Home / Privacy Policy
LEGAL / ARRINGTON DIGITAL
How Arrington Digital handles personal information across its website, software, services and communications.
LEGAL / THE DETAILS
Review how personal information is collected, used and protected, along with the choices available to you.
Who we are and what this policy covers
Arrington Digital protects the personal information it handles and never sells it. This Privacy Policy explains what we collect, why we collect it, who we share it with and the choices you have.
“Arrington Digital,” “ADX,” “we,” “us” and “our” mean B.Arren, LLC. DBA/ Arrington Digital, headquartered in Pennsylvania, USA, and its affiliate Arrington Digital Ltd., 60 Knutsford Boulevard, Kingston, Jamaica.
This policy applies to arringtondx.com; our software, including Surge (with the Vicki Ann AI agent), LaunchIQ and other applications, APIs and AI agents; our cloud, data, AI, cybersecurity, marketing, managed services and property network engineering; and communications by email, phone, SMS, web chat, WhatsApp and social media.
When you visit our website, contact us or apply for a job, we are the controller of your information. When a business customer uses our Platform or services to process data about its own employees, applicants, guests or customers, that customer is the controller and we act as its processor or service provider under its documented instructions. If you are connected to a client, contact that business first to exercise your rights.
Information we collect
We collect only what we need to run the website, deliver the Platform and services, and meet legal obligations.
Contact and business details: name, job title, company, email, phone, country and messages you send when booking a call or contacting us.
Account and user data: login email, username, role, permissions, SSO identifiers, MFA settings and preferences. Customer content: files, records, prompts, chat transcripts, reservations, schedules and project data uploaded or generated in the Platform.
Workforce data in Surge may include employee and applicant names, contact details, TRN, NIS, SSN or other tax IDs, pay rates, hours, timesheets, bank details for payroll, benefits elections, résumés and onboarding documents. Our business customer provides this data and we process it as its processor.
Location data may include geo-fenced clock-in location when an employer enables it, and approximate location from IP address. Communications data may include phone numbers, WhatsApp or social profile names and IDs, message content, call recordings and transcripts, and delivery or read status.
Billing data includes billing contacts, invoices and payment history. Card details are handled by our payment processor; we do not store full card numbers. Technical and usage data includes IP address, browser, device, operating system, pages visited, referring URL, feature usage, error logs and security logs. Job applicant data may include CVs, work history, references and interview notes.
Some Platform features may process sensitive data, such as government ID numbers, bank details or, for certain clients, health-related information. We process it only as our customer instructs and as the law allows, with added safeguards. Please do not send sensitive information through the website or general messaging channels unless we ask for it.
How we use information
We use personal information to provide, host, configure and support the Platform and services; run payroll, scheduling, hiring, reservations and other customer-enabled features; respond to inquiries and book demos; operate AI features; secure systems, detect fraud and keep audit logs; analyze usage to fix bugs and improve features; send marketing with the required consent or lawful basis; bill customers and keep financial records; comply with law; and assess job applicants.
Where GDPR, UK GDPR or Jamaica’s Data Protection Act applies, our legal basis may be contract performance, our customer’s instructions, legitimate interests, consent or legal obligation, depending on the purpose.
We do not sell personal information, share it for cross-context behavioral advertising, or use customer content or workforce data for our own marketing.
Artificial intelligence and large language models
Our software uses AI, including large language models, and we tell you when you are talking to an AI agent rather than a person. Examples include Vicki Ann answering calls, texts, web chat and WhatsApp; AI-ranked job candidates in Surge; readiness scoring and insights in LaunchIQ; and content, campaign, search, summarization and custom AI features.
We build our own software and may combine our models with providers of hosted LLMs on AWS, Google Cloud or Microsoft Azure, or direct model APIs. Relevant inputs, such as a guest message or prompt, are sent to the model provider to generate a response. Current AI sub-processors are available on request and in our DPA.
We do not use customer content, workforce data or end-user conversations to train general-purpose AI models. We choose providers that contractually agree not to train on data we send them. We fine-tune on customer data only when that customer asks us in writing, and that model is used only for that customer.
AI agents hand conversations to a person when a guest asks or the agent cannot help. Candidate rankings and scores assist human judgment; our customers—not AI—make hiring, pay and employment decisions. AI output can be incomplete or wrong; check it before relying on it for legal, medical, financial or safety decisions.
AI agent conversations and calls may be recorded, transcribed and stored so a business can review them, resolve disputes and improve service. Where notice or consent is required, we or our customer provide it at the start of the call or chat.
