Legal
Data Processing
Last updated: August 12, 2026
This page explains how Arandi Inc. processes personal data when it does so on behalf of a customer.
Roles
When you process third parties' personal data through Arandi, you act as the Controller and Arandi as the Processor: we process that data following your instructions and this document.
Isolation and no training
Each workspace is operated as a closed, isolated universe. We do not use your content to train AI models and do not share it with other customers.
Sub-processors
To operate the Service we rely on the third-party providers listed below. This is the complete list of destinations your content can reach, not a selection:
| Provider | What for |
|---|---|
| Supabase | Database and authentication |
| Vercel | Frontend hosting |
| Railway | Backend hosting |
| Anthropic (Claude) | AI language processing |
| Google Cloud (BigQuery) | Patent database search |
| Google Cloud (Vertex AI) | Embeddings — wired, currently inactive |
| Google (OAuth) | Sign-in |
| Sentry | Error monitoring and session recording |
| OpenAlex (OurResearch) | Scientific literature search |
| GDELT | News search |
Status of our sub-processor agreements
We would rather be precise than reassuring. Today we operate with each provider under their standard commercial terms and published privacy policies, which include the commitments each of them publishes. Specific data processing agreements (DPAs) between Arandi and those providers are being formalized: until each one is signed, we do not claim to hold negotiated obligations with them beyond those standard terms.
Two providers on the list, OpenAlex and GDELT, are open academic initiatives, and only derived search terms travel to them — never your full text or your account data. For GDELT there is no contractual counterparty available. For OpenAlex, operated by the non-profit OurResearch, there is one, and we are asking whether they offer a data processing agreement.
We will notify relevant changes to this list with reasonable notice.
Security and incidents
We apply reasonable technical and organizational measures (see the Security page). In the event of a security incident affecting personal data, we will notify the customer without undue delay.
Return or deletion
Upon termination of the Service we return or delete the personal data processed on your behalf, unless legally required to retain it. Today that deletion is carried out on request and manually: no automated expiry process runs yet.
Two clarifications we would rather give you before you ask. Deletion reaches our database and our file storage. It does not immediately reach the operational logs of our hosting providers or the query history of our patent-search provider: those are purged on each provider's own schedule, not on our instruction. Write to us at privacy@arandi.ai and we will confirm what was deleted, what is still alive for that reason, and for how long.
Legal framework
Law 1581 of 2012 and its regulations (Colombia); applicable U.S. state privacy laws.
Contact
Write to us at privacy@arandi.ai.