Privacy policy
What data ArduMaker collects, what it is used for, how long it is kept and how to exercise your rights over it.
Version 1 · Updated on 2026-09-20
How ArduMaker collects, uses, shares and protects personal data
| Version | 1.0 |
| Effective date | 1 April 2024 |
| Last updated | 20 September 2026 |
| Applies to | ardumaker.com and its subdomains, the Dashboard, the APIs, the MCP server, support channels, the school program and custom development |
| Related documents | Terms and Conditions (including Annex A, Data Processing Terms) · Terms of Use · Payment Procedure |
In one sentence. ArduMaker uses personal data to provide and protect its Services, to bill for them and to comply with the law; it does not sell personal data, does not use it to train AI models, and gives every person clear rights over their data. This Policy is written to comply with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Portuguese data protection law.
Summary of the key points
- Controller: Franco Nicolas Dorrego (ArduMaker), Porto, Portugal. Privacy contact:
- developer@ardumaker.com with the
[PRIVACY]tag. - What we collect: account, company, billing, verification, technical and usage data,
- communications, and the data of the integrations you connect.
- What we do not do: we do not sell personal data, we do not use it for third-party advertising,
- and we do not use it, or data received from Google, to train AI models.
- Your servers are yours: for the data you store on your servers and Services, you are the
- controller and ArduMaker only processes it on your behalf.
- Where: the Platform and customer servers are hosted in the European Economic Area. Some
- providers are located elsewhere, always with legal safeguards.
- Your rights: access, rectification, erasure, restriction, portability, objection and
- withdrawal of consent, and the right to complain to the CNPD.
1. Who is responsible for your data
1.1 Controller. The controller of the personal data described in this Policy is Franco Nicolas Dorrego, a natural person carrying on a professional activity in Portugal under the trade name ArduMaker, with professional address at [TO COMPLETE: professional address], Porto, Portugal, tax identification number (NIF) 322978254 ("ArduMaker", "we" or "us").
1.2 Privacy contact. For any question or request about personal data, write to developer@ardumaker.com with the [PRIVACY] tag at the beginning of the subject line.
1.3 Definitions. Capitalised terms not defined here have the meaning given in the Terms and Conditions.
2. Scope and roles
2.1 ArduMaker as controller. This Policy covers the personal data that ArduMaker processes for its own purposes as controller: data of visitors of the website, of Customers and their Authorized Users, of people who contact ArduMaker, of students of the school program, of people who report abuse, and of business contacts.
2.2 ArduMaker as processor. When a Customer stores or processes personal data on its servers or through the Services (for example, the users of an application it hosts, the recipients of its emails or its WhatsApp contacts), the Customer is the controller and ArduMaker processes that data only on its behalf, in accordance with Annex A of the Terms and Conditions. Section 15 explains what this means for those people.
2.3 Third-party sites and services. This Policy does not apply to third-party websites or services, even if they are linked from ArduMaker or integrated with it. Their own privacy policies apply.
3. Personal data we process
| Category and examples | Source |
|---|---|
| 1. Identification and account. Name, email address, password (stored only as a one-way hash), language, country, telephone number | You |
| 2. Company and billing. Company name, tax ID or VAT number, billing address, role in the Company, Authorized Users | You |
| 3. Verification. Identity documents, proof of address, company documents, school enrolment status, identifier of a linked school account (such as the 42 Intra), results of verification checks | You, schools, verification services |
| 4. Payments. Stripe customer identifier, card brand, last four digits, expiry date, country of the card, payment status, history of transactions and Balance, invoices. ArduMaker never receives full card numbers or security codes | You, Stripe |
| 5. Technical and usage. IP address, browser and device, dates and times of access, pages visited, API and MCP calls, errors, the activity log of actions performed by users and Agents, web terminal command history, resource metrics, email access logs (SMTP and IMAP) | Collected automatically |
| 6. Service metadata. Domain names, DNS records, names of servers, mailboxes and databases, linked repositories and commits, WhatsApp numbers and message metadata, usage of Router IA and the Search API (model, tokens, operations and cost) | You, collected automatically |
| 7. Communications. Support emails and messages, conversations with ArduMaker by WhatsApp, forms (such as the school form: name, email, telephone, country, number of students, website and message), feedback, abuse reports and appeals | You, people who report abuse |
| 8. Projects and collaboration. Projects, stages, tasks, checklists, comments, attachments, meetings and availability slots | You and your team |
| 9. Integrations. Google Calendar events (only if you connect it), GitHub account and repository metadata (only if you link it), authorizations granted to AI assistants | Google, GitHub, you |
| 10. Cookies and similar. See Section 12 | Collected automatically, with consent where required |
| 11. From third parties. Fraud risk signals from Stripe, status of WhatsApp numbers from Meta and Twilio, blocklists and abuse reports, public information used for Verification | Third parties |
| 12. Business contacts. Name, position, company, professional email and telephone of companies and professionals that may be interested in our services | Public professional sources, events, referrals |
4. Purposes and legal bases
4.1 Table of purposes. ArduMaker processes personal data only for the following purposes and on the following legal bases under Article 6(1) GDPR. The category numbers refer to the table of Section 3.
