion records include quiz scores and a cryptographic attestation hash. Team members can request access or deletion of their records via their administrator or by contacting us directly.

Vendor contact data

If your organization uses the AI vendor-risk module, you may provide the name and work email address of a contact person at each vendor so we can deliver a risk questionnaire on your behalf. We process this data solely to deliver and record the questionnaire.

Assessment responses

Your answers to the 8-pillar assessment questionnaire, including selected options for each question, free-text elaborations, and any clarifying notes. These responses form the foundation for all scoring, insights, and recommendations generated by the platform.

Organization details

Organization size, sector, geographic region, and current AI initiatives. This context enables the Discovery Agent and benchmark comparisons to produce sector-relevant outputs rather than generic advice.

Payment information

When you subscribe to any paid plan, we collect billing details through our payment processor. E-ARI does not store credit card numbers on our servers; they are handled exclusively by our PCI-compliant payment provider.

Sign-in activity

When you use the platform we record the time of your most recent activity, and the approximate location of that activity (country and city) as reported by our hosting provider's edge network. Your IP address is truncated before it is stored — the final segment is replaced with zero, so we hold 81.2.69.0 rather than the full address. We keep this to answer two operational questions: whether an account is still in use, and whether it is being accessed from somewhere unexpected. We do not build a history: each sign-in overwrites the previous record, and location data is erased 90 days after your last activity. We do not use it for advertising, profiling, or any automated decision about you.

Communication preferences

Your opt-in choices for product updates, assessment reminders, and marketing communications.

2.2 Information Generated by the Platform

Assessment scores

Calculated pillar scores (0-100), overall readiness score, maturity band classifications (Laggard, Follower, Chaser, Pacesetter), and weighted adjustments generated by the Scoring Agent using deterministic methodology (Scoring v5.6).

AI-generated insights

Strategic narratives produced by the Insight Agent, organizational landscape analysis from the Discovery Agent, learning path recommendations from the Literacy Agent, and interactive Q&A responses from the Assistant Agent. These are generated by large language models (LLMs) processing your assessment data.

Reports

PDF reports compiled by the Report Agent, including executive summaries, benchmark comparisons, roadmaps, and strategic recommendations.

Benchmark data

Sector-specific benchmarks generated from our curated dataset covering eight industry sectors (Financial Services, Healthcare, Manufacturing, Retail, Technology, Government, Energy, Education). Your anonymized scores may contribute to aggregate benchmark statistics.

2.3 Automatically Collected Information

Usage data

Pages visited, features used, time spent on assessments, click patterns, and navigation paths. This helps us understand how users interact with the platform and identify areas for improvement.

Device and browser information

Browser type and version, operating system, screen resolution, device type, and IP address. This ensures the platform renders correctly and helps detect unauthorized access.

Performance metrics

Agent pipeline execution times, API response latencies, and error rates. These operational metrics help us maintain platform reliability and performance.

2.4 Job Applications

This section was missing while the intake it describes was live. If you apply through our careers page we collect your name, email address, the role you applied for, any link you provide, what you write in the application, and — if you choose to attach one — your CV.

Purpose and basis

Assessing your application. Our legitimate interest in recruiting, and steps taken at your request before entering a contract.

Where the file is held

CVs are stored as private objects in our file storage. They are not publicly addressable and are readable only through an administrator-authenticated download.

Retention

The CV file is deleted automatically 30 days after it is received, by a scheduled job. The application text itself is kept in our support inbox so we have a record of who applied and when.

Who sees it

Nobody outside E-ARI. Applications are not sent to an applicant-tracking service and are not used to train any model.

Your rights

You do not need an account. Email careers@e-ari.com to ask for a copy of, correction of, or deletion of your application and CV.

2.5 Documents You Upload to the Compliance Workspace

If you upload evidence — a vendor DPA, a SOC 2 report, an internal policy — the platform extracts its text so it can find and cite the relevant clauses. Those documents routinely name individuals.

