1Controller Information

We act as a Data Controller under GDPR where applicable. When processing Personal Data on behalf of our business customers, we act as a Data Processor under the terms of our Data Processing Agreement (see our Terms of Service, Section 9).

2Data We Collect

We may collect the following categories of information:

• WhatsApp Business Data — Phone numbers, message content, metadata (timestamps, delivery status), and identifiers necessary for communication.
• Client Analytics Data — Usage metrics, engagement reports, and aggregated insights to support business decision-making.
• Website & Tracking Data — Cookies, device identifiers, IP addresses, and browsing behaviour via Google Analytics and Meta Pixel. See Section 3 for cookie details.
• Business Contact Information — Names, emails, and phone numbers provided voluntarily for support, partnerships, or sales inquiries.
• Authentication Data — Phone numbers and encrypted authentication credentials (including TOTP secrets) used to verify user identity when accessing the Platform.

3Cookies & Tracking Technologies

Our website uses cookies and similar tracking technologies. When you first visit, a cookie consent banner allows you to choose your preferences.

• Strictly Necessary Cookies — Required for site functionality, authentication, and security. These cannot be disabled.
• Analytics Cookies — Google Analytics, used to understand site usage, visitor behaviour, and improve our services. Data is anonymised where possible.
• Marketing Cookies — Meta Pixel, used for remarketing and measuring the effectiveness of advertising campaigns on Meta platforms.

You can manage your cookie preferences at any time using the cookie settings available on our website, or by adjusting your browser settings. Withdrawing consent for analytics or marketing cookies will not affect the functionality of our platform.

4Purpose of Processing

We process data for the following purposes:

• Delivering and managing WhatsApp Business Platform services in compliance with Meta's Developer Platform Terms
• Providing analytics to clients
• Improving, monitoring, and securing our platform
• Meeting legal obligations, including data retention and security requirements
• Marketing and remarketing through cookies, where lawful consent has been obtained
• Authenticating users and maintaining platform security

5Legal Basis (GDPR)

Processing is based on:

• Contractual necessity: To deliver WhatsApp and analytics services
• Legitimate interests: Platform improvement, security, analytics
• Consent: Cookies, marketing communications
• Legal obligations: Record-keeping, compliance with Meta policies, Irish Revenue requirements

6Sharing & Authorised Sub-Processors

We do not sell personal data.

Data may be disclosed to the following authorised sub-processors and service providers, each bound by data processing agreements:

• Meta Platforms Ireland Limited — WhatsApp Business Platform infrastructure, message routing, and delivery
• Infobip Ltd. — Messaging infrastructure and message routing services
• Stripe, Inc. — Payment processing and billing data management
• SMSAdvert — SMS fallback messaging services
• Google LLC — Google Analytics for website analytics (anonymised data)
• Meta Platforms, Inc. — Meta Pixel for advertising measurement
• Legal and regulatory authorities where required by law

We will notify customers of any changes to sub-processors with at least 30 days' notice, providing an opportunity to object. A full list of current sub-processors is available upon request to legal@arino.one.

7Data Retention

We retain data according to the following schedule, aligned with our Terms of Service (Section 9):

• Message Data: Retained for 12 months following the date of the message, then securely deleted or anonymised
• Account Data: Retained for the duration of the Agreement and 30 days following termination
• Analytics & Aggregated Data: Anonymised and aggregated analytics data may be retained indefinitely for platform improvement
• Financial & Billing Records: Retained for a minimum of 7 years per Irish Revenue requirements
• Consent Records: Retained for a minimum of 3 years following the last relevant consent event
• Authentication Data: Retained for the duration of the account and securely deleted within 30 days of account termination

8Data Security

We implement industry-standard administrative, technical, and physical safeguards, including encryption in transit and at rest, role-based access controls, data-flow logging, and periodic penetration testing in line with Meta Platform Terms and GDPR Article 32. A summary of testing outcomes is available to enterprise customers under NDA. Real-time platform status monitoring is available at status.arino.one.

9Your Rights Under GDPR

Under GDPR, you have the right to:

• Access and obtain a copy of your personal data (Article 15)
• Rectify inaccurate or incomplete information (Article 16)
• Request erasure of your personal data (Article 17)
• Restrict or object to processing (Articles 18 & 21)
• Port your data in a machine-readable format (Article 20)
• Withdraw consent at any time (where applicable)
• Lodge a complaint with a supervisory authority

You also have the right to lodge a complaint with the Irish Data Protection Commission (DPC), 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland. Website: www.dataprotection.ie

10Data Deletion & Erasure Requests

Arino One provides a dedicated self-service erasure flow for the GDPR right to erasure (Article 17) and for Meta's data-deletion requirements. The form is the canonical way to request deletion:

Accessibility fallback. If you cannot use the form, email our Data Protection Officer at dpo@arino.one with the words "Data Deletion" in the subject line and we will process the request manually.

