Privacy Policy
Aron & Aida serves users internationally. This policy applies wherever you use our website or services. It explains how we process personal data for accounts, AI-assisted profiles and measured tasks, matching, identity and business verification, collaboration, subscriptions, payments and support, including our purposes, legal bases, sharing practices and your rights. The information we process depends on your role and the services you use. Availability of particular services depends on the supported countries and eligibility requirements.
1. Who is responsible for your data?
Aron & Aida is operated by IGA TXEN OÜ, an Estonian company, registry code 14058701, registered address Vesiveski tn 11, Tallinn, Harju maakond, 11914, Estonia. In this policy, ‘we’, ‘us’ and ‘our’ mean IGA TXEN OÜ.
The GDPR applies to personal data processed in the context of our Estonian establishment, including data about users outside the European Economic Area (EEA). Other privacy laws may also apply depending on your location, the processing and the law’s scope.
We act as the controller for website operations, account administration, platform matching, security and our own business records. Aron helps people prepare a Candidate Profile and find measured tasks they can operate. Aida helps organizations define measured tasks and find suitable operators. The service concerns task-specific collaboration; it is not a public directory of candidates.
An organization may separately control personal data in its own task materials and its decisions about collaboration. Where we process such material solely on that organization’s instructions, the applicable data-processing agreement governs our processor role. The organization remains responsible for its own privacy information and lawful instructions.
2. What personal data do we process?
The data depends on the features you use and the information you choose to provide. It can include:
- Account and contact data: name, email address, phone number and country code, profile image, sign-in provider identifiers, verification status, account preferences and records of notices or choices.
- Professional profile data: experience, education, skills, languages, availability, time zone, work preferences, boundaries, CV information and supporting evidence you provide or confirm.
- Organization and task data: business contact details, organization roles, authority to act, task descriptions, desired outcomes, requirements, approved profile or task versions, proposals, agreements, work submissions, evidence of results and collaboration records.
- Verification data: identity and company information, documents, representative and beneficial-owner details, verification references and outcomes, and the selfie, liveness or biometric data required by the verification process described in section 7.
- Financial and transaction data: billing contact and address, tax or business identifiers, subscription and invoice information, payment and payout references, status, amounts, currencies, approved compensation, refunds and dispute records. Payment providers process the payment or payout details required for their services.
- Conversations and submitted materials: messages to Aron or Aida, uploaded documents or their metadata, and audio and transcripts when an available voice feature is used. Some draft and conversation state is stored in your browser; account-associated profiles and organization workspace data can also be stored on our servers.
- Operational records: support correspondence, invitations, recovery requests, security notifications, contract or billing records where relevant, and records of approvals, access and administrative actions.
- Technical data: IP address, browser and device information, session identifiers, timestamps, errors, security fingerprints and AI request usage information such as model, token counts and processing cost.
3. Where does the data come from?
We receive data directly from you, from your use of the service, and from an organization or person who invites you or provides material they are authorized to share. AI-generated summaries and suggested profile information are derived from the inputs you provide; they are not independently verified facts.
If you choose an available third-party sign-in provider, we receive the identity information authorized through that sign-in, such as an account identifier, email, name or profile image. Signing in through a professional or social network does not give us unrestricted access to your full CV or network activity. The sign-in flow identifies the provider; its privacy policy applies to your relationship with it.
Business and identity verification information may also come from business registers, authorized representatives and verification providers. Transaction information may come from payment providers or the parties to a collaboration. We do not use the public website to create a general database by scraping people’s professional profiles.
4. Why we use data and our legal bases
Under the EU General Data Protection Regulation (GDPR), the legal basis depends on the purpose, not merely on accepting our Terms of Use:
- Providing an account and requested services: we process necessary account, profile, conversation and task information to perform our contract with you or take steps you request before a contract (Article 6(1)(b)). Optional inputs are not required simply to read the website.
- Working with organization representatives: we process business contact and authority information for our legitimate interests in communicating with and providing services to the organization (Article 6(1)(f)).
- Identity and business verification: ordinary identity, representation and ownership information is processed for our legitimate interests in preventing impersonation and fraud and establishing that parties are entitled to collaborate (Article 6(1)(f)). Additional legal obligations apply only where relevant. Biometric processing and its separate consent are explained in section 7.
- Subscriptions, collaboration and payments: necessary contract, work, billing and transaction information is used to provide the services you request, administer agreed compensation and handle refunds (Article 6(1)(b)); legally required financial records are processed under Article 6(1)(c). For organization contacts who are not personally party to a contract, we rely on the legitimate business-administration interests described above.
