Legal

Privacy Policy

Last updated: 11 October 2026

1. Who we are

Arodly is a consumer SaaS platform where people practice and improve their negotiation skills through structured, gamified scenarios. Arodly is operated by Arodly. Contact: [email protected] Website: https://www.arodly.com

2. Who this policy applies to

This policy applies to all visitors and registered users of arodly.com. By creating an account or using the platform, you agree to the practices described in this policy. Arodly is not intended for use by anyone under the age of 16. By creating an account, you confirm that you are at least 16 years old. If we become aware that a user is under 16, we will delete their account and associated data.

3. What data we collect

Data you provide directly

Email address — collected at signup, used for authentication and account communications

Password — hashed and stored securely by Supabase Auth; we never see or store your plain-text password

Nickname — a public display name you choose when setting up your profile

Avatar selection — a numbered avatar choice used on your public profile

Full name and professional details (optional) — your full name and how you describe yourself, such as primary function, role level, industry and company size. These are private, are never shown on your public profile, and you can leave them blank

Content you create — custom scenarios, club details, and (if you become a mentor) your mentor profile, rates, CV link and LinkedIn link, plus mentor bookings and reviews

Privacy settings — such as whether your account is private, and which people you follow or who follow you

Messages you send us — anything you write in the contact form or in an email to us

Data generated through use

Gameplay statistics — total points, games played, wins, losses, draws, current streak, last played date, and daily usage counters used to apply free-plan limits

Match history — scenario name, opponent (if PvP), outcome, and date for each completed match

Negotiation chat content — messages sent during PvAI and PvP matches

Saved negotiations (Pro users only) — transcripts you choose to save

Negotiation Insights data (Pro users only) — per-match scores across five parameters, detected negotiation style, improvement tips, and trend data

Activity data — dates on which you played, used to generate your activity calendar

Consent records — the date you accepted our Terms of Service, and whether and when you opted in to our mailing list

Billing references (Pro users only) — your Stripe customer and subscription identifiers, plan, and billing period. We do not hold your card details

Security information — our login provider (Supabase Auth) records technical details such as IP address and browser type when you sign in, to keep accounts secure

Data from people who are not account holders

Newsletter and waitlist sign-ups — if you give us your email address on our website to receive updates, we store that email address so we can contact you

Data we do NOT collect

Phone number

Payment card details — handled entirely by Stripe — we never see or store card information

Precise location data — we do not ask for your location. The only location-related information is the IP address recorded by our login provider, as described above

Browser fingerprints or device identifiers

Third-party tracking or advertising data

4. How we use your data

To provide the service — authentication, gameplay, scoring, match history, and profile display

To improve the service — understanding how the platform is used in aggregate to make product decisions

To communicate with you — account-related emails such as password reset and email confirmation, replies to your contact messages, and (only if you opted in) product updates and newsletters, which you can unsubscribe from at any time

To enforce our Terms of Service — including detecting and acting on abuse or policy violations

To keep the platform secure — including bot protection at signup and detecting suspicious activity

To process payments (Pro users) — we pass your email to Stripe to manage subscriptions

We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as described in Section 5.

5. Who we share your data with

Service	Purpose	Data shared
Supabase	Database, authentication, and real-time infrastructure	All user and gameplay data
Vercel	Hosting and deployment	Request logs and server-side rendering
Anthropic	AI opponent and AI-generated feedback (Claude API)	Negotiation chat messages and transcripts sent to the AI during PvAI matches, debriefs and Insights
Stripe	Payment processing (Pro users)	Email address and subscription details
Resend	Sending emails (account emails, contact form messages, newsletters)	Email address and the content of the email
Cloudflare	DNS and bot protection (Turnstile) at signup	Technical request information such as IP address

These companies process data on our behalf to run Arodly. We may also disclose information if required by law.

6. Public data on Arodly

The following information is visible to other signed-in users on the platform: nickname and avatar, ranking tier and total points, win/loss/draw record, current streak, activity calendar, recent match history, and negotiation style (Pro users). Custom scenarios, clubs and mentor profiles you choose to publish are visible to other users as well. If you set your account to private, your profile details are visible only to people you approve as followers. Your email address, full name and professional details are never publicly visible. Match transcripts are visible only to you and (for PvP matches) your opponent. If a player deletes their account, they appear to other users as "Deleted user".

7. Data retention and account deletion

We retain your data for as long as your account is active. You can delete your account at any time from your settings. Deletion starts immediately and takes effect straight away. When you delete your account, we permanently remove your login, profile, gameplay statistics, match history, follows, clubs you created, mentor data, saved negotiations and custom scenarios, and your Insights data. Player-vs-player matches involve two people. After you delete your account, the messages and finished match record from those matches may remain so that your opponent keeps their own history, but they are disconnected from you and shown as "Deleted user". Unfinished match rooms are closed or removed. Some records are kept after deletion where we are required to by law. For example, Stripe keeps payment and invoice records for tax and accounting purposes. Backups held by our infrastructure providers are overwritten on their normal schedule. Emails you sent us through the contact form may remain in our mailbox until we delete them. You can ask us to delete them by contacting us.

8. Your rights

Depending on where you are located, you may have the right to access, correct, delete, or export your personal data, and to object to or restrict its processing. You can also withdraw your consent to marketing emails at any time. To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. New Zealand users may also contact the Office of the Privacy Commissioner at privacy.org.nz. EU/UK users may contact their local data protection authority.

9. Cookies and local storage

Arodly uses cookies for authentication session management only. These are set by Supabase Auth and are necessary for the platform to function. Our bot-protection check at signup (Cloudflare Turnstile) may also set technical cookies or tokens needed for the check to work. We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

10. Data security

Data in transit is encrypted via HTTPS/TLS

Data at rest is encrypted, via our infrastructure provider Supabase

Passwords are never stored in plain text — Supabase Auth handles hashing

Row-Level Security is enforced on all database tables

Server-side secrets are never exposed to the browser

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at [email protected].

11. International data transfers

Arodly is operated from New Zealand. Your data may be stored and processed in data centres located outside New Zealand, including in the United States and European Union, by our infrastructure providers. These providers maintain appropriate data transfer mechanisms in compliance with applicable law.

12. Children

Arodly is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has created an account, please contact us at [email protected] and we will delete the account promptly.

13. Changes to this policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify registered users by email.

14. Contact

For any privacy-related questions, requests, or complaints: Email: [email protected] Website: https://www.arodly.com