Privacy Policy

Version 1.7

Effective Date: 2026-10-16

Controller: Aria Coda LLC, a Texas limited liability company.

Aria Coda LLC is committed to data minimization and the protection of your personal information. This Privacy Policy is drafted to meet the stringent standards of the General Data Protection Regulation (GDPR) and applies universally to all users of the Platform.

§1. Data We Collect, Process, and Our Lawful Basis

To comply with global transparency requirements, we process specific categories of data strictly for defined purposes, relying on the following lawful bases:

Account Data & Active Negotiation Data: For Issuers and Receivers who have accepted our Terms of Use, we process identity and negotiation data on the basis of Contractual Necessity to provide the Platform's core services.
Invited Receivers & Third-Party Contract Data: We process the personal data of invited Receivers (prior to their acceptance of the Terms) and incidental third parties named within contract bodies (e.g., notice contacts, signatories) on the basis of our Legitimate Interests in facilitating B2B commercial agreements.
Negotiation Consent Records: For negotiations that produce a finalized draft agreement, we retain a record of the specific consents each party gave during the negotiation (see §5) on the basis of our Legitimate Interests in establishing, exercising, or defending legal claims.
Notice of LIA: A Legitimate Interests Assessment (LIA) is maintained on file. You have the specific right to object to this processing (see §6).
Indirect Collection (Article 14): For third parties whose data is incidentally collected within contract documents, Aria relies on the exemption under GDPR Article 14(5)(b), as providing individual notice would require disproportionate effort and impair the confidentiality of our users' commercial negotiations.
Payment Data: Transaction records and account balances (processed by Stripe) are retained to process run fees and manage top-up credits on the basis of Contractual Necessity and Legal Obligation (to comply with applicable tax and accounting laws).
Technical and Usage Data: IP addresses, basic server logs, and essential session cookies are processed to prevent fraud and ensure the foundational security of the Platform. Additionally, Aria processes aggregate, non-content server-side telemetry (such as negotiation outcome status, feature usage, and processing metrics—never the content of your documents or negotiations) to monitor and improve service reliability. All such processing is conducted on the basis of our Legitimate Interests. When a link to Aria identifies where it was published (such as an advertisement or an email), we store that source information with any account created during that same visit. We also store the timestamp of when an invitation link sent to you is first accessed (which may occur automatically via your email provider's security scanner) and when it is actively used to continue into Aria. We process this information under our legitimate commercial interest to measure which sources lead to signups, negotiations, and payments. We do not use cookies, store anything on your device, or use third-party trackers for this purpose. This information is deleted when your account is deleted. Aria does not drop non-essential tracking or analytics cookies on your device.

§2. The AI Negotiation Flow & Data Minimization (ARCH-10)

Aria's architecture enforces strict data minimization to protect your identity during AI processing.

Role-Labeling: We utilize local role-labeling so structured personal data (names, registered addresses) is never transmitted to our AI model providers. Real party names, addresses, and commercial schedules are reconstituted only within Aria's own secure infrastructure and appear only in the final documents generated for you.
Residual Data & AI Providers: Residual free-text personal data (such as names or contact details typed into free-text fields) is processed by our third-party AI providers in accordance with their respective data processing terms, subject to limited provider-side retention for abuse monitoring, security, and legal compliance.

§3. Infrastructure & AI Sub-Processors

Aria Coda LLC utilizes essential sub-processors to operate the Platform. We maintain standard Data Processing Agreements (DPAs) with all vendors:

Infrastructure & Operations: DigitalOcean, LLC (Hosting), SignWell, Inc. (E-signatures), and AC PM, LLC (Transactional email).
Payment Processing: Stripe, Inc.
AI Model Providers: Anthropic PBC / Anthropic Ireland Limited, OpenAI OpCo, LLC, and Google LLC (processing for contract negotiation; subject to limited provider-side retention for abuse monitoring, security, and legal compliance, as set out in each provider's data processing terms).

§4. International Data Transfers

Aria Coda LLC is headquartered in the United States. To provide the Platform's automated negotiation services, personal data originating from the European Economic Area (EEA), the United Kingdom (UK), and other global jurisdictions will be transferred to, and processed by, our authorized sub-processors located in the US.

