Privacy policy.
What we collect when you use arundo.com, talk to us, or use our software — and what we don't.
Last updated 26 October 2026
The short version
- No cookies. arundo.com sets none and loads no advertising or social-media trackers, so there is no cookie banner.
- Anonymous visit statistics, on our own server: which pages are read and where visitors come from. No IP addresses are stored, and nothing identifies you.
- What you type into a form goes to one place: our team's inbox, contact@arundo.com. The website itself stores nothing.
- The assessment and the calculators run in your browser. Your answers and figures stay there, unless you ask us to send you your result.
- You can ask what we hold about you, have it corrected, or have it deleted: privacy@arundo.com.
1. Who we are
Arundo Analytics AS (org. no. 814 881 512), C. J. Hambros plass 2, 0164 Oslo, Norway, is the controller for the personal data this policy covers. Our affiliates Arundo Analytics AB (Sweden) and Arundo Analytics, Inc. (United States) work with us in sales and customer support and may process the same data on our behalf.
Questions about this policy or your data: privacy@arundo.com.
2. On this website
Visit statistics
We count visits with an open-source analytics tool that we host ourselves, on Arundo's own infrastructure in Microsoft Azure's North Europe region (Ireland). No analytics company receives the data.
What is recorded: the page address, the referring site, the campaign tags in a link (UTM), the country, region and city, the browser, the operating system, the device type, the screen size and the language. And a short list of anonymous events: which call-to-action links are clicked, which files are downloaded, how far people get in the level assessment and which answers they give (yes / no / not sure — never anything typed), whether a calculator produced an estimate, whether a form was sent (never its contents), and which glossary terms are read.
What is not: your IP address is used to look up the country, region and city and is then discarded. To count unique visitors, the tool keeps a one-way hash of your address and browser, salted with a value that changes every month, so a visitor cannot be recognised from one month to the next or traced back to a person. It sets no cookies and stores nothing in your browser.
Why: to see which pages are useful and fix the ones that are not. Legal basis: our legitimate interest in running and improving the site (GDPR Art. 6(1)(f)).
How long: we keep the statistics for 25 months, then delete them.
Forms
| Form | What you send us | Why |
|---|---|---|
| Contact ("Write to us") | Name, company, role, work email, number of sites, which of the three options you chose, your message | To answer you |
| Whitepaper "Email me a copy" | Your email address and which whitepaper | To send you the copy |
| Assessment "Want this in writing?" | Your email address, your result and your six answers | To send you your result and the six-levels one-pager |
Our web server passes each submission straight on as one email to contact@arundo.com, our team's mailbox, hosted by Google Workspace. The website keeps no copy. A person on our team reads it and replies.
Legal basis: steps you asked us to take before a possible contract, and our legitimate interest in answering business enquiries (Art. 6(1)(b) and (f)). Sending a form does not sign you up for newsletters or marketing email.
How long: we keep enquiries for as long as we are in contact about them, and delete them 24 months after our last exchange unless they have become part of a customer relationship.
Delivering the site
The site is hosted on Cloudflare. To deliver pages and protect the site from attacks, Cloudflare processes your IP address and the details of each request, such as the page address and your browser. We do not keep request logs ourselves.
Pages load their code, stylesheet and typeface from our own domain; your browser does not contact any other service to display them.
Links to other sites
Links to LinkedIn, X, Google Maps, Zenodo and others take you to sites with their own privacy policies. The "Share on LinkedIn" and "Share on X" buttons are plain links: nothing is sent to those networks until you click.
3. Cookies
arundo.com sets no cookies, and neither does our analytics. We use no advertising, retargeting or social-media pixels.
Cloudflare, which hosts the site, may set a strictly necessary security cookie (such as __cf_bm) when it needs to tell people from automated traffic. It is not used to track you and expires within an hour.
4. Beyond the website
Sales, events and email
When you meet us, call us, email us or give us your card, we keep your name, company, role and contact details to follow up on that conversation. We send marketing email only where the law allows it — with your consent where it is required — and every marketing email has a way to opt out. Legal basis: our legitimate interest in business relationships, or your consent where required (Art. 6(1)(f) and (a)).
Our software
When a customer uses Arundo Foundation or one of our solutions, any personal data in it — typically users' names, email addresses and roles — is processed on the customer's behalf, under our agreement with that customer. For that data the customer is the controller and we are its processor; the customer's own privacy notice applies. Our security measures are described on the Security page.
5. Who we share data with
- Service providers that process data for us under data processing agreements: Cloudflare (hosting and security), Google (email) and Microsoft (Azure, which runs our analytics server). They receive only what they need for that service.
- Our affiliates Arundo Analytics AB and Arundo Analytics, Inc., for sales and support.
- Authorities, when the law requires it.
- A buyer or successor, if all or part of the business is sold or merged — under this policy.
We do not sell personal data.
6. Transfers outside Europe
Some of our providers, and our U.S. affiliate, are in the United States. Such transfers rely on the EU–U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's standard contractual clauses.
Arundo Analytics, Inc. participates in the EU–U.S. Data Privacy Framework, the UK Extension and the Swiss–U.S. Data Privacy Framework, and adheres to their principles for personal data received from the EU, the UK and Switzerland in reliance on them. Its certification is listed at dataprivacyframework.gov. If you have a complaint about its handling of that data that we have not resolved, you can refer it free of charge to JAMS (jamsadr.com/dpf-dispute-resolution); the U.S. Federal Trade Commission has investigatory and enforcement powers over it.
7. Your rights
You can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct it;
- delete it;
- restrict how we use it;
- give it to you in a machine-readable format, to take elsewhere;
- stop using it, where we rely on our legitimate interest — and always stop using it for direct marketing.
Where we rely on your consent, you can withdraw it at any time. Write to privacy@arundo.com; we answer within one month. You can also complain to Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no), or to the authority where you live or work.
8. Security
We protect personal data with access control, encryption in transit and at rest, and staff confidentiality obligations. Arundo is certified to ISO/IEC 27001:2022. Email is never fully secure: please do not send us anything sensitive through a form.
9. Children
This site is for business audiences. We do not knowingly collect personal data from anyone under 16.
10. Changes
When we change this policy we update the date at the top, and describe material changes here.
Contact
privacy@arundo.com
Arundo Analytics AS, Attn: Privacy, C. J. Hambros plass 2, 0164 Oslo, Norway