Arette Privacy Policy
The data we collect, how it's used, and who we share it with. We care about your privacy and want to help you understand how we collect, use, and share your personal information across our creative portfolio showcase, freelance service marketplace, Direct Contracts, escrow instructions, recruiter ATS tools, and educational classrooms.
1. Overview & Scope
This Privacy Policy explains how and why Arette collects, uses, and shares personal information when you interact with or use our Site or Service. It also includes any information Arette collects offline or through direct communications in connection with the Service, which we may combine with information from the Site and Service.
When we say “Arette”, we mean Arette Technologies Ltd. (incorporated and registered in England and Wales, United Kingdom) and its operating subsidiary Arette Technologies Nigeria Limited (registered with the Corporate Affairs Commission, Federal Republic of Nigeria), along with affiliates including Arette Escrow Services. When we say “Site”, we mean https://arette.xyz, and when we say “Service”, we mean the Site plus any websites, features, applications, widgets, or online services owned or controlled by Arette.
Arette Technologies Ltd. acts as the primary Data Controller for personal data processed under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (DPA 2018), and Arette Technologies Nigeria Limited coordinates processing for users and commercial transactions within the Federal Republic of Nigeria under the Nigeria Data Protection Act 2023 (NDPA 2023). As part of the Service, Arette provides a creative showcase and freelance marketplace which facilitates interactions between users. Users of the Service may be Clients (Buyers), Creators, Freelancers, Agencies, Enterprise Recruiters, Academy Students, or Site Visitors (as each is defined in our Terms of Service / User Agreement). This Privacy Policy applies to Arette’s processing of personal information where Arette determines the purposes and means of processing. It does not apply to processing of information by Users themselves, who may be independent controllers of the personal information they access through the Service (for instance, when an enterprise recruiter evaluates applicant resumes or when a client manages collaborator access). For information about how other Users process your personal information, please contact them directly.
This Privacy Policy uses industry-standard technologies and was developed in connection with the World Wide Web Consortium's Web Content Accessibility Guidelines, version 2.1 (WCAG 2.1). If you wish to print this policy, please do so from your web browser or by saving the page as a PDF.
2. Information Collection
a. Information You Provide to Us: When you use the Service, you may provide us with information about you. This may include your name and contact information, financial information to make or receive payment for services obtained through the Arette platform, or information to help us fill out tax forms (such as W-9, W-8BEN, or VAT documentation). When you use the Service, we may also collect information related to your use of the Service and aggregate this with information about other users. This helps us improve our Services for you. You may also provide us with information about your contacts or team members if, for example, you invite collaborators to a workspace project room. Agencies and Teams may also provide us with information about Freelancers and Creators associated with the Agency.
2.a Categories of Personal Information We Collect
Depending upon our relationship with you, we may collect the following categories and types of personal information from and about you:
| Categories of Personal Information | Examples of Personal Information Collected | Categories of Sources | Business Purpose for Collection |
|---|---|---|---|
| Identifiers | Name, Date of Birth, Social Media links, Profile Data, Avatar, IP Address. | Directly from You; Cookies & Tracking Technologies; Third Parties (SSO providers, Google, GitHub). | Developing, Improving, and Providing the Service, Identification, Communications, Marketing, Analytics, Security, Legal Obligations. |
| Contact / Account Profile Information | Email Address, Home Address, Billing Address, Location/Country, Phone Number. | Directly from You; Third Parties. | Developing, Improving, and Providing the Service, Identification, Communicating with You, Marketing, Analytics, Security, Legal Obligations. |
| Sensitive Personal Information / Government IDs | Driver’s License, State ID or Passport Number (for Verified Talent badge), VAT ID, Tax ID (TIN / SSN / EIN / National ID), Citizenship. | Directly from You. | Improving and Providing the Service, Identity Verification, Detecting Fraud, Legal, Tax, and Regulatory Obligations. |
| Commercial Information | Transaction Data including services offered, considered, or purchased; Scope of Work (SOW) records; milestone delivery logs; direct contract proposals; ARC token tipping records. | Directly from You; Contract counterparties; Payment processors. | Developing, Improving, and Providing the Service, Milestone Escrow Holding, Invoicing, Communications, Marketing, Analytics, Security, Legal Obligations. |
| Financial Data / Payment Information | Tokenized credit/debit card references, payment gateway transaction IDs, creator payout bank details (via Stripe Connect / Wise), crypto payout wallet addresses, ARC token ledger balances, Credit ledger balances. | Directly from You; Payment Gateways (Stripe, Paystack, Flutterwave, Wise). | Improving and Providing the Service, Milestone Escrow Administration, Creator Payouts, Subscription Billing, ARC Tipping, Security, Legal Obligations. |
