Aria — AI Business Assistant

1. Who We Are

Aria is an AI-powered operations platform for hospitality businesses, built and operated by Vishverse, United Kingdom. If you have any questions about this policy, contact us at vishverse123@gmail.com.

2. What Data We Collect

Account data — name, email address, business name, and password (hashed) when you sign up.
Business data — staff records, bookings, complaints, compliance documents, and other operational data you enter into Aria.
Usage data — pages visited, features used, and chat messages sent to Aria (used to improve the service).
Billing data — handled entirely by Stripe. We never store your card details.
Communications — emails sent or received via the Gmail integration are processed in real time and not stored by Aria beyond your own Supabase database.

3. How We Use Your Data

To provide and improve the Aria service.
To process payments via Stripe.
To send you service-related emails (account confirmations, billing receipts).
To generate AI responses — your business data is sent to our LLM providers (Anthropic, Groq, OpenAI) solely to generate responses. We do not use your data to train third-party models.
To comply with legal obligations under UK and EU law.

4. Legal Basis (UK GDPR)

We process your personal data under the following legal bases:

Contract — processing necessary to provide the service you signed up for.
Legitimate interests — improving the platform, detecting abuse, and ensuring security.
Legal obligation — where required by UK law.

5. Data Sharing

We share data only with the following third parties, strictly to operate the service:

Supabase — database and authentication hosting.
Anthropic / Groq / OpenAI — LLM providers for AI responses.
Stripe — payment processing.
Google — Gmail API for email integration (only when you connect your Gmail account).
Vercel — web app hosting.

We do not sell your data to any third party.

6. Data Retention

We retain your data for as long as your account is active. On account deletion, your data is removed within 30 days, except where we are required to retain it by law (e.g. billing records for 7 years under HMRC requirements).

7. Your Rights (UK GDPR)

You have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Request deletion of your data ("right to be forgotten").
Object to or restrict processing.
Data portability — receive your data in a machine-readable format.
Withdraw consent at any time (where processing is based on consent).

To exercise any of these rights, email us at vishverse123@gmail.com. We will respond within 30 days.

8. Cookies

Aria uses only essential cookies required for authentication and session management. We do not use advertising or tracking cookies.

9. Security

All data is encrypted in transit (TLS) and at rest. We use Supabase Row Level Security (RLS) to ensure each business can only access its own data. Access to production systems is restricted to authorised personnel only.

10. Changes to This Policy

We may update this policy from time to time. We will notify you by email or via the dashboard if we make material changes. Continued use of Aria after changes are posted constitutes acceptance.

11. Contact

For any privacy-related questions or requests, contact:
Vishverse, United Kingdom
vishverse123@gmail.com

Privacy Policy