- Protecting the service and handling support or disputes: relevant technical, recovery, access and correspondence records are processed for our legitimate interests in preventing misuse, protecting accounts, resolving problems and establishing or defending claims (Article 6(1)(f)). We balance these interests against your rights.
- Legal requirements: we process records needed to meet a legal obligation that actually applies to us, for example applicable accounting requirements or a lawful authority request (Article 6(1)(c)). We do not assume that every user is subject to mandatory anti-money-laundering checks.
- Optional marketing, non-essential tracking or other consent-based features: these require the applicable prior choice or consent (Article 6(1)(a)). You may withdraw consent without affecting the lawfulness of earlier processing. Necessary account and security messages are separate from marketing.
5. Aron, Aida and AI-assisted recommendations
AI processes relevant input to draft profile or task summaries, transcribe submitted audio, analyze CV information and suggest task-specific matches. Relevant information can be sent to selected AI service providers. We may use different models or providers for different functions, subject to the purposes, access, regional-processing and service-improvement safeguards in this policy. AI outputs may be incomplete or incorrect; you can review and correct them before confirming a profile, task or proposal.
Recommendations do not themselves enter into a contract, grant access to confidential material or authorize payment. Matching uses task-relevant capabilities, evidence and requirements, not a universal score of a person. We do not make final decisions with legal or similarly significant effects on you solely through automated matching or verification: a disputed eligibility or verification outcome can be assessed by an authorized person. You can ask us to explain the outcome, correct its inputs, express your position and request human review.
We may use anonymised conversation transcripts and aggregated usage data to improve our Services, matching algorithms and AI systems. We do not sell or license your personal data to third parties for training their AI models. This use is subject to verified anonymisation, applicable legal bases and any required notices or consent. Removing names alone does not make data anonymous. Confidential organization information and task-specific restrictions remain protected. This policy update does not itself activate new processing or change previously accepted agreements.
Voice inputs are used for the requested transcription and service interaction, not to create voiceprints for identifying you. Raw conversations, CVs and recordings are not automatically shared with potential collaboration partners. Identity-verification biometrics are a separate process described in section 7.
7. Identity and business verification
We use specialist providers for KYC (identity verification) and KYB (business verification), including checking a person’s identity, an organization’s existence, representation and beneficial ownership, and relevant fraud or compliance risks. Before you start, the verification flow identifies the provider and its role, links the applicable privacy notice, and explains the required checks and any additional information or consent they need.
Depending on the check, a verification provider may process name, date of birth, nationality, address, identity-document details and images, company and ownership records, representative details, a selfie or liveness recording, biometric facial information, and necessary device or fraud-risk information. The purpose is to establish identity and authority and protect the collaboration, not to assess your professional skills.
Ordinary verification information is processed for the interests described in section 4 or a specific applicable legal obligation. Where facial biometrics are used to uniquely identify you on a consent basis, we request your separate explicit consent under GDPR Articles 6(1)(a) and 9(2)(a) before that processing. Accepting our Terms or reading this policy is not biometric consent. You may decline or withdraw consent and ask us to arrange a non-biometric verification or manual-review route. Declining biometrics is not itself a failed identity check or a finding of fraud. A feature that requires verified identity can remain pending until the necessary identity and authority checks are completed.
Submit identity documents and biometric information only through the designated secure verification flow, not in ordinary Aron/Aida conversations or support email. We receive the references, status, necessary verified identity or organization information and review results needed to administer the check. Identity-document images and biometric templates are not part of a public or matching profile and are not shared with potential collaboration partners. The applicable verification notice explains retention and how to request deletion or review of an outcome.
A verification provider can process data on our instructions and, for specifically disclosed purposes, act as an independent controller, for example for its own legal or fraud-prevention duties. Before the relevant data collection, the verification notices identify the legal entities, their roles, purposes, retention and rights, including every controller relying on a requested biometric consent. This general policy is not blanket consent to a provider’s independent use of your data. Our provider arrangements and the notice given in the verification flow determine the checks and data involved; a provider result does not remove your right to contact us or challenge an error.
8. Service providers
We use providers for particular functions, not to give every provider access to all your information. This policy describes their categories so that it is not tied to one software vendor or AI model. The categories and relevant information include:
You can ask legal@aronandaida.com about the providers that actually receive your data, their roles, relevant processing locations and transfer safeguards. Where a provider acts as an independent controller, the relevant sign-in, verification or payment flow identifies it and provides its privacy information before you submit data. Where we act as a processor for an organization, the applicable data-processing agreement identifies the actual subprocessors and provides the required prior written authorization, change notification and opportunity to object. Generic categories do not replace those obligations.
