Aries — How We Use Your Data

1. What Data We Access

When you connect a third-party system such as Zendesk, MaintainX, QuickBooks, or a Google or Microsoft account, Aries accesses the following data to provide its core features:

• • Record metadata — subjects, titles, senders, requesters, timestamps, statuses, and labels from your connected systems
• • Record content — message bodies, ticket descriptions, work order details, and invoice data, used for AI classification, summarization, and draft generation
• • Calendar data — where you connect a calendar provider, events and availability (read-only), so AI-drafted replies can account for your schedule (e.g., suggesting meeting times). Aries does not create, modify, or delete any calendar events.
• • Account info — your name and email address for display and sign-off in drafts

We do not store content from your connected systems long-term. Content is processed in real time to generate classifications, summaries, and drafts, then discarded. Only metadata like workflow state and preferences are persisted.

2. How We Process Data from Your Connected Systems

Aries uses AI to classify, summarize, and draft responses to items in your connected systems. Here's how that works:

• • Content from your connected systems is sent to approved AI providers solely to generate the specific output you requested — such as a classification, summary, or draft reply.
• • These providers are contractually prohibited from retaining your data or using it for model training.
• • We do not use data from your connected systems to train, fine-tune, or improve any AI models — ours or third-party.
• • AI outputs are probabilistic. You should always review drafts and classifications before acting on them.

3. What We Store

Aries stores the minimum data needed to operate:

• • User identifiers and email addresses
• • Your preferences and settings (workflow configuration and notification preferences)
• • Connection records (which services are connected and what access each grants)
• • Action records (tracking which drafts and updates were created, not the content)

All data is stored in Google Cloud SQL with encryption at rest using Google-managed encryption keys. Sign-in credentials are securely managed by Clerk and never stored directly by our application, and credentials for connected services are stored in that same encrypted database.

4. Authentication & Access Control

Your security is built into the architecture:

• • No passwords — Aries does not manage passwords. You sign in through Google or Microsoft OAuth via Clerk.
• • Server-side enforcement — all access controls are enforced on our servers, never on the client. Every API request requires a valid session token.
• • Resource-level authorization — users can only access their own data. Privacy rules are enforced at the database query level.
• • Session tokens — we use secure, short-lived session tokens (not static API keys). Sessions are invalidated on logout.

5. Infrastructure & Security

Aries runs on Google Cloud with enterprise-grade protections:

• • Encryption everywhere — all data is encrypted in transit (TLS) and at rest
• • Secure deployments — automated CI/CD pipeline with reproducible builds. No manual deployments.
• • No debug modes in production — developer consoles and debug output are disabled
• • DDoS protection — Google Cloud's built-in rate limiting and denial-of-service protections
• • Regular backups — managed database backups with point-in-time recovery

6. Third-Party Services

We use a small set of trusted, vetted services. All are contractually required to protect your data:

• • Clerk — authentication and session management
• • Google Cloud — hosting, database, and infrastructure
• • Google Gemini — AI inference for classification, summarization, and drafting across connected systems. Contractually prohibited from retaining your data or using it for training.
• • Resend — transactional emails (welcome emails and notifications)
• • Google Analytics & LogRocket — usage analytics and session recording for improving the product. Google Analytics receives usage events, not content from your connected systems. LogRocket session replays may include content displayed in the Aries interface and are used solely to diagnose product issues.

7. What We Don't Do

We want to be clear about what Aries will never do with your data:

• • We never sell your data to anyone
• • We never use your data for advertising or profiling
• • We never train AI models on your identifiable data
• • We never store content from your connected systems beyond what's needed for immediate processing
• • We never expose sensitive information like tokens or credentials in URLs
• • We never use deprecated or insecure technologies (Flash, ActiveX, Java applets, LDAP, etc.)
• • We never act in your connected systems without your authorization — AI-drafted replies are saved for your review, and automated actions run only in workflows you have configured

8. Your Control

You are always in control of your data and your Aries experience:

• • Revoke access anytime — disconnect any connected service from Aries at any time. If you have connected a Google or Microsoft account, you can also revoke access from your Google or Microsoft account permissions
• • Toggle features — enable, pause, or reconfigure individual workflows at any time from within Aries
• • Request deletion — email support@tundraailabs.com to request full data deletion at any time
• • Export your data — request a copy of your data by contacting support

9. Compliance

Where you connect Google services (such as Gmail or Google Calendar), Aries's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• • Google API Limited Use Policy — where Google services are connected, Aries fully complies with Google's requirements for apps that access Google user data
• • Encryption — all data encrypted at rest and in transit
• • Access controls — least-privilege access enforced at the server and database level
• • Audit logging — operational logs record authentication and configuration events without logging sensitive data
• • Backups — managed database backups ensure data can be restored in a timely fashion

10. Learn More

For the full legal details, please see our Privacy Policy and Terms of Service. If you have questions about how we handle your data, contact us at support@tundraailabs.com.