To ensure these cross-border transfers are lawful and maintain a substantially equivalent level of data protection, we implement the following transfer mechanisms:

EEA and Switzerland: We strictly rely on the European Commission's approved Standard Contractual Clauses (SCCs) for all transfers to US-based sub-processors.
United Kingdom: We rely on the UK Information Commissioner's Office International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs.
APAC, Canada, and Other Jurisdictions: We implement comparable-protection measures and execute contractual safeguards as required by applicable regional privacy frameworks (including PIPEDA, the Australian Privacy Act 1988, and the Singapore PDPA).

§5. Data Retention and Deletion

Aria Coda LLC enforces a strict, tiered data minimization protocol designed to protect the legal interests of our users while limiting unnecessary data exposure:

Account Data & Deliverables: Standard account information and the final, unsigned deliverables generated by the Platform (the finalized draft agreement, redlines, and plain-English summaries) are retained for the active lifespan of your account. Upon account deletion, this data is securely purged within 90 days.
Working Negotiation Data: To protect your strategic commercial interests, all transient process data—including private negotiating ranges, playbooks, AI prompts, and round-by-round negotiation transcripts—is automatically pruned and permanently deleted 90 days after a negotiation session concludes, except the Negotiation Consent Records described below.
Negotiation Consent Records: When a negotiation between two parties produces a finalized draft agreement, Aria keeps a record of the consents each party gave during it, for seven (7) years following that negotiation: consent to share a stated position with the other party; consent to lift one of that party's own red lines, together with the text of that red line as it stood when it was lifted; and consent to ask for, send, or accept a proposed compromise. Each consent is recorded with the party's role (Issuer or Receiver), the time it was given, and its outcome. The record contains no names and does not include the text of a shared position. It is retained, including after account deletion, so that what each party consented to on the way to the agreement can be shown if that agreement is later disputed, on the basis of our Legitimate Interests in establishing, exercising, or defending legal claims. Negotiations that do not produce a finalized draft agreement, and simulations, keep no such record.
Transaction Metadata: Core transaction records (such as the database record of the negotiation, user IDs, timestamps, and billing/tax data) are retained for seven (7) years following the transaction date or the completed negotiation (whichever applies) to protect Aria's legal interests regarding breach-of-contract limitation periods and service validation.
Note: Aria does not durably store the finalized, executed contract PDF or the parties' private pre-signing negotiation parameters, other than the text of a red line a party chose to lift, which is kept in that negotiation's consent record. If you utilize our optional e-signature integration, final execution and long-term document retention are facilitated directly through our provider (SignWell). If you elect to download the finalized draft for independent execution, Aria retains no record of the ultimately executed agreement.

§6. Your Data Rights & Representatives

Depending on your jurisdiction, you have the right to access, correct, delete, or restrict the processing of your personal data, as well as the right to data portability. To exercise these rights, please contact us at privacy@ariacoda.com.

Right to Object: You have the explicit right to object to any processing of your personal data that we conduct based on Legitimate Interests.
Right to Complain: If you are located in the EU or UK, you have the right to lodge a complaint regarding our processing of your personal data with your local data protection supervisory authority.
EU/UK Article 27 Representatives: Because Aria Coda LLC is located outside of the EU and UK, we have appointed Data Protection Representative Limited (trading as DataRep), registered in Ireland under company number 616588, to act as our Data Protection Representative and our direct point of contact for data subjects and supervisory authorities. You may contact our Representative directly on any matter relating to the processing of your personal data.
By email: datarequest@datarep.com — please quote "Aria Coda LLC" in the subject line.
Online: www.datarep.com/data-request
EU Representative (post): DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland
UK Representative (post): DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom
Please note: when writing by post, address your letter to DataRep and not to Aria Coda LLC, and refer to Aria Coda LLC in your correspondence. DataRep maintains an address in every EU/EEA member state; if you would prefer to write to the representative in your own country, contact us at privacy@ariacoda.com and we will provide the address.
Singapore: We have designated a data protection contact for matters relating to the Singapore Personal Data Protection Act. Please contact privacy@ariacoda.com.