| Purpose | Categories | Legal basis |
|---|---|---|
| Creating and managing Accounts and Companies, and providing the Services | 1, 2, 5, 6, 8, 9 | Performance of the contract (b) |
| Billing, payments, invoices, accounting and tax obligations | 1, 2, 4 | Performance of the contract (b) and legal obligation (c) |
| Collection of debts and management of Default | 1, 2, 4, 5 | Performance of the contract (b) and legitimate interest in recovering debts (f) |
| Calculation of the Authorized Negative Balance | 4 | Performance of the contract (b) |
| Verification, prevention of fraud and abuse, and security of the Platform, its customers and third parties | 1 to 7, 11 | Legitimate interest (f) and, where applicable, legal obligation (c) |
| Support and communications about the Services | 1, 5, 6, 7 | Performance of the contract (b) |
| Notices of changes, incidents and security | 1 | Performance of the contract (b) and legal obligation (c) |
| Handling notices of illegal content, abuse reports and appeals | 1, 5, 6, 7 | Legal obligation (c) and legitimate interest (f) |
| Answering requests and orders from authorities | Those required | Legal obligation (c) |
| Eligibility for the school program and management of school quotas | 1, 3 | Performance of the contract (b) and legitimate interest of ArduMaker and the school in ensuring the benefit reaches eligible students (f) |
| Synchronisation with Google Calendar | 9 | Performance of the contract at your request (b) |
| Statistics and improvement of the Services, using aggregated data where possible | 5 | Legitimate interest (f) |
| Emails about ArduMaker services similar to those you use, to existing customers | 1 | Legitimate interest (f), with the right to object in every message |
| Marketing communications to people who are not customers | 1 | Consent (a) |
| B2B outreach to business contacts | 12 | For emails to companies and other legal persons, legitimate interest in offering our services to businesses (f), with the right to object at any time. For emails to natural persons, prior consent (a), as required by Law 41/2004 |
| Analytics and advertising cookies | 10 | Consent (a) |
| Establishment, exercise or defence of legal claims | Those required | Legitimate interest (f) |
4.2 Legitimate interest. When ArduMaker relies on its legitimate interest, it has weighed that interest against your rights and expectations. You may object at any time, as explained in Section 11.
4.3 Obligation to provide data. The data marked as mandatory in the forms is necessary to conclude and perform the contract. Without it, ArduMaker cannot provide the Services. Verification data is necessary when ArduMaker requests it under Clause 7 of the Terms and Conditions; if it is not provided, the consequences described there apply.
5. Automated decisions
5.1 Cases. ArduMaker uses the following automated processes, which are necessary to perform the contract under Article 22(2)(a) GDPR:
- (a) the Authorized Negative Balance is calculated automatically, between EUR 5 and EUR 100,
- from the history of successful payments over the last 6 months, and may be withdrawn in the cases
- set out in the Payment Procedure;
- (b) automatic collection: charges are attempted automatically, the Services of a Company are
- paused after three consecutive failed attempts and deleted after 25 days in Default, as set out in
- the Payment Procedure;
- (c) fraud prevention: Stripe evaluates the risk of each payment and may block payments it
- considers fraudulent; and
- (d) abuse detection: automated systems may apply measures to a specific Resource to stop an
- ongoing harm. Suspensions of a whole Company or Account are decided or confirmed by a person.