11International Data Transfers

Where data is transferred outside the European Economic Area, appropriate safeguards such as Standard Contractual Clauses (SCCs) under Article 46(2)(c) GDPR are implemented. Details of applicable transfer mechanisms are available upon written request to legal@arino.one.

12Children's Privacy

Our services are not directed to individuals under 16. We do not knowingly process children's personal data.

13Updates to this Policy

We may update this Privacy Policy from time to time. Material changes will be notified by updating the "last updated" date and, where appropriate, direct communication.

1Company Information & Parties

By accessing or using Arino One's services, registering for a free account, or entering into a subscription or service agreement, the Customer agrees to be bound by these Terms of Service, the Acceptable Use Policy, and the Data Processing Agreement contained herein. These terms apply to all users of the Arino One WhatsApp Business Platform, including free account users, subscribers, businesses, developers, and administrators.

2Definitions

In this Agreement, the following terms have the meanings set out below:

• "Arino One", "we", "us", or "our" means Arino One Tech Experts Limited.
• "Customer", "you", or "your" means the business entity that has entered into this Agreement.
• "Platform" means the Arino One WhatsApp Business Platform and all associated services, APIs, and tools.
• "End User" means any individual who receives messages via the Platform through the Customer's account.
• "Meta" means Meta Platforms Ireland Limited, provider of the WhatsApp Business Platform API.
• "Personal Data" has the meaning given in the GDPR (Regulation (EU) 2016/679).
• "Data Controller" means the Customer in its capacity as data controller of End User personal data (as defined in Article 4 GDPR).
• "Data Processor" means Arino One in its capacity as data processor acting on behalf of the Customer (as defined in Article 4 GDPR).
• "Credits" means the messaging units allocated to Customer accounts for use on the Platform.
• "Conversation" means a 24-hour messaging session as defined by Meta's conversation-based pricing model.
• "SLA" means the Service Level Agreement set out in Section 5.

3Service Description

Arino One provides comprehensive WhatsApp Business Platform services to businesses operating within the European Union and European Economic Area. Our services are delivered as an authorised Meta WhatsApp Business Solution Provider (BSP) and are subject at all times to Meta's WhatsApp Business Platform Terms and policies.

Core Platform Services

• WhatsApp Business API access and messaging capabilities
• Message Template (HSM) management and Meta approval assistance
• Contact management, segmentation, and list management tools
• Campaign creation and distribution systems
• Real-time analytics, delivery reporting, and conversation tracking
• Opt-in and opt-out management tools compliant with GDPR and WhatsApp policy

Advanced Features

• Automation flows and chatbot integration
• CRM integrations including Zapier, Make, Monday.com, and Bitrix24
• GDPR compliance tooling and consent management
• Multi-user team management with role-based access control
• API access and custom integration capabilities

Support Services

• Technical support and platform documentation
• Onboarding assistance and training
• Message Template approval guidance and compliance consultation
• Dedicated account management (enterprise plans)

The Customer acknowledges that WhatsApp Business Platform access is provided by Meta Platforms Ireland Limited. Arino One acts solely as an authorised Solution Partner. Meta may independently suspend, restrict, or terminate a Customer's WhatsApp Business Account at any time for any violation of Meta's policies. Meta's WhatsApp Business Platform Terms, Commerce Policy, and messaging policies are incorporated into this Agreement by reference and take precedence over Arino One's terms in all matters relating to WhatsApp platform usage.

4Free Account & Credit System

Free Account Benefits

• No credit card required to activate a free account
• Full platform access is available from the date of registration
• Credits refresh on the first day of each calendar month

Credit Usage & Limitations

• Credits are consumed by messaging activities as defined in the current credit schedule available on the Platform
• Unused credits do not roll over and expire at the end of each monthly cycle
• All platform features remain available within credit limits
• Users must comply with all terms of this Agreement and all Meta policies at all times
• Data, contact lists, and configurations are preserved during periods of inactivity unless the account is terminated for policy violations
• Arino One reserves the right to revoke or modify free account benefits at any time with 30 days notice

Conversation-Based Pricing Model

• A Conversation is a 24-hour session initiated either by the business or the user
• Business-initiated conversations (using Message Templates) are priced differently from user-initiated conversations
• Conversation categories include Marketing, Utility, Authentication, and Service conversations, each with different applicable rates
• Free entry point conversations (initiated via Click-to-WhatsApp ads or Facebook Page CTAs) may attract different pricing as determined by Meta
• Customers may upgrade to paid subscription plans for additional credits and enhanced features
• Full SLA coverage as described in Section 5 is available on paid plans only

5Service Level Agreement (SLA)

SLA commitments apply to paid subscribers only. Free account users are not covered by the SLA but will benefit from Arino One's best-efforts service delivery.

