Privacy Policy

1. Information We Collect

1.1 Account Information

When you register, we collect: name, email address, phone number (optional), and password (stored in hashed form). We do not store passwords in plain text.

1.2 Business Information

If you register a business, we collect: business name, address, phone numbers, website, photos, service descriptions, operating hours, and other information you voluntarily provide for your public business listing.

1.3 User-Uploaded Documents

You may voluntarily upload personal documents (passport, visa, I-94, EAD, SSN card, lease agreements, insurance cards, and other documents). These uploads are entirely voluntary. We store these documents in encrypted private storage accessible only to you through temporary signed URLs that expire after one (1) hour.

1.4 Communications

Messages sent through the in-app chat system between users and businesses are stored to provide the communication service. Messages sent to the AI assistant ("Aroo Brain") are processed by OpenAI and are subject to OpenAI's data usage policies.

1.5 Payment Information

Payment processing is handled by third-party providers: Stripe, Inc., Apple Inc. (App Store), and Google LLC (Google Play). We do NOT store credit card numbers, bank account details, or other payment credentials. We store only transaction records (amount, date, subscription type, payment provider reference ID).

1.6 Automatically Collected Information

We collect: IP address, device type, browser type, operating system, pages visited, and timestamps. This information is collected through server logs and anonymized analytics (Vercel Analytics). We do NOT use advertising cookies or third-party tracking pixels.

2. How We Use Your Information

We use your information solely to:

• (a) Provide, maintain, and improve the Service;
• (b) Process transactions and send related notices;
• (c) Send reminders about document expiration dates (if you uploaded documents);
• (d) Provide AI-powered assistance through Aroo Brain;
• (e) Moderate content to prevent abuse, fraud, and violations;
• (f) Respond to support requests;
• (g) Comply with legal obligations.

We do NOT use your information for:

• (a) Selling to third parties;
• (b) Targeted advertising on external platforms;
• (c) Profiling for credit, insurance, or employment decisions;
• (d) Any purpose not described in this Privacy Policy.

3. How We Share Your Information

We do NOT sell, rent, or trade your personal information.

We share information only with:

• (a) OpenAI, Inc. — text of your AI assistant queries is sent to OpenAI's API for processing. OpenAI's API data usage policy states that API inputs are not used to train models. We do NOT send your uploaded documents to OpenAI; only text metadata (document types and expiration dates) is included in AI context;
• (b) Stripe, Inc. / Apple Inc. / Google LLC — payment processing only;
• (c) Supabase, Inc. / Railway Corp. — infrastructure hosting (data stored in AWS US regions);
• (d) Law enforcement — only when required by valid legal process (subpoena, court order, or applicable law);
• (e) In connection with a merger, acquisition, or sale of assets — with prior notice to users.

4. Data Storage and Security

4.1 Location

All data is stored on servers located in the United States (AWS US regions) through our infrastructure providers Railway and Supabase.

4.2 Encryption

Data is encrypted at rest (AES-256) and in transit (TLS 1.2+).

4.3 Document Security

User-uploaded documents are stored in private encrypted storage. Access is granted only through temporary signed URLs that expire after one (1) hour. Direct URL access to documents is not possible.

4.4 Access Controls

Only authenticated users can access their own data. Administrative access is limited to authorized Aroo City personnel for support and moderation purposes only.

4.5 Breach Notification

In the event of a data breach affecting your personal information, we will notify affected users by email within seventy-two (72) hours of discovery.

5. Your Rights

5.1 Access

You can view all your data in your account dashboard at any time.

5.2 Deletion

You may delete your account at any time. Upon account deletion, ALL your data is permanently and irreversibly deleted, including: profile information, uploaded documents, messages, bookings, reviews, and transaction history. This deletion is cascading and cannot be undone.

5.3 Data Export

You may request a copy of your data by contacting support@aroo.city. We will provide the export within thirty (30) days.

5.4 Correction

You may update your profile information at any time through your account settings.

5.5 California Residents (CCPA)

If you are a California resident, you have the right to: (i) know what personal information we collect; (ii) request deletion of your personal information; (iii) opt out of the sale of personal information — we do NOT sell personal information; (iv) non-discrimination for exercising your rights. To exercise these rights, contact support@aroo.city.

6. Cookies

We use only essential cookies required for authentication and session management. We use Vercel Analytics for anonymized, aggregated website usage statistics. We do NOT use advertising cookies, retargeting pixels, or third-party tracking technologies.

7. Children

The Service is not intended for persons under the age of eighteen (18). We do not knowingly collect information from children under 18. If we become aware that we have collected information from a child under 18, we will promptly delete such information.

8. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those websites.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email at least thirty (30) days before the changes take effect. Continued use of the Service after changes constitutes acceptance.

10. Contact

For privacy-related inquiries: