Privacy Policy
Last updated: March 1, 2026
1. Who We Are
AROG AI is an AI automation agency based in Warsaw, Poland.
- Website: https://arogai.net
- Contact:
2. What Data We Collect
| Data Type | What We Collect | How | Why |
|---|---|---|---|
| Contact form | Name, email, company, message | Form submission | Respond to your inquiry |
| Booking data | Name, email, meeting details | a contracted scheduling service | Schedule consultations |
| Website analytics | Pages visited, clicks, scroll depth, device info | consent-gated analytics | Improve our website |
| Cookie preferences | Your consent choices | Cookie/localStorage | Remember your preferences |
| Voice demo | Live-processed conversation audio and encrypted transcript | Real-time via the contracted voice infrastructure | Provide live AI demo |
| Rate limiting | IP hash, browser fingerprint | Automatic | Prevent abuse |
| AI tool usage | Descriptions entered, selections made | Form input | Provide recommendations |
2A. Personal Data of Third Parties in Uploaded Documents
When you upload commercial lease documents, those documents may contain personal data of third parties — such as tenants, landlords, guarantors, and authorized representatives.
As the person uploading these documents, you (the Controller) are responsible for:
- Having a lawful basis to share this data with AROG AI
- Informing the relevant data subjects that their data will be processed by AROG AI for the purpose of data extraction
- Responding to any data subject requests from those individuals
AROG AI processes this data solely for the purpose of extraction and does not use it for any other purpose. Documents containing third-party data are automatically deleted within 7 days.
If you are a data subject whose data appears in a document processed by AROG AI and you wish to exercise your rights, please contact us at and we will work with the relevant Controller to address your request.
3. Legal Bases (GDPR Art. 6)
- Consent: Analytics cookies, marketing cookies
- Legitimate interest: Abuse prevention, security, service improvement
- Contract performance: Contact form responses, booking consultations
4. Voice Demo Notice
When you use "Talk to Maya" (our voice demo):
- Audio is streamed in real-time to the contracted voice infrastructure for processing
- AROG AI does not record or store conversation audio
- the contracted voice infrastructure processes audio in real-time and does not retain recordings beyond the active session
- The encrypted transcript is retained for 30 days, or 90 days when the conversation is classified as a potential lead
- Your microphone is accessed only when you click the demo button and only for the duration of the demo
4A. Artificial Intelligence Processing
We use AI models to process your documents:
- a) OCR Processing: A contracted document-processing service reads text from uploaded PDFs. This is automated data extraction, not decision-making.
- b) AI Extraction: A contracted AI model extracts structured data fields from the OCR text. The model identifies entities (landlord names, tenant names), financial terms, dates, and legal clauses from your lease documents.
- c) AI Classification: For AI Act due diligence scanning, an AI model classifies systems found in documents by EU AI Act risk tier.
- d) Accuracy Limitations: AI extraction is typically 95%+ accurate on structured fields but is NOT guaranteed. All outputs include confidence scores. You MUST verify extracted data before relying on it for legal, financial, or business decisions.
- e) No Automated Decision-Making: We do not use AI outputs to make decisions that produce legal effects concerning you (GDPR Art. 22). All outputs are informational tools for human review.
- f) AI Training: Your documents are NEVER used by AROG AI to train models. Provider handling is governed by the applicable processing agreement and contracted retention controls.
- g) Human Review: Documents with confidence scores below 95% are routed to a human review queue for manual verification before results are delivered.
5. External Service Categories
| Category | Purpose |
|---|---|
| Consent-gated analytics | Website measurement after consent |
| Meeting scheduling | Booking requested meetings |
| Browser voice demo | Interactive voice demonstration |
6. Service Provider Categories
We use contracted providers only where needed to deliver the service. The current provider schedule is supplied privately to affected customers before processing begins.
| Category | Purpose | Processing Region | Safeguard |
|---|---|---|---|
| Database infrastructure | Primary database | EEA | Contractual and regional controls |
| Application infrastructure | Hosting and delivery | EEA and approved regions | DPA and SCCs where required |
| AI and document processing | OCR and text analysis | EEA and approved regions | DPA and SCCs where required |
| Transactional communications | Service email | Approved regions | DPA and SCCs where required |
| Payment processing | Payments | EEA and approved regions | DPA, SCCs and industry controls |
| Consent-gated analytics | Website measurement | Approved regions | Consent and transfer safeguards |
The current contracted-provider schedule is supplied privately to affected customers before processing begins and updated by written notice under the applicable DPA.
7. Your Rights (GDPR)
You have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase your data ("right to be forgotten")
- Restrict processing
- Data portability
- Object to processing
- Withdraw consent at any time
- Right to restriction of processing: request that we limit how we use your data while a complaint or dispute is being resolved. During restriction, we will store but not further process the data. (Art. 18)
- Right to not be subject to automated decision-making: Our AI processing does not produce decisions with legal effects. All outputs require human verification. (Art. 22)
To exercise any of these rights, contact us at . We will respond within 30 days.
You also have the right to lodge a complaint with the Polish Data Protection Authority (UODO): https://uodo.gov.pl
Withdrawing consent: You may withdraw consent to document processing at any time by deleting your account via the Dashboard. Withdrawal does not affect lawfulness of prior processing.
8. Data Retention
| Data | Retention Period |
|---|---|
| Contact form submissions | Until inquiry resolved + 12 months |
| Scheduling records | Per the contracted retention policy |
| Analytics data | 14 months (configured analytics retention) |
| Voice demo audio | Not stored by AROG AI |
| Encrypted voice demo transcript | 30 days; 90 days for a potential lead |
| Rate limiting data (IP/fingerprint) | 24 hours |
| Cookie preferences | 12 months |
See also our Data Processing Agreement . Current provider details are supplied privately under the applicable DPA. Enterprise clients may request a customized DPA.
9. Cookies We Use
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| cookie_consent | Essential | Stores your cookie consent choice | 12 months |
| _ga | Analytics | Analytics visitor distinction | 2 years |
| _ga_* | Analytics | Analytics session state | 2 years |
Analytics cookies are only set after you explicitly accept them via our cookie consent banner.
10. International Data Transfers
Analytics data may be processed in the United States under the EU-US Data Privacy Framework.
11. Changes to This Policy
We will post any updates on this page with an updated date. We encourage you to review this page periodically.