What happens to the text

It is chunked and sent to our LLM provider for clause identification. Identifiers we can detect — email addresses, phone numbers, and similar patterns — are redacted before the text leaves our servers. Redaction is pattern-based, so treat it as a reduction of exposure rather than a guarantee, and avoid uploading documents whose contents you would not want processed.

Where the file lives

Private object storage, readable only through an authenticated request scoped to your workspace.

Deletion

Removing the evidence record deletes the stored file and its extracted text.

2.6 Administrative and Rate-Limiting Records

Administrative actions

When an administrator acts on an account — changing a tier, granting a role, deleting a user — we record who acted, on what, when, and the originating IP. This trail is append-only and survives account deletion, because it is the record that the deletion happened. The IP is truncated to a network after 90 days, and the entry retains the email addresses involved.

Rate limiting

To stop abuse of sign-in, registration and public forms we keep short-lived counters keyed to the requesting IP address and, for sign-in, the account being attempted. These expire within a week and are not used for anything else.

3. How We Use Your Information

We use the information we collect for the following purposes, each of which is necessary to deliver the E-ARI service or required by law:

Delivering assessments

Processing your questionnaire responses through the 6-agent pipeline (Scoring, Insight, Discovery, Report, Literacy, Assistant) to generate pillar scores, strategic narratives, benchmark comparisons, roadmaps, and PDF reports.

Account management

Creating and maintaining your account, authenticating your identity, managing subscriptions (Free, Pro and Enterprise plans), and processing payments.

Personalization

Tailoring assessment questions, insights, benchmarks, and recommendations to your sector, organization size, and maturity level. Without this contextual information, agents would produce generic outputs that do not reflect your organization's actual readiness landscape.

Platform improvement

Analyzing usage patterns to improve question design, scoring methodology, agent accuracy, user interface, and overall platform performance. We use aggregated and anonymized data for these purposes whenever possible.

Communication

Sending assessment results, account notifications, security alerts, and (with your consent) product updates and marketing communications. You can manage your communication preferences at any time from your account settings.

Security and fraud prevention

Detecting unauthorized access, preventing abuse, and protecting the integrity of assessment results and scoring methodology.

Legal compliance

Fulfilling legal obligations, responding to lawful requests from public authorities, and enforcing our terms of service.

4. AI Processing & LLM Usage

E-ARI uses a large language model (LLM) for its model-assisted features: narrative insights on assessment results, the Discovery interview, learning-path recommendations, the Assistant, clause extraction from uploaded evidence, compliance drafting and organisation enrichment. Readiness scoring and rule-based risk classification do not use a language model. This section explains how your data interacts with the model and the safeguards we have implemented.

4.1 What Is Sent to LLMs

When your assessment is processed, the following data is included in prompts sent to our LLM provider: your pillar scores, per-question answer details (selected options and any free-text responses), your organization's sector and size, and the assessment context. This information is necessary for the agents to produce contextually relevant, organization-specific analysis rather than generic outputs. Without per-question detail, agents would have no basis for differentiated insights. When you upload evidence, the document text sent for clause extraction first passes through regex PII redaction.

4.2 LLM Provider and Data Handling

The platform’s default model provider is DeepSeek, which processes data in China. China is not covered by a European Commission adequacy decision. Transfer safeguards must be established and assessed; this page does not assert that an agreement alone resolves the transfer assessment. Model-assisted features include narrative generation, clause extraction from uploaded evidence, compliance drafting and organisation enrichment. Configurable endpoints can change routing; the operator must confirm the active providers and update disclosures before using an alternative. Readiness scoring and rule-based risk classification do not use a language model. Provider retention and model-training conditions depend on the applicable API terms; E-ARI does not assert negotiated zero-retention or no-training commitments.

4.3 What Is NOT Sent to LLMs

The Scoring Agent and Report Agent operate deterministically and do not send data to LLMs. The Scoring Agent calculates pillar scores using a fixed, auditable methodology (Methodology v5.6) with no AI involvement. The Report Agent compiles pre-generated content into PDF format without LLM processing. Additionally, we never send your email address, password, payment information, or personally identifiable contact details to LLM providers as part of assessment processing.