| Internet or Device Network Activities | Unique device and app identifiers, browsing history, operating system, referring URL, search terms entered, interaction durations, response times, download errors. | Directly from You; Cookies & Tracking Technologies; Analytics providers. | Developing, Improving, and Providing the Service, Identification, Communications, Marketing, Analytics, Security, Legal Obligations. |
| Geolocation Information | Approximate location (city, state, country derived from IP address or self-declared profile location). | Directly from You; Cookies & Tracking Technologies. | Regional Currency Formatting, Talent Search Filtering, Recruiter Geographical Insights, Security, Legal and Compliance Obligations. |
| Customer Support & Dispute Records | Support ticket logs, dispute mediation evidence, order resolution submissions, policy appeal records. | Directly from You; Service Providers; Counterparties in mediation. | Resolving Order Disputes, Identification, Communications, Security, Legal, Compliance and Regulatory Obligations. |
| Platform Communications & Workspaces | Direct message chat logs, project workspace messages, design feedback annotations, deliverable file attachments. | Directly from You, Users with whom you communicate. | Enabling Order Collaboration, Accountability, Security, Legal, Compliance and Regulatory Obligations. |
| Professional Information & Recruiter ATS Data | Work history, earnings/rates, resumes/CVs (PDF uploads), cover letters, screening answers, recruiter interview notes, candidate hiring pipeline status. | Directly from You; Enterprise Recruiters; ATS Integrations (BambooHR, Greenhouse, Lever). | Powering Recruiter Job Boards, Candidate Pipeline Management, Marketing, Analytics, Security, Legal Obligations. |
| Academy & Maya AI Learning Records | Course enrollments, lesson progress, quiz scores, certificate verification credentials, and prompts submitted to Maya AI assistant. | Directly from You; Course Instructors. | Issuing Verifiable Digital Certificates, Delivering Contextual Educational Feedback, Analytics, Security, Legal Obligations. |
| User-Generated Content & Ratings | Visual project showcases, 3D renders, code snippets, articles, community critiques, feedback, client ratings, and job/service listings. | Directly from You; Other users. | Talent Rankings, Identification, Communications, Marketing, Analytics, Security, Legal Obligations. |
2.b Non-Identifying Information, Hashed Information, and De-Identified Information
Non-Identifying Information / Usernames: We also may collect other information that does not identify you directly, such as zip codes, demographic data, information about your use of the Service, and general project-related data (“Non-Identifying Information”). We may combine information collected from Arette users, whether they are registered or not (“Arette Users”). In some cases, we may render Personal Information (generally, email address or certificate credentials) into a form of Non-Identifying Information referred to in this Privacy Policy as “Hashed Information.” This is typically accomplished using a cryptographic mathematical process (commonly known as a hash function) to convert information into a code. While the code does not identify you directly, it may be used to verify credentials or connect your activity across platform services.
Combination of Personal and Non-Identifying Information: We may combine your Personal Information with Non-Identifying Information, but Arette will treat the combined information as Personal Information.
De-Identified Information & Anonymous Community Voting: We may also de-identify or aggregate information and convert it into non-personal information so that it can no longer reasonably be used to identify you (“De-Identified Information”). For example, when users participate in project voting with the Vote Anonymously toggle enabled, personal voter identifiers are permanently decoupled from the public showcase leaderboard. The mathematical audit weight and timestamp are retained in de-identified form to preserve the permanent mathematical integrity of historical rankings. We will maintain and use De-Identified Information in de-identified form and will not attempt to reidentify the information, except to confirm our de-identification processes or unless required by law.
2.c Information Collected Automatically
Like other online companies, we receive technical information when you use our Services. We use these technologies to analyze how people use the Service, to improve how our Site functions, to save your log-in session and interface preferences (such as selected currency and theme), and to serve you with contextual content or advertisements that may interest you.
Arette and its partners use cookies or similar technologies to analyze trends, administer the website, track users’ movement around the website and web applications, and to gather demographic information about our user base as a whole. The technology used to collect information automatically from Arette Users may include cookies, web beacons, pixel tags, local storage, and embedded scripts. In addition, we and our marketing partners, affiliates, analytics, and service providers may use a variety of other technologies that collect similar information for security and fraud detection purposes, and we may use third parties to perform these services on our behalf.
