Privacy Policy

Effective Date: October 23, 2026
Last Updated: October 23, 2026

Arailens SL ("we," "our," or "us") develops and operates the Nera OS products, including the MARI application for iOS, Android and the web (the "App") and the website neraos.com (the "Website"), together the "Services". This Privacy Policy explains what personal information we collect when you use the Services, why we collect it, who we share it with, and what rights you have.

This Privacy Policy applies to all products and services developed and provided by Arailens SL, including products we launch in the future. Before we launch a new product or start using your information for a new purpose, we will update this policy and inform you of the change.

This policy is not a contract and does not ask for your consent. Where we need your consent, for example for analytics cookies on the Website, we ask for it separately, and you can refuse or withdraw it at any time.

On-premises installations. If your employer runs MARI on its own servers, your employer operates the system and decides how your information is processed, and its own privacy notice applies. In that case, we have access to your information only if your employer asks us for support.

1. Information We Collect

1.1 Information You Provide in the App

• Account information: name, work email address, phone number, role and team
• Login credentials: your password is stored only in hashed form
• Check-in content: what you say or write in your check-ins and chats with MARI (voice is converted to text), files you attach, and the information derived from them, such as the issues, updates and blockers you report, summaries and reports
• Location you mention: if you tell MARI where you are, for example which site you work at, this becomes part of your check-in content. If a feature needs your device's location, we ask for your permission first and use it only for that feature

1.2 Information From Your Employer

If your employer has given you access to MARI, your employer may provide us with your name, work email address, phone number, role, team and work schedule, so that MARI can schedule your check-ins.

1.3 Automatically Collected Information

• Device information: device model, operating system and app version, and the token used to send you push notifications
• Usage data: features you use and when
• Log data: IP address, access times, errors and performance data

1.4 Voice Check-Ins

We do not store recordings of your voice. When you use a voice check-in, your voice is streamed to our AI provider, Google Vertex AI, and converted to text in real time. We keep the text, not the audio.

To keep a longer conversation running, Google temporarily caches the session data, including audio, for up to 24 hours and then deletes it. If Google's automated safety systems flag a request as possible abuse, Google may keep it for up to 90 days to investigate. Google does not use this data to train its models.

We analyse only the words you say. We do not analyse the tone, pitch or other characteristics of your voice, and we do not use your voice to identify you or to infer your emotions.

1.5 Emotional Tone of Check-In Text

If it is enabled for your organisation, MARI estimates the emotional tone of individual statements in the text of your check-ins, for example whether a statement sounds frustrated or positive. This analysis uses only the words, not your voice. Its results are visible only to authorised Arailens staff, are used to understand and improve how our Services work, and are not used to make decisions about you.

1.6 Website and Contact Forms

When you visit the Website, our hosting provider processes technical data, such as your IP address, browser and the pages you visit, to deliver the Website and keep it secure.

When you send a request through a form on the Website, we collect the details you enter: your name, company, email address, phone number (optional), team area, preferred date, time and time zone for a call, and your message. The fields marked as required are needed to reply to you; without them, we cannot process your request.

1.7 Cookies and Similar Technologies

The Website uses the following cookies and similar technologies:

We set the analytics cookie only after you click "Accept" in the cookie banner. You can change your choice at any time with "Cookie settings" at the bottom of every page of the Website.

1.8 Information We Do Not Collect

• Recordings of your voice (see section 1.4)
• Biometric voice prints or voice signatures
• Contact lists or phone book data
• Photos or media from your device, unless you choose to share them

2. How We Use Your Information

• Providing the Services: to run your check-ins, turn them into reports, issues and summaries, and deliver them to the managers your employer has chosen
• Account and access: to verify your identity and manage your account
• Communication: to send you notifications, operational messages and replies to your support requests
• Quality assurance: an AI model reviews a random sample of completed check-ins (about one in four) to check that the summaries and reported issues match what was said. We use the results only to improve our Services
• Security and technical operation: to detect and fix errors and security issues. Our technical logs include the text of conversations with MARI; they are kept for 30 days and only a limited number of authorised staff can access them
• Improving our Services: to improve MARI's questions, features and reliability, based on quality reviews and usage data. We do not train AI models on your information, and our AI provider does not use it to train its models
• Responding to requests: to reply to requests you send through the Website or by email and to prepare offers for your company
• Website analytics: to understand how the Website is used, only if you have accepted analytics cookies
• Compliance: to comply with legal obligations and enforce our terms

We do not send marketing emails. If we start, we will ask for your consent first.

We use your information only for the purposes described in this policy. We use information collected in one of our products to provide or improve another only where this is compatible with the purpose for which it was collected and is described in this policy.

MARI is an AI system and tells you that you are talking to an AI. Its reports are read and acted on by people. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects on you.

3. Data Sharing and Disclosure

3.1 Your Employer

If you use MARI through your employer, the managers your employer has chosen receive reports based on your check-ins. Your employer is responsible for how it uses this information within its organisation.