Platform Availability

• 99.9% uptime guarantee for paid subscribers, measured monthly
• Maximum permitted downtime: 8.77 hours per calendar year, excluding scheduled maintenance windows
• Scheduled maintenance communicated at least 48 hours in advance
• Real-time platform status monitoring at status.arino.one

Support Response Times

• Critical Issues (platform down, data breach): 2-hour response, 8-hour resolution target
• High Priority (major feature outage): 8-hour response, 24-hour resolution target
• Standard Requests (feature issues, queries): 24-hour response, 72-hour resolution target
• General Inquiries (billing, onboarding): 48-hour response

Message Delivery Performance

• 99.5% message delivery success rate target for all sent messages
• Average message processing time of under 30 seconds under normal load
• Real-time delivery status reporting and webhooks available
• Automatic retry mechanisms for failed messages where technically feasible

SLA Remedies

• Service credits issued for sustained downtime exceeding SLA thresholds, calculated as a percentage of monthly fees proportional to excess downtime
• Detailed incident reports provided for all service disruptions exceeding 30 minutes
• Proactive communication during all active service incidents
• Service credits constitute the sole and exclusive remedy for SLA breaches

6User Obligations & Compliance

General Compliance

• Comply with all applicable laws and regulations in the jurisdictions in which the Customer operates
• Follow WhatsApp Business Policy, Commerce Policy, and all Meta Developer Platform Terms
• Maintain full GDPR compliance and all applicable EU data protection obligations
• Respect all applicable intellectual property rights
• Maintain accurate and up-to-date business information on the Platform

WhatsApp Opt-In Requirements (Mandatory)

• Obtain explicit, granular, and freely given prior consent from each End User before sending any WhatsApp messages
• Ensure that opt-in clearly states the Customer's business name and that the End User will receive messages via WhatsApp
• Obtain separate consent for each distinct message type or purpose (e.g., marketing, transactional alerts, support)
• Implement and maintain a clear, simple, and functional opt-out mechanism in every communication
• Maintain verifiable records of all opt-in consent, including the date, method, and content of consent
• Immediately honour opt-out requests and cease messaging within 24 hours of receiving an opt-out signal
• Never send messages to End Users who have previously opted out, except to confirm their opt-out status

Message Template Compliance

• All business-initiated messages must use Meta-approved Message Templates (HSMs)
• Customers are responsible for the accuracy, legality, and compliance of all template content
• Templates must accurately describe the message content and must not be used for unapproved purposes
• Templates may not be materially altered after approval without resubmission to Meta
• Customers must ensure that templates comply with the correct category (Marketing, Utility, Authentication)

WhatsApp Phone Number Quality Rating

• Meta assigns a quality rating (High, Medium, or Low) to each WhatsApp Business phone number based on End User feedback
• A rating of 'Low' may result in restrictions on message sending limits or Meta disabling the phone number
• Arino One reserves the right to temporarily restrict message sending if a Customer's quality rating falls to 'Low'
• Customers whose phone numbers are disabled by Meta due to policy violations may not be eligible for refunds of prepaid credits

Account Security

• Maintain the security of all account credentials and access tokens
• Implement and enforce strong password policies for all Platform users
• Enable two-factor authentication (2FA) where available (strongly recommended)
• Notify Arino One immediately at security@arino.one upon discovery of any unauthorised access
• Regularly review and audit user roles and access permissions

7Acceptable Use Policy & Prohibited Activities

Strictly Prohibited Activities

• Sending unsolicited commercial messages (spam) or messages without valid WhatsApp opt-in consent
• Distributing malware, viruses, phishing links, ransomware, or any harmful content
• Impersonating any person, business, government entity, or brand
• Violating any applicable intellectual property rights
• Harassing, threatening, abusing, defaming, or discriminating against any message recipient
• Circumventing or attempting to circumvent rate limits, messaging thresholds, or technical restrictions
• Interfering with or attempting to gain unauthorised access to Platform operations or security systems
• Engaging in or facilitating any illegal or unlawful activity
• Using the Platform for automated or bulk messaging without proper opt-in consent
• Reselling Platform access or API credentials to any third party without Arino One's prior written consent