5.2 Your rights. You may obtain human intervention, express your point of view and contest any of these decisions by writing with the [PRIVACY] tag, or through the appeal of the Terms of Use.
6. Who we share data with
6.1 No sale. ArduMaker does not sell personal data and does not share it for third-party advertising. It shares data only with the recipients below, and only what each one needs.
6.2 Recipients.
| Recipient | Purpose | Location and safeguard |
|---|---|---|
| Infrastructure and data centre providers ([TO COMPLETE: provider names]) | Hosting of the Platform and of customer servers and backups | European Economic Area |
| Stripe | Payment processing and fraud prevention. For some purposes, such as fraud prevention and its legal obligations, Stripe acts as an independent controller | EEA and United States (Data Privacy Framework and standard contractual clauses) |
| Meta and Twilio | Operation of the WhatsApp Business API | United States and other countries (Data Privacy Framework or standard contractual clauses) |
| OpenRouter and the AI model providers it routes to | Router IA, and specific AI features such as the transcription of WhatsApp voice notes | United States and other countries (Data Privacy Framework or standard contractual clauses) |
| Tavily | Search API and specific search features | United States (Data Privacy Framework or standard contractual clauses) |
| Calendar synchronisation (only if you connect it) and, with your consent, advertising measurement | United States (Data Privacy Framework) | |
| GitHub | Deploys from linked repositories (only if you link them) | United States (Data Privacy Framework) |
| Let's Encrypt (ISRG) | Issuing SSL certificates. Domain names are published in public Certificate Transparency logs | United States (transfer necessary to perform the contract at your request, Article 49(1)(b) GDPR) |
| AI assistants you authorize (such as Anthropic, OpenAI or Google) | Only the data that your Agent requests within the scope you grant, under your own relationship with that provider | According to the provider (Data Privacy Framework where certified; otherwise transfer at your request, Article 49(1)(b) GDPR) |
| Schools with an agreement | Confirmation of enrolment and, where the school pays for or manages the quota, the data needed to administer it, such as whether the student has an active server and its cost | According to the school (adequacy decision where applicable; otherwise transfer necessary for the school program you joined, Article 49(1)(b) GDPR) |
| Other members of your Company | The data visible according to the roles assigned by the Company holder, such as costs and activity | Platform |
| Professional advisers, auditors, banks and debt collection agencies | Accounting, audit, legal advice and debt recovery | EEA |
| Authorities, courts and law enforcement | Compliance with legal obligations and valid orders | According to the authority |
| Buyers or successors of the business | In case of merger, acquisition or transfer of business, with equivalent safeguards | According to the transaction |
6.3 Sub-processors. The up-to-date list of sub-processors that process Customer Data, with their location, is available on request by writing with the [PRIVACY] tag. Customers are notified of changes in accordance with Annex A of the Terms and Conditions.
7. International transfers
7.1 Location. The Platform, customer servers and backups are hosted in the European Economic Area.
7.2 Transfers outside the EEA. When a recipient is located outside the European Economic Area, ArduMaker transfers data only when an adequacy decision applies (including the EU-U.S. Data Privacy Framework for certified recipients) or when the standard contractual clauses of the European Commission are in place, together with any supplementary measures needed. You may obtain information about these safeguards by writing with the [PRIVACY] tag.
7.3 Customers outside Europe. If you use ArduMaker from outside the European Economic Area, for example from Latin America, your data is transferred to and processed in the European Economic Area, which offers a high level of protection. Where your local law requires specific information or safeguards for that transfer, they are provided through this Policy and the Agreement.