3.2 Service Providers

We share information with providers who help us run the Services:

• Cloud hosting of the App and its database, in the European Union
• AI processing: Google Vertex AI, in the European Union by default
• Email delivery
• Push notifications: Apple and Google
• Network delivery and security: Cloudflare
• Website hosting and Website analytics: Lovable

These providers may use your information only to provide their services to us, with one exception: our Website host, Lovable, also uses technical data about Website visits, such as IP address, approximate location, browser and the pages visited, for its own security, analytics and product development, as described in Lovable's privacy policy.

Notifications we send to our own team about technical problems or support requests contain only technical identifiers, not your name or messages. You can request a list of our current service providers at privacy@arailens.com.

3.3 Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Valid legal processes (court orders, subpoenas, search warrants)
• Government or regulatory requests
• Protection of our rights, property, or safety, or that of our users
• Investigation of fraud, security issues, or technical problems

3.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, user information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice in our Services of any such change in ownership.

3.5 Data We Never Share

We will never sell, rent, or trade your personal information to third parties for their marketing purposes.

4. Data Storage and Security

4.1 Where Your Information Is Stored

• App data, including check-in content, is stored on servers in the European Union
• AI processing runs in the European Union by default; see section 7 for the exceptions
• The Website is hosted by Lovable on servers in the European Union and delivered through Cloudflare's global network

4.2 Security Measures

• Encryption of data in transit (TLS) and at rest
• Administrative access to our systems only through a private network, with individual keys
• Firewalls that block all access that is not explicitly allowed
• Automatic security updates
• Signed and verified software releases
• Restricted access to production data and technical logs
• Regular security audits and vulnerability assessments
• Employee training on data protection and privacy

4.3 Data Retention

We keep personal information only for as long as we need it for the purposes described in this policy. In particular:

• Check-in content and insights: while your employer's subscription is active. When it ends, we delete or anonymise this information within 90 days
• Account information: while your account is active, and for up to 90 days after it is deleted
• Requests sent through the Website: for up to 24 months after our last contact, unless we start working together
• Technical logs and backups: up to 90 days
• Voice recordings: never stored by us (see section 1.4)

We keep some information longer only where the law requires it, for example invoices and contracts. Anonymised information, which can no longer be linked to you, may be kept to improve our products.

5. Your Rights and Choices

5.1 Access and Control

You have the right to:

• Access: request a copy of the personal information we hold about you
• Correction: update or correct inaccurate personal information
• Deletion: request deletion of your personal information (subject to legal retention requirements)
• Portability: receive your information in a structured, machine-readable format
• Restriction: request that we restrict the processing of your personal information
• Objection: object to processing based on our legitimate interests

To exercise these rights, contact us at privacy@arailens.com. We reply within one month. If you use MARI through your employer, you can also contact your employer.

5.2 Consent Withdrawal

Where we process your information based on consent, you may withdraw that consent at any time, for analytics cookies with "Cookie settings" at the bottom of every page of the Website. This does not affect the lawfulness of processing based on consent before withdrawal.

5.3 Do Not Track

Our Services do not respond to "Do Not Track" signals. We do not track you across third-party websites.

6. Children's Privacy

Our Services are not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you become aware that a child has provided us with personal information, please contact us, and we will take steps to delete such information.

7. International Data Transfers

App data, including check-in content, is stored and processed in the European Union, with these exceptions:

• Push notifications are delivered through Apple and Google, whose services may process the notification text outside the European Union
• At the request of a customer company, AI processing for its employees may run in another region
• Some providers of the Website, such as our hosting provider and Cloudflare, may process data outside the European Economic Area

Where information is processed outside the European Economic Area, it is protected by an adequacy decision of the European Commission, such as the EU–U.S. Data Privacy Framework, or by the Standard Contractual Clauses approved by the European Commission. You can request a copy of these safeguards at privacy@arailens.com.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the new Privacy Policy in the App and on the Website
• Updating the "Last Updated" date at the top of this policy
• Sending an email notification for significant changes (if you have provided an email address)

If a change requires your consent, we will ask for it before the change applies to you.

9. Third-Party Links

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

10. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), our legal basis for processing personal information includes:

• Contract Performance: processing necessary to perform a contract with you, or to take steps at your request before entering into one, for example when you request a trial or a call through the Website
• Legitimate Interests: providing MARI check-ins to the employees of the companies that use it, quality assurance, security and technical operation, improving our Services, and replying to business enquiries. You can object to this processing at any time (see section 5.1)
• Consent: analytics cookies on the Website and your device's location
• Legal Obligation: processing required to comply with legal requirements

11. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Arailens SL
Calle del Doce de Octubre, 11, 28005 Madrid, Spain
NIF: B21899273
Email: privacy@arailens.com
Website: neraos.com

You also have the right to lodge a complaint with a data protection authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD), www.aepd.es.

12. Voice Data Processing – Technical Details

We provide AI-powered voice check-ins without ever creating or keeping recordings of your voice ourselves.

Your privacy matters to us. We are committed to protecting your data and being transparent about our practices.