Prohibited Content Categories (Meta WhatsApp Commerce Policy)

• Adult content, adult entertainment, or sexually explicit material
• Tobacco products, e-cigarettes, vaping products, or related paraphernalia
• Illegal drugs, controlled substances, or drug paraphernalia
• Prescription-only medicines or health products making unsubstantiated medical claims
• Weapons, ammunition, firearms, explosives, or items designed to harm individuals
• Gambling, betting, or gaming services (unless specifically approved by Meta)
• Financial products or services without relevant regulatory authorisation
• Multi-level marketing (MLM) schemes, pyramid schemes, or deceptive business opportunities
• Counterfeit goods, replica items, or products infringing third-party IP rights
• Political advertising, political fundraising, or issue-based advocacy campaigns
• Content targeting minors inconsistent with child protection laws or Meta's policies

Enforcement Actions

• Immediate suspension of message sending pending investigation
• Permanent account suspension or termination without refund
• Reporting violations to Meta, which may result in independent enforcement including phone number disablement
• Referral to relevant law enforcement authorities or regulatory bodies where required by law
• Legal action for material, repeated, or egregious violations

8Payment Terms & Billing

Billing Structure

• Subscription fees charged monthly or annually as agreed in the applicable order form
• Message volume charges calculated based on applicable usage tier and conversation category pricing
• All fees denominated in Euro (EUR) unless otherwise specified
• Additional charges apply for premium integrations or features as set out in the service agreement
• All fees are exclusive of VAT and any other applicable taxes

Payment Terms

• Payment due within 14 days of the invoice date unless otherwise agreed in writing
• Credit card payments processed automatically on the billing date
• Bank transfer payments require 7 days advance notice and must reference the invoice number
• Late payment interest may be applied in accordance with the EU Late Payments Directive (2011/7/EU) after 30 days overdue
• Access may be suspended for accounts with outstanding invoices more than 60 days overdue

Pricing Changes

• 90 days advance written notice of any changes to subscription fees
• Message pricing updates arising from Meta's own pricing with minimum 30 days notice
• Grandfathered pricing honoured for existing fixed-term contracts until end of contracted term
• Customers who do not accept pricing changes may terminate during the notice period

Refund Policy

• Subscription fees paid in advance are non-refundable except where required by applicable law
• Credits consumed prior to termination are non-refundable
• Unused prepaid credits at termination may be refunded on a pro-rata basis at Arino One's discretion

9Data Handling, Privacy & Data Processing Agreement

This section constitutes the Data Processing Agreement (DPA) required under Article 28 of the GDPR. By entering into this Agreement, the Customer (as Controller) appoints Arino One (as Processor) to process Personal Data on its behalf under the terms set out below.

Roles & Responsibilities

• The Customer acts as the Data Controller in respect of all Personal Data relating to its End Users
• Arino One acts as the Data Processor, processing Personal Data solely on behalf of and under the documented instructions of the Customer
• Where Arino One independently determines the purposes and means of any data processing, Arino One shall be deemed a Data Controller

Arino One's Obligations as Processor

• Process Personal Data only on documented instructions from the Customer
• Ensure persons authorised to process Personal Data are subject to confidentiality obligations
• Implement appropriate technical and organisational security measures (Article 32 GDPR)
• Assist the Customer in responding to data subject rights requests under Chapter III GDPR
• Assist the Customer in ensuring compliance with Articles 32-36 GDPR
• Upon termination, delete or return all Personal Data at the Customer's choice
• Make available all information necessary to demonstrate compliance and allow for audits

Authorised Sub-Processors

• Meta Platforms Ireland Limited — WhatsApp Business Platform infrastructure, message routing, and delivery
• Zapier Inc. — Workflow automation and CRM integration (where enabled by Customer)
• Make (formerly Integromat) — Workflow automation and CRM integration (where enabled by Customer)
• Monday.com Ltd. — CRM integration and project management (where enabled by Customer)
• Bitrix24 — CRM integration and team collaboration (where enabled by Customer)

International Data Transfers

• Meta processes data globally including outside the EEA, relying on Standard Contractual Clauses (SCCs) under Article 46(2)(c) GDPR
• Transfers by Arino One or Sub-Processors outside the EEA are conducted only with appropriate safeguards under Chapter V GDPR
• Details of applicable transfer mechanisms available upon written request to legal@arino.one

