Privacy policy

Who this covers

Aruga is a business operations platform. A company that uses it is called a brand. Each brand has its own staff, its own clients, and from the hiring part onward, its own candidates and employees.

This policy covers 4 kinds of people: the owner and staff of a brand, the clients a brand sends invoices to, the people a brand interviews, and visitors to aruga.app.

The brand decides what goes into Aruga and how long it is kept. Aruga stores it on the brand's behalf. If you are a client or a candidate of a brand, the brand is the company to ask about your record. Aruga helps the brand answer.

What Aruga stores

• Accounts: name, email address, the brand you belong to, your role, and a log of sign ins.
• Brand settings: company name, logo, colors, timezone, currency, tax rates, invoice terms, and the text a brand shows to candidates.
• Clients and invoices: client names, contacts, billing addresses, quotes, invoices, payments, credit notes, and retainers.
• Hiring: the people a brand interviews, the roles, the scorecards its own staff fill in, interview dates, consent records, interview notes, and transcripts.
• Meeting data, when a brand connects Zoom, Google Meet, or Microsoft Teams: the recording details and the transcript text of meetings that are linked to an interview record. The recording file itself is stored only when the brand has switched on Store recordings in Aruga.
• Activity: a log of who changed money, status, access, or a record about a person, and when.
• Email: the invoices, reminders, and notices Aruga sends for a brand, and whether they were delivered.

Aruga never stores a client's card number or bank account number. Card entry happens on the payment processor's own pages. A brand may print its own bank details on its invoices.

Why Aruga stores it

• To run the brand's work: sending invoices, taking payments, keeping client records, and keeping a record of who was interviewed and what was decided.
• To keep a history the brand can check: every change to money, status, or access is logged with the person who made it.
• To send the email the brand asks Aruga to send, such as an invoice or a reminder.
• To answer a support request, when you write to us.

Aruga does not sell data. Aruga does not use a brand's data to advertise. Aruga does not use a brand's data to train a model.

Records about people in hiring

Aruga never scores, ranks, or recommends a person. Every number about a candidate was typed by a named member of the brand's staff. Aruga adds no total, average, rank, or ordering of people.

A model may transcribe, locate, and summarize what was said in an interview, and check whether a required question was asked. It never evaluates, compares, or recommends a person, and it is told so in every instruction it receives. A model never receives a protected characteristic such as age, religion, or health as an input.

A recording or transcript is stored only after a consent record exists for that person and that interview. The consent record holds the exact text the person agreed to. Editing the brand's text later never changes what anyone agreed to.

Every record about a person carries a retention date. The brand sets the period, with 24 months as the default. Nothing is deleted on its own. A member of the brand deletes a record, files first, then rows, and every deletion is logged.

Zoom, Google Meet, and Microsoft Teams

A brand may connect its own Zoom, Google Workspace, or Microsoft 365 account so that the transcript of an interview arrives in Aruga by itself. The brand connects its own account. Aruga never asks for the password. The sign in happens on the vendor's own page and the vendor gives Aruga a token.

Tokens are stored encrypted in Supabase Vault and are read only on the server, by the parts of Aruga that receive meeting events and run the daily check. No person at Aruga and no browser can read them.

• What Aruga reads: the list of recordings for the connected account, the details of a recording that matches a meeting link on an interview record, and the transcript text of that meeting. Nothing else is read. A meeting with no interview record in Aruga is ignored.
• What Aruga stores: the transcript text, with speaker names and times, and the meeting identifiers needed to match it. The recording file is pulled and stored only when the brand has switched on Store recordings in Aruga, which is off unless the brand's plan includes it.
• Who can see it: the brand's own staff, under the brand's roles. Never another brand. Never a client.
• How long: until the retention date on the interview, which follows the brand's retention period.
• How to stop: the brand's owner opens Settings, Hiring, and clicks Disconnect. Aruga removes the tokens at once. You can also remove Aruga from your Zoom account on the Zoom App Marketplace under Manage, Added Apps, from your Google account under Security, Third party access, or from your Microsoft account under Enterprise applications. Removing Aruga at the vendor stops every future read.

Aruga's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Where it lives and who helps run it

Aruga runs on a small number of outside services. Each one stores only what it needs for its job.

• Vercel hosts the application and the website.
• Supabase holds the database and the stored files. Secrets such as a brand's payment key and meeting tokens live in Supabase Vault, encrypted.
• Resend sends the email Aruga sends for a brand.
• Stripe takes payments when a brand connects its own Stripe account. The money goes to the brand's own Stripe account. Aruga never holds a brand's money.
• Zoom, Google, and Microsoft provide meeting recordings and transcripts when a brand connects its own account with them.
• A speech to text service turns a recording into a transcript when a brand has switched on recordings and the platform owner has set that service up.
• A language model from Anthropic reads a job description to suggest a scorecard draft, and works on transcripts in the ways described above. It receives the text it needs for that task and nothing about a person that is not already in that text.

Who can see what

• A brand's staff see only their own brand, under the role the owner gave them. A viewer cannot change anything. An employee sees only their own record, details, time, and leave.
• A client sees only their own invoices, quotes, and statements in the brand's client portal, and never another client's, not even a count.
• The platform owner can enter any brand to help with support. Every time this happens it is written to the brand's activity log, which the brand's owner can read.
• The database enforces these limits with row level security. The screens are not the only thing in the way.

Cookies

The app sets the cookies it needs to keep you signed in. The public website sets no advertising cookies and runs no advertising tracker.

Your choices and your rights

• A brand owner can export the brand's reports and documents at any time, can ask for a full copy of the brand's data by email, and can ask for the brand's data to be deleted.
• A client can ask the brand for a copy of their record or for a correction. The brand can do both inside Aruga.
• A candidate can ask the brand what it holds about them, ask for a correction, or withdraw consent. A consent withdrawal is a new consent record. The brand can delete the recording and transcript at once.
• Anyone can write to Aruga to ask what is held about them and to ask for it to be deleted. If the record belongs to a brand, Aruga passes the request to the brand and helps it answer.

Write to hello@aruga.app. Say which brand you are asking about if you know it.

How it is protected

• Every connection uses HTTPS.
• Payment keys and meeting tokens are stored encrypted in Supabase Vault and never sent to a browser.
• Stored files live in private storage. Every read goes through the server, is logged, and uses a link that expires.
• Every table in the database carries row level security, so a brand's data cannot be read by another brand's account.
• If a security problem affects your data, Aruga tells the brand's owner by email as soon as it is confirmed and says what happened and what to do.

Changes to this policy

When this policy changes in a way that matters to you, Aruga emails every brand owner before the change takes effect. The date at the top shows the last change.

Contact

Aruga is run by its owner. Email hello@aruga.app for any question about this policy.