Privacy Notice

Scope and responsibilities

Ariadia LLC operates the Platform and handles information needed to run accounts, secure the service and respond to requests. Your institution determines what it places in a workspace, who it invites and how it uses its project records. Where Ariadia processes those records on the institution’s behalf, the institution’s instructions and any applicable agreement also govern that processing. Contact your workspace administrator about institution-controlled records; you may also contact Ariadia.

The main Ariadia website and Academy have separate features and notices. Sending a request through the central contact form is covered by the website’s notice as well.

Information we process

• Account information: email address, name, account identifier, password hash, verification status, setup/reset token records and account timestamps. We do not store your password in readable form.
• Workspace and project information: membership, roles, invitation addresses, assigned responsibilities, project descriptions, planning assumptions, budgets, dates, notes, evidence, uploaded files, reviewed sources, decisions, issued reports and audit history. This may include information that you or a teammate supplies about other people.
• Security and technical information: session identifiers stored as hashes on the server, browser/user-agent labels, session activity times and security events. The application uses a hash of the connecting IP address and email-related identifiers for temporary request throttling. Hosting and delivery systems also process network and request information to operate and secure the service.
• Ari requests: the question, selected project/task context and authorized saved information needed to answer it. The current application does not save conversation text to its database; the visible conversation is held in browser memory and is cleared when the conversation or relevant context resets or the page reloads. This is not a promise that all infrastructure request metadata is immediately erased.
• Preferences and correspondence: a local help-tip preference, and information you provide when contacting us.

Please provide only information relevant to your work and authorized for this service. Do not submit patient-identifiable information, protected health information, passwords or payment-card details in workspace content.

How information is used

We use this information to create and verify accounts, deliver account and invitation messages, manage authorized access, store and display project work, calculate planning estimates, answer Ari requests, preserve decision history, prevent abuse, troubleshoot the service and respond to support or legal requests.

Where a law requires a legal basis, processing depends on the circumstances: providing an agreed service, our legitimate interests in secure and reliable operation, compliance with legal obligations, or consent where required. Your institution is responsible for the basis for information it contributes and its own uses.

Who can access information

Active members of your workspace can see its active People directory, including names, email addresses and roles. Owners and administrators have broader oversight and can also see inactive membership records. Access to project content, reports and evidence follows current roles and project assignments. Team members may download or export records they are permitted to access; their subsequent handling is also subject to their institution’s rules.

Service providers process information as needed for the Platform. Cloudflare provides the server runtime, database and file storage. An OCBDC-operated transactional-mail relay and its email-delivery infrastructure process recipient addresses and secure setup, reset or invitation links. The relay arrangement does not make OCBDC the operator of Ariadia Platform.

Information may also be disclosed when necessary to comply with applicable law or lawful requests, protect people and the service, establish or defend legal claims, or complete a corporate transaction subject to appropriate protections and applicable notice requirements. The current Platform application has no integrated advertising or marketing-analytics tools. It makes no external generative-model requests.

Storage, security and retention

Project and account records are stored in the Platform database; uploaded originals are stored in private object storage. Password hashing, protected session cookies and server-side access checks help protect accounts and records. No system can guarantee complete security. Uploaded files are not automatically malware-scanned. This notice does not promise a particular security certification, hosting country or uninterrupted availability; service providers may process data in locations where they operate.

Account, workspace and source records are retained according to service needs, institutional instructions or agreements, and applicable legal, security and recordkeeping requirements. There is no universal automatic deletion period in the current application. Issued reports, workflow versions, audit history and security events are designed to preserve historical records; ending access or removing an item from the current project view does not necessarily erase historical records or stored attachments.

Sessions expire after 12 hours or one hour without activity. Expired session and temporary throttling records are cleaned up through application activity. These technical expiration rules do not delete the account or its project history. We assess deletion requests, including any applicable exceptions or obligations to preserve records.

Your controls and privacy requests

In Profile & security you can change your name or password and revoke sessions. Workspace exports include accessible project data, report metadata and the latest 200 audit events; they are not a complete backup or a full personal-data export. Email changes and account deletion are not currently self-service functions.

Depending on applicable law, your rights may include access, correction, deletion, a portable copy, restriction or objection, withdrawal of consent, and choices about sale, targeted advertising or certain profiling. These rights depend on your location, the processing and any applicable exemptions. We do not deny a legally protected right because you exercise it.

Contact Ariadia LLC to make a request. State that it concerns Platform privacy, the relevant account or institution, and the action requested. We may reasonably verify your identity and authority before acting, and may coordinate with your institution where it controls the record. We will respond within the period required by applicable law and explain a denial where required. To appeal a denied request, use the same form and identify the earlier request and why you believe the decision should be reconsidered. You may also complain to the privacy regulator or attorney general with jurisdiction.

Cookies and local storage

Read the Cookie Notice for the sign-in cookie, help preference, expiration periods and browser controls.

Children, changes and contact

The Platform is intended for adult professional and institutional users, not children under 13. If you believe a child has supplied personal information, contact us so we can investigate. We will update this notice as practices change and provide any notice required by law.

Contact Ariadia LLC or write to Ariadia LLC, 5202 Jackson St, Houston, TX 77004-5925, United States. Do not include sensitive records in an initial inquiry.