8. Retention
8.1 Periods. ArduMaker keeps personal data only for as long as necessary for the purposes for which it was collected:
| Data | Retention period |
|---|---|
| Account and Company data | While the Account is active. After closure, only the data needed to defend legal claims, for up to 5 years |
| Invoices, payment records and accounting documents | 10 years, as required by Portuguese tax and accounting law |
| Verification documents | Until the Verification is completed and for up to 90 days after it. Longer only if needed for an open case of fraud or abuse or a legal claim |
| Technical and security logs | 12 months |
| Activity log of a Company | While the Company exists, and 12 months after its deletion |
| Web terminal command history | While the server exists, and at most 12 months after its deletion |
| Detailed usage records of Router IA, Search API and WhatsApp | 12 months. Invoiced totals follow the accounting period |
| Support communications | 3 years from the last contact |
| Abuse cases and related evidence | 5 years from the closure of the case, or as instructed by the competent authority |
| Automatic backups of servers | The last 4 weekly copies. Final copies as set out in Clauses 15.4 and 22 of the Terms and Conditions and in the Payment Procedure |
| Google Calendar data | While the integration is connected. Erased within 30 days of disconnection |
| School program data | While the benefit is active, and 12 months after it ends |
| Marketing preferences, consents and objections | While valid. The record of the consent or objection is kept for up to 3 years as proof |
| Business contacts | Up to 2 years from the last contact, unless the person objects earlier or becomes a customer |
| Cookies | As indicated in Section 12 |
8.2 End of the period. At the end of each period, data is erased or irreversibly anonymised. Copies kept in backups are erased within at most 35 days.
9. Security
ArduMaker applies appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration and disclosure, including: encryption in transit; logical isolation between Companies; access to production systems limited to authorized personnel and recorded; one-way hashing of passwords; mailbox passwords not stored in ArduMaker's database; API Credentials that are never exposed in logs and can be revoked at once; tokenized, expiring URLs for media; weekly backups on separate infrastructure with integrity checks; and an activity log of every action. No system is completely secure. You can help by protecting your credentials and reporting any incident, as set out in the Terms and Conditions.
10. Personal data breaches
If a personal data breach occurs, ArduMaker notifies the Comissão Nacional de Proteção de Dados (CNPD) within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people. When the breach is likely to result in a high risk, ArduMaker also informs the affected people without undue delay. Breaches affecting Customer Data are notified to the Customer in accordance with Annex A of the Terms and Conditions.
11. Your rights
11.1 Rights. Under the GDPR you have the right to:
- (a) access your personal data and obtain a copy;
- (b) rectify inaccurate or incomplete data;
- (c) erase your data when it is no longer necessary, you withdraw your consent, you object, or
- it was processed unlawfully, subject to the legal retention obligations;
- (d) restrict the processing in the cases provided by law;
- (e) portability: receive the data you provided in a structured, commonly used and
- machine-readable format, and have it transmitted to another controller;
- (f) object to processing based on legitimate interest, and at any time and without giving
- reasons to processing for direct marketing;
- (g) withdraw your consent at any time, without affecting the lawfulness of the processing
- carried out before; and
- (h) not be subject to decisions based solely on automated processing without the safeguards of
- Section 5.
11.2 How to exercise them. Write to developer@ardumaker.com with the [PRIVACY] tag, indicating the right you wish to exercise. ArduMaker answers within one month, which may be extended by two further months for complex or numerous requests, in which case you will be informed. Exercising your rights is free of charge, unless requests are manifestly unfounded or excessive. ArduMaker may ask for information to confirm your identity when it has reasonable doubts.
11.3 Account deletion. You can delete your Services and request the closure of your Account from the Dashboard or by email. Closure is subject to the payment of pending debts and to the retention periods of Section 8.
11.4 Complaints. You may lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal, https://www.cnpd.pt, or with the supervisory authority of your country of residence or place of work. Outside the European Union, you may also contact the data protection authority of your country, such as the Agencia de Acceso a la Información Pública (Argentina) or the Autoridade Nacional de Proteção de Dados (Brazil). We encourage you to contact us first, so that we can try to solve the issue.
12. Cookies and similar technologies
12.1 What they are. Cookies and similar technologies, such as the browser's local storage, store or read information on your device.
