Privacy Policy

This explains what Araraa does with data — yours, and your customers'.

Who is responsible for what

For your team's account data, Araraa is the controller. For the conversations you manage through Araraa, you are the controller and we are your processor: we hold and display them so your team can answer them.

What we hold

• Account data — name, email, role, workspace, and sign-in events (time, IP, device) so you can spot an unfamiliar login.
• Conversations — the messages, media, files and contact details that arrive through the accounts you connect. Media is cached on our servers so it loads without fetching it again each time.
• Usage data — which workspace, plan and features are in use, so billing and support work.
• Payment data is handled by our payment provider. Card numbers never reach our servers.

What is encrypted

Telegram session strings, mailbox passwords and platform API keys are encrypted at rest, with the key held outside the database. Message text is stored readable by the database because search runs against it — the full picture is at /security.

Who else sees it

• Telegram, your email provider, and any other network you connect — they carry the messages.
• Our infrastructure providers: the hosting company running our servers, and object storage for files.
• The payment provider that processes subscriptions, and the email provider that sends account emails.
• Optional features you switch on: AI features send the text being summarised or drafted to the configured AI provider, and the GIF picker queries a GIF service. Both are off unless enabled.

We do not sell data, and we do not use your conversations to train models.

Araraa staff

Support staff can see workspace names, plans and usage. Opening a support session inside your workspace is recorded in your audit log, so you can see that it happened.

How long we keep it

Conversations stay until you delete them, the conversation is cleared, or the workspace is closed. Backups are kept for a rolling period and then destroyed. Sign-in events are kept for 90 Days.

Your rights

Depending on where you live, you can ask for a copy of your data, correction, deletion, or to object to some processing. Write to cs@araraa.com and we will answer within 30 days. If you are in the EU or UK and unhappy with our answer, you can complain to your data protection authority.

Where data lives

Our servers are in the United States. Where data moves across borders we rely on the standard contractual clauses.

Cookies

We use a session token and local storage to keep you signed in and remember preferences. No advertising trackers.

Questions: cs@araraa.com.