Privacy policy

Who operates Armathes

Armathes is operated by Evan Friedman in Atlanta, Georgia, United States. Our initial beta is intended for US businesses and their invited professional users.

For privacy questions or requests, email contact@armathes.com with the subject “Privacy request.”

Information we handle

• Accounts and security: name, work email, organization, invitation and role, identity-provider identifiers, authentication/session records, which version of the Terms of service you accepted, when, and the IP address and browser you accepted from, which product-announcement versions you dismissed and when, the approximate country each sign-in came from, which we use to email you about a sign-in from a new country, IP address, browser information and timestamps. That email names the approximate city and region; we store only the country. A copy of each Terms acceptance record, with its IP address and browser, is emailed to the Armathes owners.
• Your work: saved research, notes, citations, watchlists, interests, preferences, pursuits, collaboration and export history. Export records can include bounded search and filter text.
• Activity and support: coarse active-time intervals and daily page/feature counts linked to your account. Submitted feedback includes your description, current page/query and browser, screen, language, time-zone, appearance and version context. The public support form sends your topic, message, and optional email address to the Armathes owners by email; we keep a one-way fingerprint of your IP address, for up to thirty days, to limit repeat sends.
• Communications: correspondence, email addresses, message content, delivery/failure information, preferences and opt-out status. Business outreach contacts may come from public business sources.
• Public evidence: government contract and opportunity records, source payloads and revisions. Public records can include names and contact details. The platform’s People page gathers the contacts named on SAM.gov notices, usually contracting staff, so customers can search them by name, email, or office and see the notices that name them. To ask about a listing, use the request process below.

Please avoid putting sensitive personal information in research notes or feedback. We do not ask for payment-card details through the current free beta.

How information is used

We use information to provide the website and workspace, authenticate invited users, enforce permissions and limits, deliver requested messages, support customers, investigate abuse and understand service use. Welcome and product-announcement acknowledgements prevent repeat prompts across your devices; announcement acknowledgements are removed with the account.

Team administrators can see their organization’s membership, access and basic activity information. Authorized Armathes staff review permitted account, usage, security and support information. Estimated active time is approximate and does not measure employee productivity.

Services and sharing

Our providers support these functions: Vercel hosts the website/API and optional public-site metrics; Neon stores application data; Resend delivers application email; Google provides optional sign-in and business Gmail/Sheets; Cloudflare provides bot protection and the separate staff access gateway; Sentry receives limited technical error reports. The people building Armathes also use AI development tools, including Anthropic’s Claude and OpenAI’s Codex; when maintenance or support work requires it, those tools can process application data and business email. The platform itself has no AI features today and does not send your research to an AI model.

Error reports help us diagnose application failures. We limit them to error categories, technical codes, page route patterns, software versions, and code locations. We exclude error-message text, request contents, sign-in tokens, customer identity, and research content. Session replay and performance tracing are off. The error service still receives network connection information needed to deliver the report.

We do not sell personal information, share it for targeted advertising, or let advertising networks track your activity across websites through Armathes. One customer organization’s workspace, including its saved research, notes, pursuits, and watchlists, is not shown to other customer organizations.

These providers can process technical request information needed to deliver and protect their services. We may also disclose information where legally required or to investigate abuse and protect accounts. If Armathes moves to a company formed to operate it or to a successor to the business, information moves with it under this policy. Hosting, email and security processing is separate from optional analytics choices.

Public-source links and external identity-provider pages have their own privacy practices. Cloudflare describes Turnstile processing in its Turnstile privacy policy.

Optional analytics and storage

Optional Vercel Web Analytics and Speed Insights stay off until you allow them. When enabled, they measure visits and performance on our main marketing pages. We remove event URL parameters/fragments and reject events from sign-in, customer workspace, staff and unknown pages.

If your browser sends a Global Privacy Control signal, we treat it as a decline: optional analytics stay off in that browser, even if you allowed them before. Because optional analytics are already off until you allow them, we do not respond separately to Do Not Track signals.

Change or withdraw your choice using Cookie settings in the website footer. Withdrawal stops future optional metrics; it does not remove metrics already sent. Our own account/security and coarse internal usage records are separate.

See Cookies and browser storage for necessary storage, preference durations and the limits of browser choices.

Retention

Scheduled application cleanup removes sign-in attempts older than thirty days, expired sign-in/session records after thirty additional days, and activity intervals/daily usage older than ninety days. A sign-in country is removed after a year without a sign-in from it. Active sessions can last up to thirty days and access ends after seven idle days.

Account, research, export, feedback, correspondence and audit records do not all have an automatic expiry. They can remain until removed through the service or a reviewed request, taking shared organization ownership, security, recordkeeping and applicable obligations into account.

Hosting and email-provider logs, backups and minimal opt-out records can remain separately after live application copies are removed. A request is reviewed across the relevant systems; deleting an account is not an instant erasure of every backup or public government record.

Privacy and deletion requests

Email a privacy request to ask about access, correction, deletion or other choices for your information. Tell us the work email involved and what you want help with. Do not send passwords, sign-in links or identity documents in your initial email.

A person reviews these requests. We may need to verify your identity and authority for shared organization material. We will explain what can be removed or corrected and any records that need to remain. Available rights depend on the laws that apply; this policy does not limit them.

Deleting personal account information is separate from deleting shared company research or changing the public source record.

Email choices

Optional digest and reminder preferences are available in the platform, and those emails include unsubscribe controls. For outreach from Evan, reply asking to stop. Unsubscribing does not delete an account or end necessary sign-in and security messages.

Submitting a sign-in request does not subscribe you to marketing email.

Children and updates

Armathes is a professional business research service and is not directed to children under thirteen. Contact us if you believe a child has provided personal information so we can investigate.

We will update this page when our practices change and show its updated date.