- Hosting, application-delivery, authentication, database and storage providers: relevant account, application and technical data needed to operate and secure the service.
- Email delivery and mailbox providers, and SMS providers for verification and recovery: destination contact details, message contents, attachments and delivery information needed for that communication. Messages to our support or legal addresses can be routed to our managed contact inbox using these providers.
- Security and abuse-prevention providers for protected forms and infrastructure: verification tokens and relevant technical/device information.
- AI model and processing providers: the relevant inputs and request metadata described in section 5, under the processing limitations set out in this policy.
- Identity and business verification providers for the scope described in section 7. Third-party sign-in services receive information associated with the sign-in you choose under their own notices.
- Payment-service providers for subscriptions and supported task payments or payouts: necessary billing, payee, transaction and verification information. The payment flow identifies the provider and links its privacy information; some providers also act as independent controllers for their own legal and fraud-prevention duties.
10. International processing
Our primary application databases and customer-content AI processing use approved European regional infrastructure. Some providers or their subprocessors operate internationally, and account, support, security, verification or delivery data may be processed outside the European Economic Area (EEA), depending on the service. We do not describe all processing by every provider as EU-only.
Where personal data is transferred outside the EEA, we use an appropriate transfer mechanism, such as an adequacy decision or Standard Contractual Clauses, together with additional safeguards where necessary. Contact us to ask about or obtain a copy of the safeguards relevant to your data. A regional hosting choice alone does not replace assessment of a provider’s other processing.
11. How long we retain data
Retention depends on the record and purpose. We keep account, profile and workspace information while it is needed to provide the requested service. When it is no longer needed, we delete or appropriately anonymize it, subject to necessary legal or dispute-related retention. You may request deletion at any time.
Support, security, verification and audit records are retained according to the duration needed to handle the matter, protect against misuse and establish or defend relevant claims. Contract and accounting records may need to be retained for the applicable statutory period. We consider whether a dispute or legal obligation requires preservation and restrict further use of retained records.
Browser-held information may remain until you clear site storage or use the applicable reset control. Server deletion and provider deletion are separate from browser reset. Backups may retain data until their normal replacement cycle; restored data remains subject to deletion requirements.
Verification evidence and results are kept for the verification purpose and any applicable legal or dispute-related requirement. The notice presented before the check gives the retention arrangement for the configured identity or biometric process. Contact us for the criteria or period relevant to a particular record, including a deletion request we cannot fully satisfy.
12. Your rights and how to exercise them
Depending on the applicable conditions, you can request access and a copy of your data, correction, deletion, restriction, or a portable copy. You can object to processing based on legitimate interests and to direct marketing, withdraw consent, and ask for human consideration of a decision affecting you.
Send requests to legal@aronandaida.com. You do not need access to your account to contact us. We may ask for proportionate information to verify your identity, but please do not email identity documents unless an appropriate secure process has been agreed.
We normally respond within one month and observe any shorter applicable legal deadline. If a lawful extension is needed because of complexity or the number of requests, we will tell you within the applicable deadline and explain why. If we cannot fulfill a request, we will explain the applicable reason and your options, including any available appeal process. These rights are not replaced by a browser reset button.
You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or another competent privacy regulator under applicable law, including where you live or work in the EEA. Where local privacy laws apply, you may have additional rights, including limits on sensitive-data use, opt-outs from specified processing and protection against discrimination for exercising privacy rights. Contact legal@aronandaida.com to exercise applicable rights.
13. Security and sensitive information
We use access controls, protected connections and purpose-limited administrative operations to reduce the risk of unauthorized access. Sensitive account-recovery fields use additional encryption or keyed fingerprints. No online service can promise absolute security; contact us if you suspect an incident affecting your data.
Do not put passwords, access keys, identity documents, biometric data, health information or other unnecessary sensitive information into a CV, task description or conversation. A designated verification flow has its own requirements. The professional service is not directed at children; contact us if you believe a child’s data has been submitted so we can assess and address it.
14. Changes and contact
We will update this page when processing or the service changes and revise the effective date. Material changes will be brought to your attention through an appropriate notice. Continued use of the website is not a substitute for consent where consent is required.
For privacy questions or requests, contact IGA TXEN OÜ at legal@aronandaida.com or Vesiveski tn 11, Tallinn, Harju maakond, 11914, Estonia. This policy is available in Estonian and English; both versions are intended to explain the same processing.