2.d Client-Initiated Direct Contracts & Public Checkouts
Arette provides features that allow creators and clients to initiate Direct Contracts and access public checkout links (/offer/:shareCode). When interacting with a Direct Contract, we collect client contact information, project milestone scopes, escrow funding authorizations, deliverable submission files, and client review approvals. If a client accesses a public offer link without having a pre-existing registered account, an authorized guest checkout session is provisioned strictly to execute the escrow deposit and facilitate milestone contract fulfillment.
2.e Analytics Providers, Ad Servers and Similar Third Parties
We may work with advertising agencies, analytics vendors, and ad networks (such as Google AdSense) who use technology to help us understand how people use our Site, to serve advertisements on our platform or other websites, and to evaluate the effectiveness of promotional campaigns. In addition, Arette operates an internal self-serve advertising engine allowing creators and companies to sponsor services and job postings. These service providers may set and access their own tracking technologies on your device (including cookies and pixel tags) and may collect information regarding your visits to the Service. Subscribers to Pro and Agency membership tiers have the ability to toggle third-party ad displays off in Settings.
2.f Do Not Track Signals & Global Privacy Control (GPC)
Please note that your browser setting may allow you to automatically transmit a “Do Not Track” (DNT) signal to websites and online services you visit. Arette does not generally alter its practices when it receives a standard DNT signal. However, Global Privacy Control (GPC) is a recognized browser-based signal that allows you to inform websites of your privacy preferences regarding ad trackers. Arette honors valid GPC signals on a per-browser basis as an opt-out of the “sale” or “sharing” of personal information for targeted advertising in accordance with applicable data protection laws.
2.g Children's Privacy
The Service is a general audience platform intended for users 18 years of age and older. We do not knowingly collect Personal Information from anyone younger than age 18. If we become aware that an individual younger than 18 has registered an account or provided us with Personal Information, we will use commercially reasonable efforts to delete such information from our files. If you are the parent or legal guardian of a child younger than age 18 and believe that Arette has collected Personal Information from your child, please contact us at privacy@arette.xyz.
3. Use of Information
We, along with our service providers, may use your data for the purposes described below. As part of these purposes, your data may be processed using Artificial Intelligence technologies (“AI”), including generative AI and our conversational assistant Maya AI.
3.a We Use Information We Collect:
- To develop, provide, and improve the Service, complete your transactions, process milestone escrow releases, address your inquiries, process your registration, verify the information you provide is valid, and for compliance and internal business purposes.
- To administer and develop our business relationship with you and, if applicable, the corporation, agency, or other legal entity you represent.
- For the purposes disclosed at the time you provide your information, with your consent, and as further described in this Privacy Policy.
- To contact you with administrative communications and Arette newsletters, product updates, transactional alerts, and marketing or promotional materials. To tailor content we display to you and offers we may present to you, both on the Service and elsewhere online.
- To prepare internal statistics reports and platform utilization benchmarks.
- To honor our contractual commitments (including Escrow Instructions, Fixed-Price Contracts, Direct Contracts, and Fee Agreements), or to take steps at Users' request in anticipation of entering into a contract with them.
- For our legitimate interests: In many cases, we handle Personal Information on the grounds that it furthers our legitimate interests in commercial activities, in ways that are not overridden by the interests or fundamental rights and freedoms of affected individuals, such as:
- Providing and maintaining our Site and Service;
- Detecting security incidents, protecting against malicious, deceptive, fraudulent, duplicate multi-account rings ("smurfing"), off-platform circumvention, or illegal activity, and prosecuting those responsible;
- Measuring interest and engagement in our Services;
- Short-term, transient use, such as contextual customization of ads;
- Improving, upgrading, or enhancing our Services;
- Developing new features and educational tools;
- Ensuring internal quality control, code safety, and platform reliability;
- Authenticating and verifying individual identities and Verified Talent badges;
- Debugging to identify and repair errors with our Services;
- Auditing relating to interactions, transactions, and other compliance activities;
- Enforcing our agreements, User Agreement, and community policies;
- Analyzing and improving our business;
- Communications, including marketing and responding to your inquiries;
- Addressing information security needs and protecting our Users, Arette, and others;
- Managing legal issues and disputes.
- Across Arette Services and Features: As part of providing an integrated platform experience, we may use personal information collected through one feature on the Service to support other features. For example, data from your profile, proposals, communications, portfolio showcases, or client feedback may help inform other parts of the Service, such as talent recommendations, search results, or Maya AI educational guidance.