Data Retention & Deletion

• Message data retained for 12 months following the date of the message, then securely deleted or anonymised
• Account data retained for the duration of the Agreement and 30 days following termination
• Aggregated and anonymised analytics data may be retained indefinitely for platform improvement
• Financial and billing records retained for minimum 7 years per Irish Revenue requirements
• Consent records retained for minimum 3 years following the last relevant consent event
• Customer data exportable in standard format within 30 days upon written request following termination

Data Subject Rights

• Right of access (Article 15): Obtain confirmation of processing and a copy of Personal Data
• Right to rectification (Article 16): Have inaccurate Personal Data corrected
• Right to erasure (Article 17): Have Personal Data deleted ('right to be forgotten')
• Right to restriction (Article 18): Restrict processing in certain circumstances
• Right to data portability (Article 20): Receive Personal Data in a structured, machine-readable format
• Right to object (Article 21): Object to processing for legitimate interests or direct marketing

Data Breach Notification

• Arino One will notify the Customer without undue delay, within 72 hours of becoming aware of any Personal Data breach
• Notification will include the nature of the breach, categories and number of data subjects affected, likely consequences, and measures taken
• The Customer is responsible for assessing whether a breach requires notification to the DPC and/or affected End Users

10Intellectual Property Rights

Arino One Intellectual Property

• All Platform software, features, innovations, source code, and user interfaces are the exclusive intellectual property of Arino One
• All trademarks, logos, trading names, and branding elements are protected by Irish and EU trade mark law
• Platform documentation, training materials, and published guides are protected by copyright
• API specifications, integration tools, and proprietary methodologies are confidential and proprietary
• No licence to any Arino One intellectual property is granted except as expressly set out in this Agreement

Customer Intellectual Property

• Customers retain all rights, title, and interest in their business content, message copy, brand assets, and Customer data
• The Customer grants Arino One a limited, non-exclusive, royalty-free licence to use Customer content solely for providing Platform services
• The Customer is solely responsible for ensuring all content submitted complies with applicable law and does not infringe third-party IP rights
• Arino One will provide reasonable backup and data recovery services for Customer data

11Limitation of Liability

To the maximum extent permitted by applicable Irish and EU law, Arino One and the Customer shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to: loss of profits, loss of data, loss of business opportunities, loss of revenue, loss of goodwill, or business interruption.

Liability Limitations

• For both parties, the total aggregate liability shall not exceed fees paid by the Customer in the 12-month period preceding the claim
• Nothing excludes the parties' liability for death or personal injury caused by negligence, fraud, or fraudulent misrepresentation
• Arino One's liability as a Data Processor under the GDPR shall be governed by applicable data protection law, and the Customer's liability as a Data Controller under the GDPR shall be governed by applicable data protection law
• Force majeure events for both parties (acts of God, pandemics, government acts, cyberattacks, Meta platform failures) exclude liability
• Each party shall notify the other promptly of any Force Majeure Event and use reasonable endeavours to mitigate its effects

12Termination & Contract End

Customer Termination

• 30 days written notice to legal@arino.one required for contract termination
• Immediate cancellation of future-dated campaigns available through the Platform interface
• Refunds of prepaid subscription fees subject to the refund policy in Section 8.4
• Customer data remains available for export for 30 days following termination
• All outstanding fees remain due and payable following termination

Arino One Termination Rights

• Immediate termination for material policy violations (Section 6 or Section 7) or violations of Meta's platform policies
• 30 days written notice for non-payment or material breach of any other term
• Suspension of Platform access without notice for urgent security or compliance issues
• Service discontinuation with 90 days advance written notice with pro-rata refunds where applicable

Post-Termination

• All Platform access and API credentials deactivated on the effective termination date
• Customer data securely deleted following applicable retention periods in Section 9 (Data Retention & Deletion)
• All payment obligations, limitations of liability, IP provisions, and data protection obligations survive termination
• Any confidential information of either party must be returned or destroyed upon request

13Confidentiality

Each party agrees to keep confidential all non-public information of the other party that is designated as confidential or that should reasonably be understood to be confidential.

• Each party will use Confidential Information only as necessary to perform obligations under this Agreement
• Each party will use at least the same degree of care for the other's Confidential Information as for its own
• Confidentiality obligations do not apply to information that: (a) is publicly available, (b) was previously known, (c) is independently developed, or (d) is required to be disclosed by law
• Confidentiality obligations survive termination for a period of 5 years

14Governing Law & Dispute Resolution

This Agreement and any disputes or claims arising out of or in connection with it shall be governed by and construed in accordance with the laws of the Republic of Ireland and, where applicable, the laws of the European Union.