4.4 AI-Generated Content Labeling

All content generated by LLM-powered agents is clearly labeled as AI-generated within the platform. This includes insight narratives, discovery analysis, literacy recommendations, and assistant responses. We believe in transparency: you should always know whether a piece of content was calculated by deterministic methodology or generated by an AI model. Scores are never altered by AI; LLM-generated content is supplementary narrative that helps interpret the scores.

5. Data Sharing & Disclosure

We do not sell, rent, or trade your personal information or assessment data to third parties. We share information only in the following specific circumstances:

LLM providers

The platform’s default model provider is DeepSeek, which processes data in China. China is not covered by a European Commission adequacy decision. Transfer safeguards must be established and assessed; this page does not assert that an agreement alone resolves the transfer assessment. Model-assisted features include narrative generation, clause extraction from uploaded evidence, compliance drafting and organisation enrichment. Configurable endpoints can change routing; the operator must confirm the active providers and update disclosures before using an alternative. Readiness scoring and rule-based risk classification do not use a language model. Provider retention and model-training conditions depend on the applicable API terms; E-ARI does not assert negotiated zero-retention or no-training commitments.

Payment processors

Billing information is processed by our PCI-compliant payment provider. We do not store full credit card numbers on our infrastructure.

Infrastructure providers

We use cloud hosting providers for application hosting, database storage, and file storage. These providers are contractually obligated to process data only as instructed by E-ARI and maintain appropriate security certifications (SOC 2, ISO 27001).

Enterprise customers

If your organization has an Enterprise agreement, designated administrators within your organization may access aggregate assessment data and usage analytics for users within that organization. Individual assessment responses are not shared with organization administrators unless you explicitly opt in.

Legal requirements

We may disclose information when required by law, regulation, legal process, or governmental request. We will notify you of such disclosure unless we are legally prohibited from doing so.

Business transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the acquiring entity. We will notify you via email and update this policy before any such transfer occurs.

6. Data Storage & Security

The security page describes the controls implemented in the application and the current assurance limitations. Procurement requirements should be assessed against those controls and the actual deployment.

6.1 Encryption

Browser traffic and configured external provider API calls use HTTPS. Supported TLS versions, storage encryption and backup placement depend on the configured providers. Application secrets are supplied through deployment configuration; a dedicated application KMS and an enforced rotation schedule are not established here.

6.2 Access Controls

The application uses role-based authorisation and records specified administrative actions. Provider-account access, administrative MFA enforcement and access-review procedures require separate operational confirmation; the application role checks do not establish those controls.

6.3 Infrastructure Security

Our infrastructure is hosted on cloud providers that maintain SOC 2 Type II and ISO 27001 certifications; those attestations cover their platforms, not the E-ARI application running on them. The application has regression tests for specific security findings; these tests are not a completed OWASP assessment or an independent audit. E-ARI holds no security certification of its own and does not publish a third-party penetration test report — our security page sets out what we have and have not done.

6.4 Incident Response

We maintain an incident response plan and will notify affected users within 72 hours of discovering a data breach that poses a risk to their rights and freedoms, in accordance with applicable data protection laws. Notifications will include the nature of the breach, the data affected, and the steps we are taking to remediate it.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide you services, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention periods are as follows:

Account data, assessment responses and results

Account deletion is requested through support@e-ari.com. Once authorised, the erasure workflow removes account-linked records and stored files; specified audit records and legally required records may remain. A separate post-termination reactivation period is not implemented by that workflow. Backup deletion schedules and any contractual maximum retention period require operator confirmation; no unverified backup-erasure deadline is represented here as an implemented control.

AI-generated content

Retained alongside the associated assessment for the same period. When an assessment is deleted, all associated AI-generated insights, reports, and narratives are also deleted.

