Arran AI Inc. – Privacy Policy
1.Who we are and what this policy covers
Arran AI Inc. (“Arran”, “we”, “us”) is a company incorporated in British Columbia, Canada. We provide Arran AI, a voice-first artificial intelligence platform for yacht and vessel operations, used by engineering, deck and interior crew (the “Platform”). This policy explains how we collect, use, disclose and protect personal information, and the rights you have.
This policy applies to personal information we collect:
- through our website, arranai.com;
- from representatives of our customers and prospective customers, for example for sales, contracts, billing and support;
- from authorized users who hold accounts on the Platform (“Authorized Users”), whether they use our web app, our desktop app or our mobile apps for Apple and Android devices, about their accounts and use of the Platform; and
- when you contact us.
Information our customers put into the Platform. Our customers, such as yacht owners, yacht management companies and vessel operators, use the Platform to record and analyse operational information. This can include voice recordings made by their crew and staff (together, “Customer Data”). For Customer Data, we act as a service provider to our customer. Our customer decides what information is collected and why, and is responsible for being entitled to share it with us. We process Customer Data only to provide the Platform to that customer, under our written agreement with them.
If you are a crew member or employee of one of our customers, please also read your employer’s privacy policy. Requests about Customer Data should go to your employer first; we will help them respond.
“Personal information” means information about an identifiable individual. Business contact information used only to communicate with you about your work is handled as permitted by applicable privacy law.
2.Personal information we collect
We collect only the personal information we need for the purposes in section 3.
| Category | Examples | Where it comes from |
|---|---|---|
| Account information | Name, work email, job title or rank, employer, vessel or fleet assignment, user role, login credentials | The customer’s administrator, or you |
| Customer contact and billing information | Names and business contact details of customer representatives, billing address, payment records. Card payments are processed by Stripe and we do not store full card numbers. Customers may also pay by invoice or bank transfer | The customer |
| Voice recordings and transcripts (Customer Data) | Voice logs recorded through the Platform, and the transcripts, summaries and other AI outputs created from them. Transcripts may contain the speaker’s name and anything said. The audio itself is not stored | Authorized Users, on the customer’s behalf |
| Other Customer Data | Maintenance logs, fault reports, handover reports, compliance records, passage plans, schedules, and drydock and vendor quote information. Interior records may include guest preferences, provisioning and service notes, which can identify guests and may include details such as dietary needs or allergies. These records may also name crew, contractors or vendors, and may include photos, and names or signatures added to logs | The customer and Authorized Users |
| Usage and device information | Login times, features used, IP address, browser, device type, operating system and app version, error logs | Collected automatically |
| Support and communications | Emails, support tickets, feedback and training session records | You |
| Website contact form | Your name, email address and message when you contact us through our website | You |
| Website analytics | Pages visited, time on the site, approximate location, and device and browser type. Collected only if you accept analytics cookies | Collected automatically, with your consent |
About voice recordings. A voice recording can identify the person speaking, so we treat recordings with particular care. Audio is used only to create a transcript and is not stored afterwards. We do not use voice recordings to create voiceprints or to identify individuals by their voice. Recordings may also capture other people speaking nearby. Customers should tell their crew and staff when voice logging is in use.
Mobile apps and device permissions. If you use the Platform through our app on a phone or tablet, the app asks for your permission before it uses your device’s microphone. The microphone is used only while you are recording a voice log. If the app offers features such as adding photos, it will ask for your permission before using your camera or photos, and will use them only when you choose to. You can turn these permissions off at any time in your device settings, although some features will not work without them. Information you enter may be stored on your device until it can be synced with the Platform. When you download our app, Apple (App Store) or Google (Google Play) collects information under their own privacy policies.
3.How we use personal information
We use personal information only for these purposes:
- to provide, operate and maintain the Platform, including transcribing voice logs and generating AI outputs for the customer;
- to set up and manage accounts, verify identity and control access;
- to deliver onboarding, training and support;
- to bill customers, process payments and collect amounts owed;
- to monitor performance, uptime and security, and to detect and prevent fraud, misuse and security incidents;
- to improve the Platform, using anonymized and aggregated information as described below;
- to send service notices, such as updates, maintenance alerts and changes to our terms;
- to send business contacts information about our products, with consent as required by Canada’s Anti-Spam Legislation. You can unsubscribe at any time; and
- to comply with the law and enforce our agreements.
We will not use personal information for a new purpose without your consent, unless the law permits it. We do not sell personal information.