- Generative AI & Maya AI: We provide educational and productivity features by integrating trusted AI technologies. When you submit prompts, curriculum queries, or code to Maya AI, your inputs are processed strictly to return educational tutoring, critique feedback, or contextual assistance. Where Arette leverages data to power AI features, we implement appropriate privacy safeguards, including removing direct personal identifiers and prioritizing public data.
- To enforce and comply with the law, including conducting investigations, protecting the property and rights of Arette or a third party, protecting public safety, or preventing illegal, fraudulent, or actionable activity.
- To Comply with Legal, Tax, and Accounting Obligations.
3.b Public Content on the Platform
Some parts of the Service allow you to share personal information publicly, such as when you create a public profile, publish visual portfolio projects, post a public service offering, post a job opening, submit proposals that include visible work samples, or leave client/freelancer feedback and ratings (“Public Content”). When you choose to make information public through the Service, it may be indexed by search engines, accessible to other users or third parties, and reused within other parts of the Service (such as search ranking algorithms and talent recommendations).
Please note that information you choose to make public may be accessed, copied, or used by others in ways we do not control. Arette cannot guarantee how third parties or other users will use such publicly available information. You should not include information you consider sensitive, confidential, or subject to client non-disclosure agreements in areas of the platform designated as public.
4. Data Retention
Unless you request that we delete certain information (see Your Choices and Rights below), we will retain your personal information for as long as is necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements, as well as ongoing fraud prevention, backup, dispute resolution, and business continuity purposes.
When you delete your account, your public profile, portfolio showcases, and direct message accessibility are deactivated. Transactional records, tax invoices, and dispute resolution archives are retained for seven (7) years in accordance with statutory accounting and financial compliance standards.
6. Your Choices and Rights
Residents of certain jurisdictions have specific choices and rights associated with their personal information, including accessing, exporting, correcting, or deleting their data, and opting out of targeted advertising or disclosures to third parties. You or your authorized agent may request that Arette honor these rights by:
- Submitting a verifiable data request by emailing our privacy team at privacy@arette.xyz; or
- Updating your profile preferences directly in Account Settings.
Non-Discrimination: You will not receive any discriminatory treatment by us for the exercise of your privacy rights.
Verifying Your Request: Only you, or a person that you authorize to act on your behalf, may make a request related to your personal information. In the case of access and deletion, your request must be verifiable before we can fulfill it. Verifying your request requires you to provide sufficient information for us to reasonably confirm that you are the person about whom we collected personal information. We will only use the personal information provided in a verifiable request to verify your identity or authority. We cannot respond to your request if we cannot verify your identity.
6.a For Individuals Located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland
Under applicable European and UK data protection laws (including GDPR, UK GDPR, and Swiss FADP), you have a number of statutory rights in relation to your personal information. Under certain circumstances, you have the right to:
- Right of Access: Request confirmation of processing and obtain a copy of your personal data;
- Right to Erasure: Request that your personal information be deleted;
- Right to Rectification: Request that inaccurate or incomplete personal information be corrected;
- Right to Restriction: Request that the processing of your personal information be restricted;
- Right to Object: Object to further processing of your personal information, including processing for direct marketing;
- Right to Data Portability: Receive a machine-readable copy of the personal information you provided to us;
- Right to Withdraw Consent: Withdraw any consent you previously provided at any time;
- Right to Restrict Automated Decision-Making: Restrict certain automated processing or profiling; and
- Right to Lodge a Complaint: Lodge a complaint with the appropriate Data Protection Supervisory Authority in your country of residence.
6.b Notice for California Residents (CCPA / CPRA)
“Shine the Light” and “Eraser” Laws: California residents may request a list of all third parties to which we have disclosed certain personal information during the preceding calendar year for direct marketing purposes.
California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA): California residents have specific rights regarding personal data:
- Your Right to Know: You have the right to request disclosure of the categories of personal data collected, categories of sources, specific pieces of personal data collected, business purposes for collecting or sharing, and categories of third parties with whom data was shared.
- Your Right to Opt-Out of “Sale” or “Sharing”: California residents have the right to opt-out of the “sale” or “sharing” of personal information for cross-context behavioral advertising. You may exercise this right through your Privacy Settings or by enabling Global Privacy Control (GPC) in your browser. We do not knowingly sell or share personal information of individuals under the age of 18.
- Your Right to Limit Use of Sensitive Personal Information: California residents have the right to limit the use of sensitive personal data strictly to those uses necessary to perform the Services. Arette does not use sensitive personal data for any other purposes.
- Your Right to Delete: You have the right to request deletion of your personal information, subject to statutory exceptions (such as tax compliance, ongoing disputes, or security auditing).
