ARAI Agent personal data processing policy
Version 1.6 of 5 October 2026. English translation of the published policy.
Contains information under Article 24 of Kazakhstan Law No. 94-V of 21 May 2013 “On Personal Data and Their Protection” and a notice under Kazakhstan Law No. 230-VIII of 17 November 2025 “On Artificial Intelligence”.
1. Data controller
CODEALIVE LTD (England and Wales, Company Number 16517721, address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom). Service: ARAI Agent, arai.build. Personal data contact: support@arai.build.
2. Data, purposes and retention
Processing is automated. Data is stored in a database in the Republic of Kazakhstan.
| Personal data | Purpose | Source | Retention |
|---|---|---|---|
| Mobile phone number, surname, first name, patronymic (if any), workplace (if provided), interface language | Account, sign-in code delivery, quota tracking | Sign-in form; sign-in number also from “Share phone number” in the ARAI Telegram bot | Until account deletion, including automatic deletion after 3 years without sign-in |
| Chat messages and conversation history linked to the account | Providing the service | Entered by you | Until you delete the conversation or account |
| Uploaded drawings (DWG) and resulting PDFs | Conversion at your request | Uploaded by you | 30 days |
| Consent record (text version, date, IP address, browser) | Evidence of consent | Automatically at registration | Until account deletion |
| Phone-to-Telegram link (hashed phone number, Telegram chat and user identifiers) | Sign-in code delivery in Telegram | “Share phone number” in the ARAI bot | Until account deletion or blocking the bot |
| Sign-in code delivery log (hashed phone number, channel, outcome) | Preventing abuse | Automatic | 90 days |
| IP address, session cookies, browser type, request times | Service operation, limits, security | Automatic | Up to 30 days |
| Visits to arai.build: pages viewed and actions, referral source, device and browser details, IP address, Yandex Metrica cookies | Visitor statistics, site improvement, advertising evaluation | Automatically via Yandex Metrica | Under Yandex Metrica terms (section 3) |
| Usage information (message and conversion counts) | Quota tracking | Automatic | 1 year |
| Audio recording dictated into chat | Speech-to-text at your request | Recorded by you through the microphone | In ARAI, for the request duration; at the provider, under its terms (section 3) |
After deletion, copies in backups are destroyed within 14 days. Audio is not used for voice identification. Other data (individual identification numbers, identity documents, payment details) is not collected. Do not include other people's personal data in messages or files.
3. Third-party and cross-border transfers
Account data (phone number, full name, workplace, IP address) is transferred to third parties only to deliver sign-in codes and host the service on servers in the Republic of Kazakhstan. Full name and workplace are not transferred outside Kazakhstan; IP addresses are transferred only in the case described below for arai.build.
The arai.build product page uses Yandex Metrica (YANDEX LLC, Russia). It uses cookies and collects visit information: pages viewed and actions, including recordings of page interactions, referral source, device and browser details, and IP address. Contact details entered in the access-request form are excluded from recordings: the contents of those fields are hidden from the counter. Visit information is processed on Yandex servers outside Kazakhstan (cross-border transfer) under its terms: https://yandex.ru/legal/confidential. The Service itself — chat and account at beta.arai.build — has no counter. You can opt out by blocking cookies in your browser or installing the Yandex Metrica opt-out extension: https://yandex.ru/support/metrica/ru/general/opt-out.
Sign-in codes are delivered through Telegram (Telegram FZ-LLC, UAE). You share your number with the ARAI bot using “Share phone number”; Telegram then processes the number, your Telegram account identifier and sign-in code messages on its servers outside Kazakhstan (cross-border transfer), under its own terms. This transfer takes place with your consent.
Your messages, uploaded files, dictated audio and search queries — without the phone number, full name and workplace from your profile — are sent for processing to third-party artificial intelligence, search and file conversion providers outside Kazakhstan, including countries that do not ensure personal data protection. If you include personal data in that content, it will be transferred with it. This transfer takes place with your consent. OpenRouter also receives a stable account or session identifier to prevent abuse. It is sent separately from the message text.
ARAI processes audio during the request and does not retain it in its own file storage. Speech recognition providers may retain it under their terms. Soniox receives the uploaded recording; after processing, ARAI requests deletion of the recording and transcript, but immediate deletion is not guaranteed if the provider is unavailable or returns an error.
When you select “Publish conversation”, the text up to and including the selected answer becomes available to anyone with the link. Publishing a later answer extends the same link. Attachments and tool results are not published, but personal data included in messages remains in the published text. Closing the system share dialog does not revoke the link. Revoke it under “Account → My public links”, or by deleting the conversation or account. Copies already saved by recipients cannot be retrieved.
4. Artificial intelligence
The service uses an artificial intelligence system: answers are AI-generated text, may contain errors and do not replace official standards. The Service does not make decisions with legal consequences for you on the basis of automated processing.
5. Your rights
You may ask whether we hold your personal data and obtain the information in section 2, request correction, blocking or destruction, withdraw consent (ending access to the Service), and delete your account and conversations in the interface. Send requests to support@arai.build or through chat; responses are provided within the periods established by law. You may also contact the authorised personal data protection body of the Republic of Kazakhstan.