AI and model improvement. We do not use identifiable Customer Data, including voice recordings and transcripts, to train AI models. We may use information that has been anonymized and aggregated, so that it no longer identifies any individual or customer, to analyse performance, fix errors, develop features and refine our AI models. We take steps to ensure that our service providers do not use Customer Data to train their own AI models, or keep it longer than needed to provide their services to us.
Automated processing. The Platform uses AI to analyse information and produce recommendations, such as maintenance priorities. It supports decisions made by our customers and their staff; it does not make decisions about individuals that have legal or similarly significant effects on them. AI outputs can be inaccurate, and customers remain responsible for the decisions they make using the Platform.
4.Consent
We collect, use and disclose personal information with consent, except where the law permits otherwise. The form of consent depends on how sensitive the information is and what you would reasonably expect. For example, consent may be implied when you give us your business card or open a support ticket.
Customer Data. Our customers are responsible for giving notice to, and obtaining any consent needed from, their crew, staff and others whose information is in Customer Data, including people heard in voice recordings.
Withdrawing consent. You may withdraw consent at any time on reasonable notice, subject to legal or contractual limits. We will explain what that means for you. For example, we cannot keep an account open without the information needed to run it.
Without consent. We may collect, use or disclose personal information without consent where the law allows or requires it, for example to comply with a court order, investigate a breach of an agreement or law, or respond to an emergency that threatens someone’s life, health or safety.
5.When we share personal information
We share personal information only as described here. We do not sell, rent or trade it.
Service providers. We use trusted service providers to run the Platform and our business. We use contracts and other measures to require our service providers, and the providers they engage to support the Platform, to keep personal information confidential, protect it, and use it only to provide their services. For example, Amazon Web Services and OpenAI are engaged through Active AI. We remain responsible for personal information we transfer to them. Our main service providers are:
| Service provider | What they do for us | Where they process data |
|---|---|---|
| Les Entreprises Wesfield inc., operating as Active AI | Platform development, maintenance and support | Canada |
| Amazon Web Services (AWS) | Hosting, data storage and backups | United States, with a planned move to Canada |
| OpenAI | Transcription of voice logs and AI analysis | United States |
| Stripe | Payment processing | Canada and the United States |
| Google (Google Workspace and Google Analytics) | Email, business documents and website analytics | United States and other countries |
| The Digital Crafters LLC (Logo Grove) | Website development and maintenance, including our website contact form | United States |
| Our website hosting provider (a US-based cloud hosting company) | Website hosting | United States |
We may change or add service providers from time to time. When we do, we will update this list and give our customers any notice required by our agreements with them. A current list is always available on request from our Privacy Officer.
Our customers. A customer, through its administrators or by asking us, can see Customer Data and the account and usage information of its own Authorized Users.
Business transactions. If Arran is involved in a sale, merger, financing or similar transaction, we may share personal information with the other party, under confidentiality obligations and as permitted by law.
Legal requirements. We may disclose personal information where required or permitted by law, for example in response to a court order or lawful request, or to protect the rights, property or safety of Arran, our customers or others.
6.Storage and processing outside Canada
We are based in British Columbia. For the online version of the Platform, personal information is currently stored and processed in the United States, where our hosting and AI service providers operate. We plan to move storage and hosting to Canada. After that move, some processing, such as AI transcription and analysis, may still take place in the United States. We will update this policy if any other location is used.
Online and offline versions. Each customer chooses how the Platform is set up on its vessels. In the online version, Customer Data is stored and processed as described in this section. In the offline version, the Platform runs on the customer’s own equipment on board the vessel. Customer Data is stored on that equipment, voice logs are transcribed on the device itself, and Customer Data is not sent to us or our service providers, including our AI service provider, unless the customer chooses to connect or share it, for example for support or updates. The customer is responsible for securing its own equipment.
While personal information is outside Canada, it is subject to the laws of that country. It may be accessible to courts, law enforcement and national security authorities there. We use contracts and other measures, directly or through our service providers, to help ensure it receives a level of protection comparable to what it would receive in Canada.
Individuals in the European Economic Area, the United Kingdom and Quebec have additional protections for international transfers; see section 10.
