Privacy Policy

1. Introduction

Arrakis Security, Inc. ("the Company," "we," "us," or "our") operates arraksisecurity.com and the Arrakis agent governance platform (together, the "Service"). Arrakis Security, Inc. is an enterprise AI security company headquartered at 600 Congress Avenue, Suite 1400, Austin, TX 78701. We can be reached at [email protected] or by phone at +1 (512) 740-0257.

This Privacy Policy describes the personal information we collect through the Service, how we use it, and your choices. It covers two distinct contexts: (a) information about visitors to and users of arraksisecurity.com, and (b) operational data that enterprise customers transmit to the Arrakis platform as part of monitoring their autonomous AI agent deployments. These contexts are handled differently and are described separately below.

2. Information We Collect

2.1 Information You Provide Directly

When you contact us, request a demo, start a free trial, or register for an account, we collect:

• Contact details: name, work email address, phone number;
• Company information: employer name, role, team size, the AI frameworks or platforms you are evaluating;
• The content of messages, demo requests, or support inquiries you send us.

2.2 Information Collected Automatically

When you visit arraksisecurity.com, we automatically collect limited technical information:

• IP address and approximate geographic location (city/region);
• Browser type, operating system, and device class;
• Pages visited, referring URLs, session duration;
• Cookie and similar identifiers (see Section 5 and our Cookie Policy).

2.3 Agent Operational Data (Enterprise Platform Customers)

Enterprise customers connect their AI agent runtimes to the Arrakis platform for monitoring, policy enforcement, and audit logging. In this context, the platform receives agent event metadata: agent identifier, action type, resource target, policy outcome, session identifier, and timestamp. This is behavioral telemetry, not content.

The Company does not capture or store the content of agent inputs or outputs (prompt text, LLM response bodies, database row content, or API response payloads) unless you have explicitly enabled content-capture for debugging purposes in your account settings. We do not use agent event metadata to train machine learning models. Enterprise customers remain the data controllers for the agent operational data they transmit; the Company processes this data as a service provider under the customer's instructions.

2.4 We Do Not Knowingly Collect Children's Data

arraksisecurity.com is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it promptly.

3. How We Use Information

The Company uses the information we collect to:

• Respond to demo requests, sales inquiries, and support tickets;
• Operate, maintain, and improve arraksisecurity.com and the Arrakis platform;
• Provision trial and paid accounts, authenticate users, and manage subscriptions;
• Deliver policy-enforcement, behavioral monitoring, and audit-log features to enterprise customers;
• Send service notifications and, with your consent where required, product updates or marketing communications;
• Detect, investigate, and prevent fraud, unauthorized access, and abuse;
• Comply with applicable legal obligations.

We do not sell personal information for monetary value. Where applicable state law treats certain advertising arrangements as a "sale" or "share," see Section 9 (Texas Residents) and Section 9a (California Visitors) below.

4. Sharing of Information

The Company shares personal information only with:

• Service providers acting on our behalf (hosting infrastructure, email delivery, analytics, payment processing) under contractual confidentiality and data-processing terms that restrict their use;
• Government authorities and law enforcement when required by law or valid legal process, or to protect rights, safety, or property;
• A successor entity in the event of a merger, acquisition, or sale of substantially all assets, subject to this Policy.

We do not sell personal information to third parties.

5. Cookies and Tracking

The Company uses cookies and similar technologies to operate the site, maintain session state, and measure usage. For details on what cookies are set, how long they last, and how to manage them, see our Cookie Policy.

6. Data Retention

Website visitor contact records and demo-request details are retained for as long as we have a legitimate business reason (for example, an active sales relationship or ongoing product evaluation) and are removed no later than 24 months after the last meaningful interaction. Server access logs for arraksisecurity.com are retained 90 days, then aggregated to summary metrics only.

For enterprise platform customers, agent event logs are retained for the period specified in your subscription plan (30 days on Starter, 90 days on Professional, 12 months on Enterprise) and are deleted within 30 days following account termination, unless a longer retention is required by law or you have requested an export.

7. Security

The Company applies administrative, technical, and physical safeguards to protect the information we hold, including TLS encryption in transit, encryption at rest, tenant-isolated storage (no cross-customer data in any shared layer), and least-privilege access controls governing Company personnel access to production data. Our SOC 2 Type II audit is currently in progress; our design controls are aligned with the SOC 2 framework. No system is perfectly secure and we cannot guarantee absolute security.

8. Your General Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or port personal information, and to limit certain processing. To make a request, email [email protected]. We will respond within the timeframe required by applicable law. Additional rights for Texas residents and California visitors are described in Sections 9 and 9a below.

9. Texas Residents (TDPSA)

Under the Texas Data Privacy and Security Act ("TDPSA"), Texas residents have the rights described below regarding personal data we control or process.

9.1 Your TDPSA Rights

• Right to Confirm and Access: confirm whether we are processing your personal data and obtain access to it.
• Right to Correct: correct inaccuracies in your personal data.
• Right to Delete: request deletion of personal data we have collected from or about you.
• Right to Data Portability: obtain a portable copy where we maintain it electronically and where technically feasible.
• Right to Opt Out: opt out of targeted advertising, sale of personal data, and profiling for decisions producing legal or similarly significant effects. The Company does not engage in any of these activities.

9.2 Sensitive Data Consent

If we ever process sensitive data as defined under TDPSA (such as precise geolocation, biometric data, or health information), we will obtain your prior consent. The Service does not currently process such sensitive categories of data.

9.3 How to Exercise

Email [email protected]. The Company responds within 45 days; one 45-day extension is available with notice to you.

9.4 Appeal

If we deny your request, you may appeal by replying to our response. If denied on appeal, you may contact the Office of the Texas Attorney General Consumer Protection Division.

9a. California Visitors

If you are a California resident, you may also exercise the rights granted under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), including the right to know, the right to delete, the right to correct, and the right to opt out of sale or sharing. The Company does not sell personal information and does not "share" personal information for cross-context behavioral advertising.

To submit a CCPA/CPRA request, email [email protected] with the subject line "California Privacy Request."

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date and, where appropriate, a notice on the Service.

11. Contact

Questions, requests, or complaints about this Policy can be sent to: