who we are
This website is operated by ARAN LABS LLC ("Aran Labs," "we," "us," or "our"), a Delaware limited liability company.
Registered office:
ARAN LABS LLC
8 The Green, Suite A
Dover, Delaware 19901
United States
For any privacy-related queries, contact us at [email protected].
what data we collect
We collect and process the following data:
- Email address — when you voluntarily subscribe to our mailing list, book a call, purchase an AI Workflow Audit, or contact us.
- Booking and enquiry details — the contact, scheduling, and workflow information you choose to provide through Google Calendar, email, or a previous website enquiry form.
- Purchase and transaction details — when you purchase an AI Workflow Audit or Website Redesign Sprint through Stripe, Stripe processes the payment details you enter. Aran Labs receives transaction details such as your contact information, the product purchased, amount, currency, payment status, Stripe customer or transaction identifiers, and any project detail requested in Checkout, such as the current website URL. Aran Labs does not receive your full card number.
- Analytics and campaign data — if you accept measurement cookies, Google Analytics and Google Ads collect information about pages viewed, interactions, device and browser details, approximate location, referring pages, and campaign identifiers. We do not send booking details, names, email addresses, or message contents to these tools.
- Server logs — our hosting provider (Railway) automatically collects standard server log data, including IP addresses, browser type, and pages visited. This data is collected for operational and security purposes.
- Font loading data — Google Fonts may receive your IP address when fonts are loaded on this site.
analytics, advertising measurement, and cookies
We use Google Analytics 4 and Google Ads conversion measurement to understand how visitors find and use the site, and which campaigns lead to introductory-call, audit-checkout, or redesign-checkout clicks. Google measurement tags load only after you select “accept measurement” in the privacy choices panel.
If you decline, these Google measurement tags do not load. You can change your choice at any time through the “privacy choices” control shown on the site. Your choice is stored in your browser's local storage so the site can remember it.
If you accept measurement and arrive through a campaign or external referring page, we store an allowlisted first-touch record for up to 90 days. It contains campaign parameters, the landing-page path, a query-free external referrer, and a capture date. It does not contain your name, email address, form answers, or arbitrary URL query data. Declining or withdrawing measurement removes that record.
When measurement is accepted, Google may set or read cookies and process online identifiers in accordance with Google's information for sites that use its services. We use this data in aggregate to measure traffic, campaign performance, booking-link clicks, audit-checkout clicks, and redesign-checkout clicks. We do not use it to make decisions about an individual or engagement.
how we use your data
Subscription details are used to send the content you requested. Booking and enquiry details are used to arrange the call, understand the work you want to discuss, and follow up about a possible engagement. Purchase and transaction details are used to process and record payment, arrange the purchased audit or redesign sprint, provide customer support, prevent fraud, and meet accounting or legal obligations. Analytics and campaign data is used to measure site performance and advertising effectiveness. We do not sell or rent personal information.
Server logs are used for security monitoring and to ensure the site operates correctly. They are not used to identify or track individual users.
email subscriptions
Email subscriptions are managed through Resend. When you consent through a Notes, Blog, or Glossary form, your email address is stored as a Resend Contact and added to our main mailing-list segment and the segment for that source. We also record the consent time, signup source and stream, privacy-policy version, and welcome-delivery time on that contact. Resend delivers the immediate welcome email and future messages for the stream you joined.
You can unsubscribe at any time through the link included in mailing-list messages, by replying with “unsubscribe,” or by contacting us at [email protected]. Resend retains suppression information when needed to ensure an opted-out address is not mailed again. A later website-form submission does not automatically reverse a provider-level unsubscribe.
Resend's privacy policy is available at resend.com/legal/privacy-policy.
booking an introductory call
Our booking links open a Google Calendar appointment page. Google processes the contact and scheduling details you enter and sends the calendar invitation, confirmation, and any reminders shown in the booking flow. Aran Labs receives the booking details so we can hold the call and respond to your enquiry.
You can cancel or reschedule through the links in the calendar invitation, or contact [email protected]. Booking a call does not add you to the mailing list.
buying an AI Workflow Audit
Our purchase actions open a Stripe-hosted checkout page. Stripe processes the contact, billing, payment-method, device, transaction, and requested project information you provide to complete the payment, authenticate the transaction, and prevent fraud. Aran Labs receives the customer, project, and transaction information needed to confirm the purchase and arrange the audit or redesign sprint. A purchase does not add you to the mailing list.
