Privacy Policy

In brief: Arselli processes account details and uploaded documents to provide document intake, field preparation and review. A self-hosted option is available for organizations that need to operate the service in their own infrastructure.

Effective Date: August 18, 2026
Contact Email: bouhlal.work@gmail.com
Domain: https://arselli.com

Arselli ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, store, and protect your personal data when you use our services at arselli.com.

1. What Data We Collect

We collect the following types of data when you use Arselli:

• Account Data: Email address, display name, optional avatar image. No passwords are stored.
• Communication Data: Email messages we send for verification, updates, or newsletters.
• Uploaded Files: Invoices, receipts and any other files that you upload, which may contain sensitive personal or financial information.
• Session Metadata: IP address, browser type, and timestamps for session security.
• Service Usage Data: Metadata related to your activity within the platform (e.g. number of uploaded files and documents processed).
• Pilot Request Data: Name, firm, work email, and, when you choose to provide them, phone number and estimated monthly document volume. When you submit the pilot form, we also record campaign parameters present in the page URL and the referring page so we can understand which campaign led to the request.

2. How We Use Your Data

We use your data to:

• Create and manage your Arselli account
• Store and analyze your uploaded files
• Prepare document fields for your review before export
• Communicate with you about your account and service updates
• Respond to pilot requests and assess the effectiveness of our acquisition campaigns
• Comply with legal obligations

3. Automated Document Processing

Arselli may use approved external document-processing and AI service providers, selected and operated by Arselli, to:

• Read invoice and receipt content using OCR and document extraction
• Prepare structured fields for user review

Customers do not need to provide a provider API key or choose a model. Relevant document data may be transferred to the active provider solely for processing. Providers may operate outside the EU subject to the applicable contractual and legal safeguards. The current provider list must be confirmed in Arselli's subprocessor notice before production use.

4. Cookies and Tracking

Arselli uses essential authentication and security technologies. When Google Ads conversion measurement is configured, its tag is loaded only after explicit consent and only on the public landing page. It records a conversion after a pilot request is successfully saved; no document, accounting content, or private application page view is sent through that event. Rejecting measurement does not affect access to Arselli.

Campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term and gclid) may be retained temporarily in the browser's session storage so they are not lost during navigation. They are stored by Arselli with the lead, together with the referring page, only when the visitor intentionally submits the pilot request form. These values are used to understand which campaign generated the request.

5. Data Storage and Security

• Arselli uses managed infrastructure and storage providers selected for the service. Hosting locations and subprocessors may change and must be reflected in the current subprocessor notice.
• Data is transmitted over HTTPS; storage protections depend on the configured infrastructure provider.
• Access to personal data is limited to authorized team members for debugging or support purposes only.

While we strive to maintain reasonable safeguards, no system is completely secure. Use the platform at your own risk.

6. Legal Basis for Processing

We process personal data based on:

• Your consent, which you grant when you create an account or upload data
• Your optional advertising consent for Google Ads conversion measurement, which can be rejected or withdrawn without affecting the service
• Our contractual obligations to provide the services you signed up for

You can withdraw consent at any time by deleting your account or contacting us directly.

7. Data Retention

We retain your data:

• As long as your account remains active
• Until you request deletion

Once deleted, your data is removed from our systems, though some residual logs may remain for a short time due to backups or operational needs.

8. Your Rights (under GDPR and similar laws)

As a user, you have the right to:

• Access and review your personal data
• Correct or update inaccurate information
• Download a full backup of your data
• Request permanent deletion of your account and associated data
• Object to certain forms of processing
• Lodge a complaint with a data protection authority

To exercise your rights, contact us at bouhlal.work@gmail.com.

9. Children's Privacy

Arselli is not intended for users under the age of 18. We do not knowingly collect or store data from minors.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be published on this page with an updated "Effective Date." We encourage you to review the policy periodically.