Privacy Policy

This is a draft, written to reflect what our checkout, invoicing, and vendor-onboarding flows actually collect. It has not yet been reviewed by legal counsel — do not treat it as final or binding.

1. Overview

This policy describes the personal data Arilator collects when a Buyer purchases software through Arilator, and when a Vendor submits product or pricing information — and how that data is used.

2. Information we collect from Buyers

At checkout, we collect your work email, first and last name, and seat count. GSTIN is optional.

If you provide a GSTIN, we verify it against India's GST records to auto-populate your legal business name and registered address for invoicing. An unverified or omitted GSTIN doesn't block your purchase — it just means your invoice won't carry a GSTIN line, and the GST charged can't be claimed as input credit.

3. Payment information

Buyer payments are made directly over UPI or bank transfer to Arilator's bank account — we don't collect or store card numbers. Payment confirmation is received from our banking partner and linked to your order.

4. Information we collect from Vendors

Company name, contact name, work email, product URL, and details about your provisioning method and settlement bank account — submitted through our vendor forms or by email.

5. How we use this information

• To create and fulfill orders — provisioning access and generating GST invoices.
• To verify a GSTIN for invoicing purposes.
• To settle payments with Vendors.
• To respond to inquiries submitted through our forms or by email.

6. Data sharing

We share the minimum data necessary with:

• India's GST verification systems, to confirm a Buyer's GSTIN.
• Our banking partner, to process and reconcile payments.
• Vendors — limited to what's needed to provision your access (e.g. your email). We don't share a Buyer's GSTIN or invoice details with the Vendor.

We do not sell personal data.

7. Data retention

We retain order and invoice records for as long as required by Indian tax law, and other personal data for as long as needed to provide the service or as required by law.

8. Your rights

Depending on your jurisdiction, you may have rights to access, correct, or delete your personal data. Contact partnerships@arilator.com to make a request.

9. Security

We apply reasonable technical and organizational measures to protect personal data, including restricting internal access to what a given function actually needs.

10. Changes to this policy

We may update this policy from time to time. Continued use after an update constitutes acceptance.

11. Contact

Questions about this policy can be sent to partnerships@arilator.com.