arilator

Privacy Policy & Data Residency

How Arilator collects, verifies, and protects personal and business data, localizes Indian payment and GST records within India, and upholds your rights under the India DPDP Act (2023).

1. Overview & Data Fiduciaries

This Privacy Policy & Data Residency Statement governs the collection, processing, and storage of personal and business data by Arilator India Private Limited (GSTIN: 36ABGCA4968F1ZG, acting as the Data Fiduciary in India for Customer accounts, INR/UPI orders, GSTIN verification, prepaid usage ledgers, and statutory GST tax invoicing) and Arilator Inc. (a Delaware corporation, USA, responsible for global Vendor onboarding and monthly USD wholesale settlements).

2. Information We Collect from Customers

  • Account & Profile Information: When you register a Customer account or place an order, we collect your work email address, full name, account type (Organization or Individual), organization/company name, billing address, state, and order parameters (selected software package, seat count, or prepaid usage tier).
  • GSTIN Verification: Providing a 15-character Indian GSTIN is mandatory when registering as (or converting an account to) an Organization, and optional for Individual registrations. When you submit a GSTIN, we verify it in real time against official Indian GST taxpayer records through authorized GST compliance verification services to confirm active registration status, validate that the registered Legal Name or Trade Name matches your organization name, and populate your statutory State Code and Place of Supply on your B2B Tax Invoice.
  • Enhanced API Router Telemetry & Optional Data Protection Decorators: When you route requests through the Arilator Enhanced API Router (whether under a prepaid INR package or in Bring-Your-Own-Key mode), Arilator records operational metering and audit metadata — specifically request ID, timestamp, tenant ID, vendor/model identifier, token/unit counts, latency, HTTP status, and policy outcome — without storing raw prompt or response bodies by default. When you enable optional X-Arilator-PII-Protection or X-Arilator-Secrets-Protection headers or tenant policies, request text fields are inspected in memory using heuristic and regex pattern matching to detect, mask, or block common identifiers (such as email addresses, phone numbers, PAN/Aadhaar-like patterns, and API credentials) before forwarding. Heuristic inspection has inherent limitations (for example, on obfuscated text or binary/multimodal payloads), and internal X-Arilator-* headers are stripped prior to upstream transmission.

3. Payment Information, RBI Data Localization & Upstream API Providers

Customer payments are collected in Indian Rupees (INR) via domestic UPI or bank transfer (NEFT/RTGS) to Arilator India Private Limited's designated collection account displayed at checkout. Arilator never collects, processes, or stores raw payment card numbers (PAN/CVV).

In strict compliance with Reserve Bank of India (RBI) directives on Storage of Payment System Data, all Indian customer order records, UPI transaction references (UTR/RRN), payment callback payloads, GSTIN verification logs, INR prepaid credit ledgers, router audit logs, and domestic GST tax invoices are processed and stored exclusively within secure data centers located in India (asia-south1). Please note that when you invoke an external third-party software or API vendor through Arilator, the forwarded API request payload is transmitted to and processed by that upstream provider in the regions where that provider operates; Arilator's domestic localization of payment, tax, and audit records does not imply that third-party upstream API providers store or process API payloads in India.

4. Information We Collect from Software Vendors

When a software provider onboards through the Partner Manager portal, we collect the Vendor's legal and display company name, authorized representative name, work email address, product catalog and pricing schedules, fulfillment configuration (API endpoints, encrypted master API credentials, or single-use coupon pools), and USD settlement bank account details for upfront master account funding and monthly Net-15 wholesale USD payouts.

5. Purpose & Lawful Basis of Processing

We process personal and business data strictly for the following lawful commercial and statutory purposes:

  • To generate locked INR checkout quotes, reconcile domestic UPI and NEFT/RTGS payments, and issue compliant Indian GST Tax Invoices and Credit Notes under GSTIN 36ABGCA4968F1ZG.
  • To authenticate buyer GSTINs and Legal/Trade Names against official GST records so eligible B2B buyers can claim 18% Input Tax Credit (ITC) in GSTR-2B, subject to buyer GST eligibility and applicable GST compliance requirements.
  • To provision software subscriptions, license keys, and metered Enhanced API Router entitlements upon payment confirmation.
  • To meter real-time usage against prepaid INR credit wallets and prevent unauthorized or over-balance API consumption.
  • To calculate, audit, and remit upfront USD master account funding and monthly Net-15 USD wholesale settlements to Vendors and maintain immutable financial audit trails.
  • To respond to customer support requests, refund claims, and statutory regulatory or tax inquiries.

6. Data Sharing & Strict Minimization

Arilator never sells personal data and never uses customer or vendor data for third-party behavioral advertising. We share only the minimum data necessary to execute and comply with your transaction:

  • Authorized GST Verification Providers: Your supplied 15-character GSTIN is transmitted over encrypted TLS to our authorized Indian GST compliance verification provider solely to verify active GST registration status, Legal Name / Trade Name match, and registered state code.
  • Banking & Settlement Partners: Domestic Indian banking partners for INR UPI and NEFT/RTGS reconciliation, and regulated US banking partners for outbound USD wholesale wire/ACH settlements to Vendors.
  • Software Vendors: Strictly the minimum identifier required to provision your software entitlement (such as work email, organization name, and purchased plan/seat count, or a pseudonymized tenant identifier on proxied API gateway calls). We do not share your domestic UPI banking metadata or Indian tax records with Vendors.
  • Tax & Regulatory Authorities: Invoice and GSTIN particulars required for statutory GST return filings (such as GSTR-1 / GSTR-3B) under Indian tax law.

7. Statutory Data Retention

In accordance with Section 36 of the Central Goods and Services Tax (CGST) Act, 2017 and Indian corporate accounting regulations, domestic GST tax invoices, credit notes, GSTIN verification records, and order payment ledgers are retained in data centers located within India for a minimum of eight (8) years from the due date of furnishing the annual return for the relevant financial year.

8. Your Rights Under the India DPDP Act (2023) & Global Privacy Laws

Under the Digital Personal Data Protection Act, 2023 (India) and applicable international data protection laws, Data Principals have the right to:

  • Access & Summary: Obtain a summary of the personal data being processed by Arilator and the processing activities undertaken.
  • Correction & Updating: Request correction, completion, or updating of inaccurate or incomplete account data (note that already-issued statutory GST tax invoices cannot be retroactively altered once locked, except via formal GST Credit/Debit Notes where permitted by law).
  • Erasure & Withdrawal of Consent: Request erasure of personal data that is no longer necessary for the purpose for which it was collected, subject to mandatory 8-year statutory tax and financial audit retention obligations under Indian law.
  • Grievance Redressal: Register a formal privacy or data-handling grievance with our Grievance Officer.

To exercise any of these rights, contact our Privacy & Grievance Desk at refunds@arilator.com or partnerships@arilator.com.

9. Technical & Organizational Security Controls

We enforce encryption in transit (TLS 1.2+) and encryption at rest (AES-256), strict role-based access controls across Customer, Partner Manager, and BackOffice portals, authenticated session isolation, one-way cryptographic hashing of customer API keys, outbound SSRF protection on proxy gateway routes, and hardware-backed key isolation for vendor provisioning secrets. Visit our Trust, Security & Regulatory Compliance page for further architectural details.

10. Updates to This Policy

We may update this Privacy Policy periodically to reflect operational, legal, or regulatory developments. Material changes will be published on this page.

11. Grievance Officer & Contact Information

In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, questions, data rights requests, or grievances regarding privacy and data residency may be directed to our Grievance Officer: