Back to Arrivli

Privacy Policy

Last updated: 23 June 2026

1. Who We Are and Data Controller

Arrivli ("we", "us", "our") is an AI-assisted relocation platform. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our services, and how we comply with the EU General Data Protection Regulation (GDPR) and the UK GDPR.

For the purposes of GDPR, Arrivli is the data controller of the personal data you provide. This means we determine how and why your personal data is processed. You can contact the data controller for any privacy matter, including to exercise your rights, at privacy@arrivli.com.

2. Data We Collect

  • Account data: name and email address when you register.
  • Relocation data: origin and destination countries, move dates, family size, and priorities you enter during onboarding.
  • Usage data: tasks created, documents uploaded, budget entries, and features accessed.
  • Payment data: subscription tier and billing cycle. We do not store card details. Payments are handled by our payment processor.
  • Communications: messages sent to our AI advisor or coaching agents.
  • Technical data: browser type, IP address, and session data collected automatically for security and performance.

3. How We Use Your Data

  • To provide and personalise the Arrivli service, including generating your relocation roadmap.
  • To process payments and manage your subscription.
  • To send service-related emails (account confirmation, billing receipts, important updates).
  • To improve the platform based on aggregated, anonymised usage patterns.
  • To comply with legal obligations.

We do not sell your personal data to third parties. We do not use your data for advertising profiling.

4. Legal Basis for Processing (GDPR)

We rely on the following GDPR legal grounds for each processing activity:

  • Performance of a contract (Art. 6(1)(b)): processing necessary to provide the services you've signed up for, including generating your roadmap and managing your account.
  • Legitimate interests (Art. 6(1)(f)): improving the platform, security monitoring, and fraud prevention.
  • Consent (Art. 6(1)(a)): optional analytics and non-essential cookies, which you can withdraw at any time.
  • Legal obligation (Art. 6(1)(c)): retaining billing records as required by law.

5. Cookies

We use essential cookies to keep you logged in and maintain your session, and analytics cookies to understand how the platform is used. You can accept or decline non-essential cookies via the consent banner shown on first visit. Declining will not affect core functionality.

  • __cf_bm: set by Cloudflare to distinguish humans from bots and protect the service. Essential, retained up to 30 minutes.
  • _dd_s: set by Datadog for performance monitoring and error tracking. Analytics, retained for the session.

6. Data Sharing

We share your data only where necessary to deliver the service:

  • Payment processors: to handle subscription billing securely.
  • AI providers: prompts sent to AI models to generate your roadmap and advisor responses. Prompts may contain relocation details you've provided.
  • Infrastructure providers: cloud hosting and database services under data processing agreements.
  • Analytics and security providers: Datadog (performance monitoring) and Cloudflare (bot protection and content delivery) process limited technical data to keep the service secure and reliable.

All third-party processors are contractually bound to protect your data and may not use it for their own purposes.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law (e.g. billing records, which are kept for 7 years).

8. Your Rights

Under UK GDPR you have the right to:

  • Access a copy of your personal data.
  • Rectification of inaccurate data.
  • Erasure ("right to be forgotten"), request deletion of your account and data.
  • Portability, export your data in a machine-readable format from your Profile page.
  • Restriction of processing in certain circumstances.
  • Objection to processing based on legitimate interests.
  • Withdraw consent at any time where processing is consent-based.

To exercise any of these rights, email privacy@arrivli.com. We will respond within 30 days.

You also have the right to lodge a complaint with your national data protection supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk). In Spain it is the Agencia Española de Protección de Datos (aepd.es), and in Portugal the Comissão Nacional de Proteção de Dados (cnpd.pt). Residents of other EU/EEA countries may contact their local authority.

9. Data Security

We use industry-standard security measures including encryption in transit (TLS), access controls, and row-level security to protect your data. No system is 100% secure; if you suspect unauthorised access to your account, contact us immediately at security@arrivli.com.

10. International Transfers

Some of our third-party service providers operate outside the UK. Where data is transferred internationally, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses or adequacy decisions).

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-app notice. The date at the top of this page reflects the most recent revision.

12. Contact

For privacy-related queries: privacy@arrivli.com
For general enquiries: hello@arrivli.com