Skip to main content

Privacy Policy

Last updated: March 1, 2026

1. Who We Are

AROG AI is an AI automation agency based in Warsaw, Poland.

2. What Data We Collect

Data TypeWhat We CollectHowWhy
Contact formName, email, company, messageForm submissionRespond to your inquiry
Booking dataName, email, meeting detailsa contracted scheduling serviceSchedule consultations
Website analyticsPages visited, clicks, scroll depth, device infoconsent-gated analyticsImprove our website
Cookie preferencesYour consent choicesCookie/localStorageRemember your preferences
Voice demoLive-processed conversation audio and encrypted transcriptReal-time via the contracted voice infrastructureProvide live AI demo
Rate limitingIP hash, browser fingerprintAutomaticPrevent abuse
AI tool usageDescriptions entered, selections madeForm inputProvide recommendations

2A. Personal Data of Third Parties in Uploaded Documents

When you upload commercial lease documents, those documents may contain personal data of third parties — such as tenants, landlords, guarantors, and authorized representatives.

As the person uploading these documents, you (the Controller) are responsible for:

  • Having a lawful basis to share this data with AROG AI
  • Informing the relevant data subjects that their data will be processed by AROG AI for the purpose of data extraction
  • Responding to any data subject requests from those individuals

AROG AI processes this data solely for the purpose of extraction and does not use it for any other purpose. Documents containing third-party data are automatically deleted within 7 days.

If you are a data subject whose data appears in a document processed by AROG AI and you wish to exercise your rights, please contact us at and we will work with the relevant Controller to address your request.

3. Legal Bases (GDPR Art. 6)

  • Consent: Analytics cookies, marketing cookies
  • Legitimate interest: Abuse prevention, security, service improvement
  • Contract performance: Contact form responses, booking consultations

4. Voice Demo Notice

When you use "Talk to Maya" (our voice demo):

  • Audio is streamed in real-time to the contracted voice infrastructure for processing
  • AROG AI does not record or store conversation audio
  • the contracted voice infrastructure processes audio in real-time and does not retain recordings beyond the active session
  • The encrypted transcript is retained for 30 days, or 90 days when the conversation is classified as a potential lead
  • Your microphone is accessed only when you click the demo button and only for the duration of the demo

4A. Artificial Intelligence Processing

We use AI models to process your documents:

  • a) OCR Processing: A contracted document-processing service reads text from uploaded PDFs. This is automated data extraction, not decision-making.
  • b) AI Extraction: A contracted AI model extracts structured data fields from the OCR text. The model identifies entities (landlord names, tenant names), financial terms, dates, and legal clauses from your lease documents.
  • c) AI Classification: For AI Act due diligence scanning, an AI model classifies systems found in documents by EU AI Act risk tier.
  • d) Accuracy Limitations: AI extraction is typically 95%+ accurate on structured fields but is NOT guaranteed. All outputs include confidence scores. You MUST verify extracted data before relying on it for legal, financial, or business decisions.
  • e) No Automated Decision-Making: We do not use AI outputs to make decisions that produce legal effects concerning you (GDPR Art. 22). All outputs are informational tools for human review.
  • f) AI Training: Your documents are NEVER used by AROG AI to train models. Provider handling is governed by the applicable processing agreement and contracted retention controls.
  • g) Human Review: Documents with confidence scores below 95% are routed to a human review queue for manual verification before results are delivered.

5. External Service Categories

CategoryPurpose
Consent-gated analyticsWebsite measurement after consent
Meeting schedulingBooking requested meetings
Browser voice demoInteractive voice demonstration

6. Service Provider Categories

We use contracted providers only where needed to deliver the service. The current provider schedule is supplied privately to affected customers before processing begins.

CategoryPurposeProcessing RegionSafeguard
Database infrastructurePrimary databaseEEAContractual and regional controls
Application infrastructureHosting and deliveryEEA and approved regionsDPA and SCCs where required
AI and document processingOCR and text analysisEEA and approved regionsDPA and SCCs where required
Transactional communicationsService emailApproved regionsDPA and SCCs where required
Payment processingPaymentsEEA and approved regionsDPA, SCCs and industry controls
Consent-gated analyticsWebsite measurementApproved regionsConsent and transfer safeguards

The current contracted-provider schedule is supplied privately to affected customers before processing begins and updated by written notice under the applicable DPA.

7. Your Rights (GDPR)

You have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Erase your data ("right to be forgotten")
  • Restrict processing
  • Data portability
  • Object to processing
  • Withdraw consent at any time
  • Right to restriction of processing: request that we limit how we use your data while a complaint or dispute is being resolved. During restriction, we will store but not further process the data. (Art. 18)
  • Right to not be subject to automated decision-making: Our AI processing does not produce decisions with legal effects. All outputs require human verification. (Art. 22)

To exercise any of these rights, contact us at . We will respond within 30 days.

You also have the right to lodge a complaint with the Polish Data Protection Authority (UODO): https://uodo.gov.pl

Withdrawing consent: You may withdraw consent to document processing at any time by deleting your account via the Dashboard. Withdrawal does not affect lawfulness of prior processing.

8. Data Retention

DataRetention Period
Contact form submissionsUntil inquiry resolved + 12 months
Scheduling recordsPer the contracted retention policy
Analytics data14 months (configured analytics retention)
Voice demo audioNot stored by AROG AI
Encrypted voice demo transcript30 days; 90 days for a potential lead
Rate limiting data (IP/fingerprint)24 hours
Cookie preferences12 months

See also our Data Processing Agreement . Current provider details are supplied privately under the applicable DPA. Enterprise clients may request a customized DPA.

9. Cookies We Use

CookieTypePurposeDuration
cookie_consentEssentialStores your cookie consent choice12 months
_gaAnalyticsAnalytics visitor distinction2 years
_ga_*AnalyticsAnalytics session state2 years

Analytics cookies are only set after you explicitly accept them via our cookie consent banner.

10. International Data Transfers

Analytics data may be processed in the United States under the EU-US Data Privacy Framework.

11. Changes to This Policy

We will post any updates on this page with an updated date. We encourage you to review this page periodically.