12.2 Categories.
| Category and purpose | Examples | Basis | Duration |
|---|---|---|---|
| Strictly necessary. Session, authentication, security, and remembering your cookie choices and preferences such as language | Session cookies, the record of your cookie choice | Necessary for the service requested; no consent required | From the session up to 12 months |
| Local preferences. Conveniences that stay in your browser, such as the state of the web terminal or the history of your database queries | Browser local storage | Necessary for the function you use | Until you delete them |
| Analytics. Understanding how the website is used, to improve it | Google analytics tools, if enabled | Consent | As set by the provider, up to 24 months |
| Marketing. Measuring the effectiveness of advertising campaigns | Google Ads conversion measurement | Consent | Up to 90 days |
12.3 Your choice. Analytics and marketing technologies are used only if you accept them in the cookie banner. You can change your choice at any time through the cookie settings of the website or by deleting cookies in your browser. Rejecting them does not affect the use of the Services.
13. Google user data and Limited Use
13.1 What we access. If you choose to connect your Google account, ArduMaker accesses your Google Calendar with read and write permissions only to show your events inside ArduMaker and to create there the time blocks and meetings you generate on the Platform.
13.2 Who sees it. This data is kept only for you. The shared calendar of a project never shows your teammates the content of your personal events, only your availability slots.
13.3 Limited Use. ArduMaker's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, ArduMaker:
- (a) uses Google user data only to provide and improve the user-facing calendar features described
- above;
- (b) does not transfer Google user data to third parties, except as necessary to provide those
- features, to comply with the law, or as part of a merger or acquisition with equivalent
- safeguards;
- (c) does not use Google user data for advertising, and does not sell it;
- (d) does not send Google user data to any AI provider, and does not use raw or derived Google user
- data to develop, improve or train generalised or third-party AI or machine learning models; and
- (e) does not allow humans to read Google user data, unless you give your express consent for
- specific data, it is necessary for security purposes or to comply with the law, or the data is
- aggregated and anonymised for internal operations.
13.4 Disconnection. You can disconnect your Google account at any time from Integrations in the Dashboard, or revoke access from your Google account's permissions page (https://myaccount.google.com/permissions). The synchronised data is erased as indicated in Section 8.
14. Artificial intelligence
14.1 Limited use of AI by ArduMaker. ArduMaker uses AI in specific, limited features, such as transcribing voice notes received through WhatsApp. These features are independent of your Google account and never receive Google Calendar data.
14.2 Router IA. When you use Router IA, your prompts and the outputs are processed on your behalf and transmitted to OpenRouter and to the provider of the model you select, whose data policies apply, as described in Annex B of the Terms and Conditions.
14.3 No training. ArduMaker does not use your personal data, your Customer Content, your prompts or data received from Google to train AI models.
14.4 AI assistants you connect. If you authorize an external AI assistant (such as Claude or ChatGPT) through the MCP server, that assistant can access only the data it requests within the scope you enable, and only for the projects you enable. The provider of the assistant processes that data under its own privacy policy. You can revoke the authorization at any time.
15. If you are an end user of an ArduMaker customer
If you use an application, website, email address or WhatsApp number of a company that uses ArduMaker, that company is the controller of your data and decides how it is used. Please contact that company to exercise your rights. If you contact ArduMaker, it will forward your request to the company without undue delay.
16. Children
The Services are not directed at people under 18, and ArduMaker does not knowingly collect their data. If you believe that a minor has provided us with personal data, contact us with the [PRIVACY] tag and we will erase it.
17. Communications
While you have an Account, ArduMaker sends you messages necessary for the Services, such as security notices, billing notices and changes to the terms. These cannot be disabled. Marketing communications can be stopped at any time through the link included in each message or by writing with the [PRIVACY] tag.
18. Changes to this Policy
ArduMaker may update this Policy to reflect changes in the Services or in the law. The date of the last update appears at the top. Material changes are notified by email or in the Dashboard before they take effect.
19. Contact
For anything related to this Policy or your personal data: developer@ardumaker.com, with the [PRIVACY] tag at the beginning of the subject line.
Current legal documents
- Terms and Conditions — Version 2 · Updated on 2026-09-20
- Privacy Policy — Version 1 · Updated on 2026-09-20
- Terms of Use — Version 1 · Updated on 2026-09-20
- Payment Procedure — Version 1 · Updated on 2026-09-20