How AROS handles your information

AROS (“AROS”, “we”, “us”, or “our”) is a hiring coordination platform operated by the AROS team. This Privacy Policy describes how we collect, use, and protect personal information you share with us through our marketing site (getaros.ai and subdomains), our application, and any direct communications with our team.

From the Early Access form on our public site:

• Name
• Work email
• Company name
• Job title
• Approximate hires per year (optional)
• Your biggest hiring challenge (optional, free text)
• Your stated interest (early access / demo / Validation Program)
• Submission timestamp, IP address, and browser user-agent (for abuse prevention)

If you become a customer or program participant, we additionally process:

• Account information (email, hashed password, role, organisation)
• Application content you create (job postings, hiring criteria, decision notes)
• Candidate data that your organisation uploads or imports into AROS — see “Candidate data processed on behalf of employers” below
• Audit logs of significant actions taken within the platform
• Support ticket content sent to hello@getaros.ai or our in-app help form
• AROS Guide questions — questions you ask our in-app AI assistant, the help articles we suggested back, and whether you escalated to a human. Used for product improvement.
• Legal consent stamps — the timestamp + version of the Terms / Privacy policy you accepted at signup

From your use of our website:

• Basic analytics (page views, referrers, device/browser type) via PostHog
• Cookies strictly necessary for the site to function

Candidate data processed on behalf of employers: when employers and recruiters upload candidate profiles, resumes, or applications to AROS, we act as a data processor on their behalf. The employer is the data controller for that information. Candidates should direct subject-access or deletion requests to the relevant employer in the first instance; we will assist that employer in fulfilling them.

We use the information above only for the following purposes:

• To contact you about Early Access, demos, and the Validation Program
• To evaluate fit between your hiring workflow and our roadmap
• To operate and improve the AROS platform
• To detect and prevent abuse, fraud, and security incidents
• To comply with our legal and regulatory obligations

We do not sell your personal information. We do not share Early Access submissions with third parties for marketing.

If you are in the EEA or the UK, the legal bases on which we process your data are:

• Consent — when you submit the Early Access form, you consent to being contacted about the program. You can withdraw consent at any time.
• Contract — when you become a customer, processing is necessary to deliver the service you’ve signed up for.
• Legitimate interest — for security, abuse prevention, and to improve the platform, balanced against your rights and expectations.
• Legal obligation — where applicable.

We share data only with the following categories of recipients, and only as needed:

• Infrastructure providers — cloud hosting, database, and content delivery. These act as our processors under contractual data protection obligations.
• Analytics — PostHog for product analytics.
• Email delivery — Resend or equivalent, when we email you about the program or send transactional emails (welcome, setup links, closure communications).
• AI / LLM provider — questions you ask AROS Guide are sent to a third-party LLM provider (e.g. Anthropic Claude) along with the relevant excerpts of our public Help corpus. We do not send your hiring data, candidate data, or audit logs to the LLM provider when you use AROS Guide.
• Legal and safety — if required by law, or to protect the rights and safety of AROS, our users, or the public.

• Early Access form submissions — until you ask us to delete them, or 24 months after our last contact with you, whichever is sooner.
• Account data — for as long as you have an account with AROS, plus a short window for backup and audit log retention.
• Audit logs — up to 24 months, then aggregated or deleted.
• Candidate data uploaded by employers — retained per the controlling employer’s instructions and their own retention policy.

Depending on where you live, you have the following rights with respect to your data:

• Access — request a copy of the personal information we hold about you
• Correction — ask us to fix inaccurate information
• Deletion — ask us to delete your information, subject to legal retention obligations
• Restriction / objection — limit or object to certain processing
• Portability — receive your data in a portable format
• Withdraw consent — at any time, with no penalty
• Lodge a complaint — with your local supervisory authority

To exercise any of these rights, email privacy@getaros.ai. We respond within 30 days. For Early Access submissions specifically, telling us “delete my submission” is enough — no verification ceremony required.

AROS uses industry-standard safeguards including TLS in transit, encryption at rest for sensitive fields, role-based access control, and audit logging. No system is perfectly secure; if we become aware of a breach that affects your data, we will notify you and the relevant authorities within the timeframes required by applicable law.

AROS is not intended for and does not knowingly collect personal information from individuals under 16. If you believe a child has provided us with information, contact us and we will delete it.

AROS is operated from the United States. If you are accessing the service from outside the US, your information may be transferred to, stored in, and processed in the US and other countries where we or our processors operate. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses).

We may update this policy as the product evolves. Material changes will be announced via email to active program participants and via a notice on this page. The “Last updated” date at the top reflects the most recent revision.

Questions, requests, or complaints about your data:

• Email: privacy@getaros.ai
• General: hello@getaros.ai

This policy is plain-English by design. It is not a substitute for legal advice in your jurisdiction. Counsel-reviewed terms will replace this notice before general availability.