WhatsApp, Meta and other messaging and social platforms
When you message us or a customer through WhatsApp, Facebook Messenger, Instagram or another social platform, that platform and our software both process your messages. We connect to the WhatsApp Business Platform (Cloud API) and other Meta and social APIs on behalf of ourselves or business customers.
We may receive your phone number, profile name, platform user ID, message content (including text, images, voice notes, documents or location you choose to share), timestamps, and delivery or read status. We use it to reply, complete what you asked, keep a business conversation history and meet platform requirements—not for unrelated purposes, sale or data brokerage.
Business-initiated WhatsApp messages, such as confirmations, reminders or offers, are sent only to people who have opted in. Reply STOP or tell the agent you want to stop to end non-essential messages.
Meta and other platforms process your data under their own terms and policies, including WhatsApp’s Privacy Policy and Meta’s Privacy Policy. We do not control their practices. We follow applicable business messaging, platform and developer terms, and delete platform data when it is no longer needed, when a user asks or when the platform requires it.
To request deletion of platform data, email privacy@arringtondx.com with the phone number or account you used. We will delete associated messages and data within 30 days unless the law requires retention or a business customer controls the data; in that case, we will forward your request.
Third-party integrations and sub-processors
We share personal information with vetted service providers under contracts that limit use to our instructions. Providers may include AWS, Google Cloud and Microsoft Azure for hosting; Snowflake, Databricks and Google BigQuery for data platforms; hosted model services and model APIs for AI; WhatsApp Business Platform, SMS and voice carriers and email providers for messaging; Salesforce, including Marketing Cloud and Agentforce, for CRM and marketing; Noyo, QuickBooks Online, Sage Intacct, Unanet, banks and payment processors for benefits, finance and payments; Cal.com and Framer for scheduling and our website; and logging, error-tracking and support tools for security and support.
When you or your organization connect another app—such as payroll, accounting, CRM, calendar or social account—data flows as configured. The other service’s own terms and privacy policy govern its handling, and we are not responsible for its practices.
We may also share information with affiliates, professional advisers, a buyer or successor in a merger or asset sale, and courts, regulators or law enforcement when the law requires it or to protect rights, safety or property. Customers may request a current sub-processor list in our DPA.
International transfers, retention and security
We operate in the United States, Jamaica, the Caribbean, Latin America and Europe. Providers may process data in other countries. For transfers from the EU, UK, Jamaica or another region with transfer rules, we use safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or another legally recognized mechanism.
We keep information only as long as needed: website inquiries and sales contacts up to 3 years after our last interaction; customer content and workforce data for the contract term, then deleted or returned within 90 days unless instructed otherwise or law requires more; payroll, tax and financial records as employment and tax laws require (often 6–7 years); AI agent conversations and call recordings as configured by the customer or 12 months by default; security and audit logs up to 2 years; and our job applicant data up to 2 years after the hiring decision unless you ask us to delete it sooner.
Safeguards include AES-256 encryption at rest, TLS encryption in transit, role-based access control, SSO and MFA, tamper-evident audit logs, network monitoring, vulnerability management and staff confidentiality obligations. No system is completely secure. We notify affected people, customers and regulators about a breach as the law requires.
Your rights and choices
Depending on where you live, you may have the right to access, correct, delete or port personal information, and to object to or restrict how it is used. These rights may arise under Jamaica’s Data Protection Act, 2020; EU and UK GDPR; the California Consumer Privacy Act as amended by the CPRA; and other US state privacy laws.
Email privacy@arringtondx.com to make a request. We verify identity and respond within the time required by law, usually 30–45 days. You may withdraw consent without affecting earlier processing, opt out of marketing using an unsubscribe link, replying STOP or emailing us, and appeal our response or complain to your local data protection authority.
We will not treat you differently for exercising your rights. If we process information for a business customer, we will pass your request to that customer and assist it in responding.
Cookies and similar technologies
Our website uses cookies and similar technologies to make the site work, remember preferences and understand how visitors use it. Where required, we ask for consent before setting non-essential cookies. You can change your choices in our cookie banner or block cookies in your browser; some features may then not work. We honor Global Privacy Control signals where the law requires.
Children
Our website and Platform are intended for businesses and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
Changes to this policy
We may update this policy as our services, technology or the law change. We will post the new version here with a new effective date and, for material changes, notify customers by email or in the Platform before the changes take effect.
Contact us
B.Arren, LLC. DBA/ Arrington Digital, Pennsylvania, USA, and Arrington Digital Ltd., 60 Knutsford Boulevard, Kingston, Jamaica.
Privacy questions and requests: privacy@arringtondx.com. General inquiries: info@arringtondx.com.
YOUR NEXT CHAPTER STARTS HERE
A new initiative, platform refresh or digital experience—we’ll map the right next step together.