Usage and analytics data

Retention depends on the configured analytics and monitoring services. A universal 90-day anonymisation or 180-day raw-log deletion schedule has not been established; the operator must confirm each service’s active settings.

Sign-in activity

The truncated IP address and approximate location are cleared 90 days after your last activity by an automated daily job. The timestamp of last activity is kept for the life of the account, since "last used in March" carries no location information.

Payment records

Retained for the period required by the applicable accounting and tax obligations. The operator must confirm the jurisdiction-specific schedule.

LLM prompts and completions

Generated outputs selected for the assessment or system record are retained with that record. Provider retention is governed by the applicable API terms.

8. Your Rights & Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

Access

You can request a copy of the personal information we hold about you, including your assessment responses, scores, and AI-generated content. You can access most of this information directly from your account dashboard.

Rectification

You can update your account information at any time. If you believe assessment results contain errors due to inaccurate input data, you can retake the assessment with corrected responses.

Erasure

You can request deletion of your account and all associated data. Upon confirmation, we will delete your personal information within 30 days, except where retention is required by law (such as financial records).

Portability

You can export your assessment results, scores, and reports in machine-readable formats (JSON, PDF) from your account dashboard.

Objection

You can object to the processing of your data for direct marketing purposes by updating your communication preferences. For other processing activities, you may object on grounds relating to your particular situation.

Restriction

You can request that we restrict the processing of your data in certain circumstances, such as when you contest the accuracy of the data or object to processing based on legitimate interests.

Automated decision-making

E-ARI's scoring methodology is deterministic and auditable, not automated decision-making in the legal sense. AI-generated insights are supplementary narratives and do not make decisions about you. You have the right to be informed about the logic involved in scoring and insight generation.

To exercise any of these rights, contact us at privacy@e-ari.com. We will respond to your request within 30 days. If we are unable to comply with your request, we will explain why.

9. Cookies & Tracking

E-ARI uses cookies and similar tracking technologies for the following purposes:

Essential cookies

Required for authentication, session management, and security (e.g., CSRF protection). These cannot be disabled without breaking core platform functionality.

Functional cookies

Store your preferences such as theme settings, language, and assessment progress. These enhance your experience but are not strictly necessary.

Analytics cookies

Help us understand how users interact with the platform, including page views, feature usage, and error rates. We use anonymized data and do not track individual users across sessions for advertising purposes.

We do not use advertising cookies or sell data to advertising networks. You can manage your cookie preferences through the cookie banner displayed on your first visit or through your browser settings. Disabling certain cookies may affect the functionality of the platform.

10. Children's Privacy

E-ARI is a professional platform designed for organizations governing their use of AI. Our services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a person under 18, we will take steps to delete that information promptly. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@e-ari.com.

11. International Data Transfers

E-ARI operates globally and your data may be transferred to and processed in countries other than your country of residence. We ensure that all international transfers are protected by appropriate safeguards, including Standard Contractual Clauses approved by the European Commission, adequacy decisions, or other legally recognized transfer mechanisms. When data is transferred to our LLM providers, appropriate safeguards are in place as described in our Data Processing Agreement.

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we comply with the General Data Protection Regulation (GDPR) and applicable local data protection laws. Our legal basis for processing includes: performance of the contract (delivering assessment services), legitimate interests (platform improvement and security), consent (marketing communications), and legal obligations (financial record retention).

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by posting a prominent notice on the platform, sending an email to the address associated with your account, or both. The updated policy will be effective as of the "Last updated" date shown at the top of this page.

We encourage you to review this policy periodically. Your continued use of E-ARI after any changes constitutes your acceptance of the updated policy. If you do not agree with the changes, you may close your account by contacting us at privacy@e-ari.com.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us using any of the following methods:

Email

privacy@e-ari.com

Data Protection Officer

dpo@e-ari.com

Mailing address

E-ARI, Attn: Privacy Team

For EU/EEA residents: If you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with your local supervisory authority. We are committed to resolving any concerns you may have and encourage you to contact us before filing a formal complaint.