1. Who We Are
Arfiti is provided by Arfiti Technologies OÜ (registry code 17266831), Paekalda 16-39, Tallinn 13628, Estonia ("we", "our", or "us"). We are the controller for website, account, support, and business-contact information. We process personal data in customer financial records on the customer’s behalf, under its instructions and the applicable data processing agreement. Contact your organisation first about records it controls.
2. Information We Collect
2.1 Information You Provide
We collect information you provide directly to us, including:
- Email address when you join our waitlist
- Company name and role (optional)
- Account information when you create an account
- When you choose Google sign-in: your Google account identifier, email address and verification status, name, and profile picture where supplied. Auth0 processes these details to authenticate you and associate your login with your Arfiti account. Google sign-in does not give us access to Gmail messages, Drive files, or contacts. We do not receive your Google password.
- Financial data you input into the system
- Communications with us (support requests, emails)
2.2 Automatically Collected Information
When you use our services, we automatically collect:
- Log data (IP address, browser type, pages visited, time spent)
- Device information (device type, operating system)
- Usage data (features used, actions taken)
- Cookies and similar tracking technologies
3. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve our services
- Process transactions and send related information
- Send you technical notices, updates, and support messages
- Respond to your comments and questions
- Send marketing communications (with your consent)
- Monitor and analyze trends, usage, and activities
- Detect, prevent, and address technical issues and fraud
- Comply with legal obligations
Legal Bases for Processing
For information we control, we rely on performance of a contract or steps you request before entering one (accounts and support), legal obligations (our own accounting and required disclosures), legitimate interests (security, troubleshooting, and business relationships), and consent where required (such as optional tracking and marketing). We assess legitimate interests against your rights. Customer-controlled records are processed under the customer’s instructions and legal basis.
4. AI Workflows and Connected Clients
Arfiti provides accounting infrastructure with optional AI workflows. Arfiti-managed agents may send relevant prompts, records, documents, and tool results to the configured AI provider, such as Anthropic, to perform the requested work. Provider processing and retention are governed by the applicable service terms and data processing agreement.
If you connect Cowork, Codex, or another client through MCP or an API, that client receives data you authorise it to access. Its provider’s privacy, retention, and model-training settings apply separately; we cannot control those settings. Agent interactions and tool activity may be recorded for execution history, troubleshooting, security, and audit evidence. We do not use Google sign-in information to train AI models.
5. Data Security
We use technical and organisational safeguards, including authenticated access, permissions, encrypted connections, and activity logging. Safeguards depend on the service and deployment. No internet service guarantees absolute security. Contact us for the commitments applicable to your agreement; this policy does not represent a certification or universal storage-location or audit-retention guarantee.
6. Data Sharing and Disclosure
We may share your information in the following circumstances:
- With your consent: When you authorize us to share specific information
- Service providers: Third-party vendors who perform services on our behalf (hosting, authentication (Auth0 and Google for Google sign-in), analytics, email delivery)
- Business transfers: In connection with a merger, acquisition, or sale of assets
- Legal requirements: When required by law or to protect our rights
- Aggregated data: Non-personally identifiable information for analytics and research
We do not sell customer financial records or Google sign-in information. Website visitor-identification and marketing services are described below.
7. Data Retention and Deletion
We retain information for the purposes described here, taking account of the account or customer relationship, applicable agreements, security and dispute-resolution needs, and legal obligations. Customer financial records follow the customer’s instructions and applicable requirements. There is no single accounting retention period for every country and record. Backups may retain copies until their normal expiry and are not a separate permanent archive.
To request deletion of your account or Google sign-in data, contact andrew@arfiti.com. We may verify your identity and explain any information that must be retained. You can revoke Google access in your Google Account settings; revoking access stops that connection but does not itself delete your Arfiti account or your organisation’s records.
8. Your Rights
Depending on your location, you may have the following rights:
- Access: Request a copy of your personal information
- Correction: Request correction of inaccurate information
- Deletion: Request deletion of your information (subject to retention requirements)
- Portability: Request export of your data in a machine-readable format
- Opt-out: Unsubscribe from marketing communications
- Object or restrict: Object to processing or request restriction where applicable
You may withdraw consent without affecting prior lawful processing and complain to your local supervisory authority or Estonia’s Data Protection Inspectorate (aki.ee). To exercise your rights, contact us at andrew@arfiti.com.
9. Cookies and Tracking
We use cookies and similar technologies to:
- Remember your preferences and settings
- Understand how you use our services
- Improve our website performance
- Deliver relevant content and advertising
You can control cookies through your browser settings. Disabling cookies may limit certain features.
9.1 Visitor Identification and Analytics Partners
We use third-party services to understand which businesses are interested in our product and to improve our website. These partners include:
- RB2B: Visitor identification and business-contact enrichment where enabled, including identifiers and contact details supplied by the service.
- IPinfo: Provides company, network, and geographic data based on IP address.
- PostHog: Captures product analytics and session behavior to improve the website.
- Google Analytics 4: Aggregate website traffic and engagement metrics.
- Vercel Analytics: Privacy-friendly traffic measurement.
When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.
You also have the option to opt out of the collection of your personal data in compliance with GDPR by visiting https://www.rb2b.com/rb2b-gdpr-opt-out.
Our visit-tracking database uses salted IP hashes. Hashing is pseudonymisation, not a guarantee of anonymity. Infrastructure and enrichment providers may process IP addresses separately.
10. International Data Transfers
Providers may process information outside your country, including outside the EEA. Where required, transfers must be covered by an adequacy decision or appropriate safeguards such as Standard Contractual Clauses. Contact us for information about providers and safeguards applicable to your service. A customer-specific data processing agreement governs transfers of customer-controlled records.
11. Children's Privacy
Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Where required, we will provide additional notice or obtain consent before a material change in processing.
13. Contact Us
If you have questions or concerns about this Privacy Policy, please contact us:
- Email: andrew@arfiti.com
- Website: arfiti.com