Dispute Resolution

• Good faith negotiation for 30 days following written notice identifying the dispute
• Mediation through the Irish Commercial Mediation Centre (ICMC) or another mutually agreed mediation service
• Exclusive jurisdiction of the courts of Ireland if mediation is unsuccessful
• EU-wide enforcement of Irish court judgments under applicable EU regulations
• Nothing prevents either party from seeking emergency or interim relief from any court of competent jurisdiction

15General Provisions

• Entire Agreement: This Agreement constitutes the entire agreement between the parties and supersedes all prior agreements
• Severability: If any provision is found unenforceable, the remaining provisions continue in full force
• Waiver: Failure to enforce any provision does not constitute a waiver of the right to enforce it in the future
• Assignment: The Customer may not assign rights without Arino One's prior written consent
• Notices: All legal notices must be in writing and sent to the addresses set out in Section 17
• Relationship: The parties are independent contractors; no partnership, joint venture, or employment relationship is created
• Language: This Agreement is executed in English, which governs in the event of any conflict with translations

16Changes to Terms

Arino One may modify this Agreement from time to time to reflect changes in our services, legal requirements, or business practices.

Notification Process

• Material changes communicated to Customers via email at least 30 days before changes take effect
• Platform notifications accompany all significant updates
• Updated terms posted at arino.one/terms with a revision date
• Continued use after the effective date constitutes acceptance of updated terms
• Customers who do not accept material changes may terminate without penalty during the notice period

17Contact Information

For questions about these terms or our services:

1Dedicated, single-tenant instances

Every client runs on a dedicated instance with its own database, authentication and Infobip boundary. Full row-level security means no shared tenancy — your data is not co-mingled with another customer's at any layer of the stack.

Because your instance is yours, a GDPR export or erasure scopes cleanly to one workspace — no cross-tenant untangling. The code is yours too: export it, or take the whole instance with you.

2Encryption in transit and at rest

All traffic between clients, the Arino One platform, Infobip and downstream channel providers is transported over encrypted channels (TLS). Message content, contact records and credentials are stored on encrypted volumes on the underlying regional database (EU by default).

3Regional hosting

Every instance is engineered in the EU and deployed in the region you choose — EU by default, with North America and APAC available for regulated global rollouts. See EU data residency for the GDPR alignment in detail, or Global coverage for regional options.

4Access controls & audit logging

Role-based access control and audit logging are built into the core platform on every instance:

• Role-based access control over who can see and act inside the Conversational Studio.
• Audit logging across privileged actions so changes are traceable.
• Consent events recorded alongside contact records.
• Data-flow logging across the messaging path — inbound, outbound and channel transitions.
• Scoped per instance — no cross-tenant visibility.

5Penetration testing & independent review

The platform is subject to periodic penetration testing in line with Meta Platform Terms and GDPR Article 32 obligations. Findings are triaged, remediated and re-tested; a summary is available to enterprise customers under NDA on request to security@arino.one.

6Data-subject rights & erasure

Every instance ships with the GDPR rights engine described in the Privacy Policy — Article 15 access, Article 20 portability and Article 17 erasure are native controls, not paperwork.

Anyone whose personal data sits on an Arino One instance can submit an erasure request through the self-service form at arino.one/erase. Identity is verified before the request is executed against the instance and a written confirmation is returned.

7Responsible disclosure

Found a vulnerability? Please report it privately so we can fix it before it is disclosed publicly. Email security@arino.one with a description, reproduction steps and any proof-of-concept. We will acknowledge your report and keep you informed through remediation.

1Where your data lives

Every Arino One instance is engineered and hosted in the EU. Customer conversations, contact records and the CDP behind them stay within EU infrastructure.

2GDPR alignment

The same GDPR engine described on the homepage compliance section ships on every instance:

• Consent management for opt-in and opt-out flows.
• Article 20 data portability — export a contact's data in a machine-readable format.
• Article 17 right to erasure — submit an erasure request to delete a contact and the conversations attached to them.
• Audit logging across privileged actions and consent events.
• Row-level security as a primitive, not a bolt-on.

3Single-tenant isolation

Every client runs on a dedicated instance with its own database, authentication and Infobip boundary. No shared tenancy means a GDPR request, a data export or an erasure scopes cleanly to your instance.