7.How long we keep personal information
We keep personal information only as long as needed for the purposes in section 3, or as required by law. After that, we securely delete it or anonymize it so it no longer identifies anyone.
| Information | How long we keep it |
|---|---|
| Voice audio | Not stored. Audio is used only to create a transcript and is then discarded |
| Customer Data, including transcripts | For the term of the customer’s agreement. After termination, the customer has 30 days to retrieve it, and we then delete it unless the law requires us to keep it |
| Backup copies | Kept on a rolling seven-day cycle, then automatically deleted |
| Account information | For the life of the account, plus two years |
| Billing and tax records | At least six years, as required by Canadian tax law |
| Support communications | Two years after the matter is closed |
| Website contact form messages | Two years, then deleted |
| Usage logs | 12 months |
| Website analytics data | 14 months, then automatically deleted |
If we use personal information to make a decision about you, we keep it for at least one year after the decision, so you have a reasonable opportunity to request access to it.
8.How we protect personal information
We use safeguards suited to the sensitivity of the information, including:
- Technical: encryption in transit and at rest, and access limited to approved technical staff;
- Organizational: access limited to staff and contractors who need it, confidentiality obligations, and privacy training; and
- Physical: secure data centres operated by our hosting providers.
No system is completely secure. Customers and Authorized Users are responsible for keeping their login credentials safe and should tell us immediately if they suspect unauthorized use.
If a breach happens. If a breach of our security safeguards involving personal information creates a real risk of significant harm, we will notify the affected individuals and the Office of the Privacy Commissioner of Canada, and any other authority required by law. We keep a record of every breach. If a breach affects Customer Data, we will notify the customer without undue delay and help them meet their own obligations.
9.Your rights
Subject to the law, you have the right to:
- access the personal information we hold about you, and learn how it has been used and to whom it has been disclosed;
- correct personal information that is inaccurate or incomplete;
- withdraw consent, as described in section 4; and
- complain to us, or to a privacy regulator (section 10).
How to make a request. Write to our Privacy Officer (section 10). We may ask you to verify your identity. We will respond within 30 days, or within the time set by the law that applies to you. If we need more time, we will tell you why, as the law allows. Requests are free, although we may charge a minimal fee where the law permits, and we will tell you before we do.
In some cases the law allows or requires us to refuse a request, for example where the information is legally privileged or would reveal personal information about someone else. If so, we will explain why.
Deleting your account. To ask us to delete your Platform account, contact your employer’s administrator or our Privacy Officer (section 10). We will delete your account information, subject to section 7 and any legal requirement to keep it. Records you created in the Platform, such as maintenance logs, belong to the customer and are kept or deleted under the customer’s instructions.
Requests about Customer Data. If your request concerns Customer Data, such as a voice log recorded at work, please contact the customer (usually your employer). If you send it to us, we will pass it to the customer and help them respond.
10.International users, cookies, changes and contact
Governing law. This policy is governed by the laws of British Columbia and the federal laws of Canada that apply there. This does not take away any rights you have under the privacy laws of the place where you live.
European Economic Area and United Kingdom. Where the GDPR or UK GDPR applies to our processing, we rely on these legal bases: performing our contract with you or your employer; our legitimate interests in running, securing and improving the Platform and communicating with business contacts; complying with legal obligations; and your consent, where we ask for it. You also have the rights to request erasure, restrict or object to processing, receive your information in a portable format, and complain to your local data protection authority. Canada is recognised by the European Commission and the UK as providing adequate protection for commercial organisations subject to PIPEDA; for other transfers we use appropriate safeguards, such as standard contractual clauses. For Customer Data, the customer is the controller and we act as its processor.
Quebec. Individuals in Quebec have rights under Quebec’s private sector privacy law, including the right to be informed about automated processing used to make a decision about them, and to receive certain information in a structured, commonly used technological format. Before transferring personal information outside Quebec, we assess whether it will be adequately protected, as that law requires.
Cookies. Our website uses Google Analytics cookies to understand how visitors use the site, for example which pages are visited and how long visitors stay. These cookies only run if you agree to them through the cookie banner on our website, and you can change your choice at any time. Our website may also use essential cookies that are needed for the site to work. We do not use advertising or other tracking cookies.
Children. The Platform is a business service and is not intended for anyone under 16. We do not knowingly collect personal information from children.
Changes to this policy. We may update this policy from time to time. We will post the updated version with a new effective date and, for significant changes, notify customers by email or through the Platform.
Contact us. Questions, requests and complaints go to:
Privacy Officer: David Hill, Arran AI Inc., 187 Asher Road, Kelowna, BC V1X 3H5, Canada. Email: davidhill@arranai.com.
Complaints to a regulator. Please contact us first so we can try to resolve your concern. You may also complain to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.