- Your Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.
6.c Notice for Nevada Residents
Under Nevada law (NRS 603A), Nevada consumers may opt out of the sale of covered personal information for monetary consideration to third parties who license or sell such information. Arette does not sell personal information for monetary consideration. However, Nevada residents who have purchased services from us may submit an opt-out request by emailing privacy@arette.xyz with the subject “Nevada Privacy Opt-Out”.
6.d Residents of Virginia, Colorado, Connecticut, Utah, Texas, and Other U.S. States
The laws of your state of residence may provide you with rights to confirm processing, access, delete, correct, obtain portable copies of your personal data, and opt out of targeted advertising, data sales, or significant automated profiling. To exercise these state privacy rights, email privacy@arette.xyz.
6.e Opting Out of Targeted Advertising
You can manage your advertising choices in Privacy Settings, transmit a Global Privacy Control (GPC) signal, or visit industry opt-out portals:
- Digital Advertising Alliance (DAA) Consumer Choice: http://www.aboutads.info/choices/
- European Interactive Digital Advertising Alliance (EDAA): http://www.youronlinechoices.eu/
- Network Advertising Initiative (NAI): https://optout.networkadvertising.org/
6.f Privacy Request Appeals Process & Dispute Resolution
Certain information may be exempt from privacy requests under applicable law. If we deny your request in whole or in part, you have the right to appeal our decision. You may submit an appeal by emailing privacy@arette.xyz with the subject line “Data Privacy Request Appeal”. We will review and provide a written response within forty-five (45) days.
7. Security Safeguards
We take a number of steps to protect your data, but no security system is completely impenetrable. Arette maintains reasonable administrative, technical, and physical safeguards designed to protect personal information against accidental, unlawful, or unauthorized destruction, loss, alteration, access, disclosure, or use.
These measures include end-to-end transport encryption (TLS 1.3 / HTTPS), cryptographic password hashing (bcrypt / Argon2), tokenized payment processing, automated rate-limiting, least-privilege administrative access controls, active DDoS mitigation, and continuous vulnerability monitoring.
8. Cross-Border Data Transfers & Data Processing Agreement (DPA)
Because Arette is a United Kingdom company, your personal data is controlled from the UK and processed across secure infrastructure in the UK, European Economic Area (EEA), and global cloud data centres operated by our hosting and payment providers. Where personal data is transferred from the UK or EEA to a third country without an adequacy regulation, Arette implements the UK International Data Transfer Agreement (IDTA), the UK Addendum to European Commission Standard Contractual Clauses (SCCs), or European Commission SCCs, ensuring that data recipients maintain equivalent technical and organizational safeguards.
Enterprise recruiters and corporate clients processing candidate or employee data through our ATS integrations may execute our standard Data Processing Agreement (DPA) by contacting legal@arette.xyz.
9. Third-Party Links & ATS Integrations
The Service may contain links to digital assets such as external portfolios, social media profiles, or third-party web services that we do not own or operate (including BambooHR, Greenhouse, Lever, and Single Sign-On authenticators). This Privacy Policy does not apply to data collected through any such third-party digital assets. Arette is not responsible for the privacy practices of external platforms, and we encourage you to carefully review the privacy policies of every service you visit.
10. Accessibility & Nondiscrimination Statement
Arette is dedicated to providing an accessible platform in accordance with the World Wide Web Consortium's Web Content Accessibility Guidelines (WCAG 2.1). Furthermore, Arette maintains a strict non-discrimination policy: discrimination against any user, creator, or job applicant based on race, color, religion, gender, sexual orientation, disability, veteran status, or national origin is strictly prohibited across all job postings, freelance service listings, and community interactions.
11. Changes to this Privacy Policy
We may change this Privacy Policy. If we make material changes, we will provide notice by posting an announcement on the Site, sending an email to your registered address, or updating the effective date at the top of this document. By accessing or using the Service after we notify you of such changes, you are deemed to have accepted the revised Privacy Policy. Please refer back to this Privacy Policy on a regular basis.
12. Contact Us & Data Protection Representatives
To request that Arette honor any of the privacy rights described in this Policy, or if you have questions regarding our data practices, contact us via the channels below:
Pursuant to Article 27 of the EU GDPR, Arette Technologies Ltd. has appointed European Data Protection Office (EDPO) as its GDPR Representative in the European Union. You can contact EDPO regarding matters pertaining to the EU GDPR:
Pursuant to Article 14 of the Swiss FADP, Arette Technologies Ltd. has appointed EDPO Switzerland as its Representative in Switzerland: