Privacy Policy
1. Scope and controller
This policy describes how Arvanord processes personal data when you use arvanord.io, submit a form, write to one of our addresses, or engage our services.
Arvanord is the controller for that processing. Questions, and any request under section 8, go to hello@arvanord.io.
2. What we do not do
We run no analytics, no advertising pixels, no session recording and no third-party tracking scripts. There is no consent banner because there is nothing to consent to: browsing this site does not create a profile, and no data about your visit is sold, shared or used for advertising.
You can verify this — the network panel in your browser will show requests to this domain and to no tracking service.
3. What we process, and why
Form submissions. When you send a system brief, an enquiry or a subscription, we process the email address you give and, where you provide them, your name, company and the content of your message. We use this to answer you and to perform or prepare a contract with you.
Orders. When you place an order or reserve early access to an Academy program, we process the items and the contact details needed to fulfil it. Payment card details are handled by our payment processor and never reach our servers.
Correspondence. Email sent to our addresses is received and stored so that we can answer it and keep a record of the engagement.
Technical data. Our hosting platform records standard request data — IP address, user agent, requested URL, timestamp — to serve the site and to defend it against abuse. This is a platform-level log, not a behavioural record.
4. Cookies and local storage
This site sets no cookies for visitors. Two things are stored in your own browser using local storage, and both stay on your device until you clear them: your chosen currency, and the contents of your cart. They are functional only — they are not identifiers and they are not sent to us except as part of an order you place.
One cookie exists, and only for staff: a signed session cookie that keeps an Arvanord administrator signed in to the internal mail panel. It is not set for visitors.
5. Where data is stored, and who processes it
We keep the number of processors small and use providers with processing agreements in place. Hosting and file storage run on Vercel, with stored data held in its EU region. Transactional and inbound email is handled by Resend, with inbound mail received in the EU. Payments, when enabled, are processed by Stripe. Mail addressed to our own inboxes is also forwarded to a Google Workspace mailbox so that it is seen promptly.
We do not transfer personal data to other third parties, and we do not sell it.
6. Storage and retention
Messages sent to our mailboxes are encrypted at rest and retained while the enquiry or engagement is live, and for a reasonable period afterwards so that we can honour our obligations and answer follow-up questions. Records connected to an invoiced engagement are kept as long as accounting law requires.
Client project data is governed by the applicable engagement agreement and data-processing terms, which prevail over this policy where the two describe the same processing.
7. Security
Stored correspondence is encrypted with AES-256-GCM, with keys held as environment secrets outside the data store. Access to the internal mail panel is restricted by a signed session and rate-limited sign-in. Transport is encrypted in transit. No system is perfect, and we would rather say so than claim otherwise; if a breach ever affects your data, we will notify you and the supervisory authority as required.
8. Your rights
Under the GDPR you may request access to the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or object to its processing, and request it in a portable format. You may withdraw consent at any time where consent is the basis for processing.
Write to hello@arvanord.io and we will respond within the period the law allows. If you believe we have handled your data wrongly you may complain to the data protection authority in your country; we would rather you told us first, so that we can put it right.
9. Changes
If this policy changes materially we will update the date below. Because the policy describes how our systems actually work, changes to those systems are what drive changes here — not the other way around.