ARWANZAI POLICY

Privacy Notice

ArwanzAI uses a data-minimization model focused on account operation, incident analysis, reporting, support, security, licensing and auditability.

Version 0.9.0-web-policyUpdated 26/09/2026Automatic execution: NEVER

This page describes the working ArwanzAI privacy model. Final controller/processor roles, legal entity details, regional rights language and the production subprocessor list will be finalized before paid commercial activation.

1. Data we may process

Account and identity data such as name, email, organization and authentication identifiers.
Incident evidence and analysis metadata supplied by the customer.
Generated reports and investigation history.
Commercial, licensing, usage, support and reconciliation metadata.
Technical, security and audit events necessary to operate and protect the service.

2. Why we process data

We process information to create and secure accounts, analyze permitted incident evidence, generate reports, maintain case continuity, provide support, enforce licensing, prevent abuse, maintain security and meet applicable legal or accounting requirements.

3. Evidence minimization

ArwanzAI is designed so that raw evidence is temporary and bounded. Customers should not intentionally submit passwords, private keys, payment-card data, bank credentials or unrelated personal information.

4. Current retention model

The current service defaults to approximately 2 hours for raw incident-evidence working data and 30 days for generated PDF reports, unless configured otherwise within the bounded implementation. A lightweight successful-run audit record can remain after report expiry so usage and entitlement history stay transparent. Customers can request account deletion subject to legal, security, billing and audit retention requirements.

5. Deletion

Eligible production data is deleted according to the applicable retention/deletion process. Backup copies may persist until the relevant backup lifecycle expires, subject to law and documented security controls. Deleting a report does not restore consumed analysis allowances.

6. AI processing

ArwanzAI may send bounded, necessary investigation context to designated AI providers to perform the contracted analysis or conversational service. Customer evidence is processed to provide the service and is not treated as a general-purpose training dataset unless a separate, expressly approved basis exists.

7. Subprocessors and international processing

A controlled subprocessor register is maintained for production providers. Processing may occur in India or other jurisdictions depending on the approved service architecture and provider contracts. Public provider details will be kept aligned with the actual production roster before paid commercial activation.

8. Security

ArwanzAI uses access controls, encryption, private storage, bounded retention, audit records, secret-minimization controls, customer isolation and controlled administrative access. No security control eliminates all risk; security is managed as a continuous operational process.

9. Customer choices and requests

Depending on applicable law, customers may request access, correction, deletion, withdrawal of consent where consent applies, or grievance handling. Requests can be sent to the service contact above and may require identity/account verification.

10. Legal basis and compliance

ArwanzAI will apply the lawful processing basis appropriate to the service relationship and applicable law. Regulatory obligations, including India's phased Digital Personal Data Protection framework, will be tracked as they become applicable to the relevant entity and processing activity.

11. Updates

Material changes will be published with a new policy version. Contractual customers may also receive version-specific notice or acceptance requirements where applicable.

12. Contact

Privacy questions and requests: arwanzai@crazydba.com.