Stripe may process transaction information as both a service provider to Aran Labs and for its own legal, security, and fraud-prevention purposes. You can read the Stripe privacy policy.
previous website enquiries
Details submitted through our previous workflow-enquiry form were stored in private durable storage on Railway before a transactional acknowledgement and internal notification were sent through Resend; SendGrid could be used as an optional fallback for the internal notification. These details are used only to evaluate and respond to the enquiry and do not add anyone to the mailing list.
Our data and controls note describes the access, source, training, retention, export, deletion, and exit terms set for client work. The written agreement for each engagement controls that work.
legal basis for processing
Under the General Data Protection Regulation (GDPR), we process your data on the following bases:
- Consent — for email subscriptions. You provide consent by checking the consent box and submitting the subscribe form.
- Consent — for Google Analytics and Google Ads measurement. You provide or withhold consent through the privacy choices panel and can change that choice later.
- Steps prior to entering a contract — to arrange requested calls and review or respond to enquiries you choose to submit.
- Contract — to process a purchase you request, confirm payment, and arrange delivery of the AI Workflow Audit or Website Redesign Sprint.
- Legitimate interest — for server logs and security monitoring, which are necessary for the operation of the website.
your rights under GDPR
As a data subject, you have the right to:
- Access your personal data and request a copy of what we hold.
- Rectification — request correction of inaccurate data.
- Erasure — request deletion of your personal data.
- Restriction — ask us to limit how we process your personal data in certain circumstances.
- Portability — receive your data in a structured, machine-readable format.
- Object to processing based on legitimate interest.
- Automated decisions — ask for human review where a significant decision is made solely by automated means.
- Withdraw consent at any time for email subscriptions or measurement.
To exercise any of these rights, contact [email protected].
your rights under California law
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides additional rights, including:
- Right to know what personal information we collect, use, disclose, and (if applicable) sell or share.
- Right to delete personal information we have collected about you, subject to certain exceptions.
- Right to correct inaccurate personal information.
- Right to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under the CPRA.
- Right to limit the use of sensitive personal information. We do not collect sensitive personal information beyond what is described above.
- Right to non-discrimination for exercising any of these rights.
To exercise any of these rights, contact [email protected]. We will verify your request before responding.
third-party services
This site uses the following third-party services that may process your data:
- Resend — mailing-list contact management, welcome or newsletter email delivery, and notifications for previous website enquiries. Resend privacy policy.
- Railway — website hosting and server logs. Railway privacy policy.
- SendGrid — optional fallback delivery for notifications from previous website enquiries.
- Google Calendar and Google Workspace — appointment scheduling, calendar invitations, reminders, and related email. Google privacy policy.
- Stripe — hosted checkout, payment processing, transaction records, authentication, and fraud prevention. Stripe privacy policy.
- Google Analytics and Google Ads — consent-based website analytics, campaign attribution, and conversion measurement. Google privacy policy.
- Google Fonts — font delivery. Google may receive your IP address. Google privacy policy.
international data transfers
Some of our third-party processors are based in the United States. Where personal data is transferred outside the European Economic Area, it is protected by Standard Contractual Clauses (SCCs) or equivalent safeguards as required by GDPR.
data retention
Email addresses are retained for as long as your subscription is active. If you unsubscribe, we keep only the suppression information needed to honour that choice unless you request deletion. Previous website-enquiry details are normally retained for up to 90 days while we assess and respond, unless a longer period is required for an active engagement or legal obligation. Booking records and related correspondence are normally retained for up to 12 months after the last contact, unless an engagement or legal obligation requires longer. Purchase and transaction records are retained for the period needed to deliver the purchased audit or redesign sprint and meet accounting, tax, fraud-prevention, dispute, or other legal obligations. Analytics event data and server logs follow the configured retention periods of Google Analytics and Railway.
children's privacy
This site is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. In compliance with the Children's Online Privacy Protection Act (COPPA), if we become aware that we have inadvertently collected personal information from a child under 13, we will delete that information from our records as soon as reasonably practicable. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected].
complaints
If you have a concern about how we handle your data, contact [email protected]. You may also lodge a complaint with the data-protection authority that applies where you live or work.
changes to this policy
We may update this privacy policy from time to time. Changes will be posted on this page with an updated effective date.
contact
For any questions about this privacy policy, contact us at [email protected] or by mail at the registered office address listed above.