/Aristotl
Language
Demo

Privacy Policy

Version v1.06Updated

Introduction

Aristotl BV, established at Entrepotkaai 2/802, 2000 Antwerp, with enterprise number 1018.326.784 (“Aristotl”), processes personal data in different roles:

  • As controller: when we process personal data for our own purposes, such as managing our website, marketing, sales, invoicing, account administration and the security of our own systems.
  • As processor: when our business customers (“Customer”) process personal data via the Aristotl platform (for example data that the Customer or its end users enter into or upload to the Services). In that case, the Customer determines the purposes and means of the processing and is the controller. Aristotl processes such personal data solely on behalf of and in accordance with the Customer’s instructions, as set out in our Data Processing Agreement (DPA).

Why do we collect and process personal data?

  • For our own purposes (as controller): e.g. managing customer relationships, invoicing, security, communication, product improvement and (where permitted) marketing.
  • On behalf of our business customers (as processor): the Customer uses the Services to process personal data for its own purposes. Aristotl processes that data only to provide, maintain and secure the Services and to provide support, in accordance with the Customer’s instructions and the DPA.

What data do we collect?

Aristotl collects and processes various types of personal data, depending on how you use our Services. The data we collect may include the following information:

  • Personal Data:
    • Name
    • Email address
    • Job title
    • Company or organization where you work
  • Technical Data:
    • IP address
    • Browser information
    • Device information (such as device type, operating system)
    • Location data
    • Data about your use of the website and Services (such as pages visited, click behavior, duration of the visit)
  • Cookies and similar technologies: We use cookies and similar technologies to collect information about your use of our website, your preferences and your navigation behavior. This helps us improve the website and offer you a personalized experience. More information about the use of cookies can be found in our Cookie Policy.

Sharing of data

As controller (own purposes)

We may share personal data with service providers who act as processors for us (e.g. hosting providers, email/communication services, Google Analytics), only to the extent necessary for the purposes set out in this privacy policy and under appropriate contractual safeguards. Not every recipient is our processor: for the advertising technologies on our website, LinkedIn and Meta are joint controllers with us and Google is a separate controller (see Website analytics and marketing). When you book a demo on our website, we pass your work email and the chosen time to HubSpot (HubSpot Ireland Ltd.), which schedules the meeting and sends the calendar invite; your name is derived from your email address.

As processor (on behalf of our business customers)

When Aristotl processes personal data on behalf of a Customer, Aristotl may engage sub-processors (e.g. hosting and infrastructure). The terms, safeguards and the notification/objection mechanism regarding sub-processors are governed by the DPA and the (current) sub-processor list referred to in the DPA.

AI assistant connector (Claude, ChatGPT)

Members of a Customer organization can connect an AI assistant they use, such as Claude (Anthropic) or ChatGPT (OpenAI), to the Services. This is allowed in every organization unless an administrator turns it off, but nothing is shared until a member sets up a connection themselves. A connection is always started by the member: they sign in to Aristotl, choose one organization and approve what the assistant may do (read; make changes; generate content). A Customer administrator can turn the connector off for the whole organization, or disconnect any member's connection, at any time. Members can disconnect their own connections under Profile > Connected apps. Disconnecting, or turning the connector off, takes effect immediately, and at the latest within one minute.

While a connection is active, Aristotl sends the assistant only what is needed to answer the member's request, and only data that member can already access in the chosen organization, with the member's role in that organization: for example search results and excerpts from the knowledge base, course and checklist content, calendar items, member and team details for members who manage them and, for members allowed to view analytics, aggregated training analytics. Aristotl does not receive the member's conversation with the assistant, only the requests the assistant sends to Aristotl.

For Customer data, Aristotl remains a processor acting on the Customer's instructions. The AI assistant provider is not a sub-processor of Aristotl: it receives the data because the member chose to use that assistant, and processes it under the member's or the Customer's own agreement with that provider and that provider's privacy policy. Aristotl does not control how the provider stores or uses the data.

Aristotl keeps:

  • a record of each connection (member, assistant, organization, permissions, when it was approved and when it was last used). The record is kept while the connection exists, and is deleted when the connection is disconnected, when the member leaves or is removed from the organization, when the member's account is deleted and when the organization is deleted. A connection that has not been used for 30 days, or that was approved more than 180 days ago, stops working until the member approves it again;
  • an audit record of each connection being approved or disconnected and of each change made through the assistant (member, assistant, action, item, outcome), for the duration of the Agreement;
  • a usage record of AI generation started through the assistant (feature, model, volume, cost), for billing, for the duration of the Agreement.

These records do not contain the member's prompts or conversation, nor the content of the requests the assistant sends. When the assistant asks Aristotl to generate content, the input it provides (such as a course title or brief) is processed like any generation started in Aristotl, including by our AI monitoring tools. Aristotl's technical logs for these requests contain technical identifiers and the name of the action performed, not the content of the requests, and are kept for 30 days. Content the assistant creates or changes in Aristotl is Customer data like any other.

Calendar sync (Google Calendar and Outlook)

If a Customer administrator turns on Google Calendar or Outlook Calendar, each member can choose to connect their own calendar from Calendar sync on the calendar page, by signing in to Google or Microsoft. Nothing is read or written until a member connects.

While a calendar is connected, Aristotl reads the events in the member's primary Google calendar or main Outlook calendar, from 30 days back to 90 days ahead. Of each event it uses only the title, times, location, free/busy status, privacy flag, video-call details and the member's own reply to it (from Google), and the technical details that keep it up to date (its identifier, type, status and when it last changed). Google sends Aristotl only these, except for the events Aristotl added: for those, Google sends the whole event, and Aristotl uses only the details listed here. Microsoft sends the whole event, and Aristotl uses nothing else from it. It never stores descriptions, guests or attachments, and it keeps no title, location or link of an event marked private. Aristotl adds the member's Aristotl meetings, deadlines and personal events to that calendar as events with no guests, and keeps them in line with Aristotl.

Only the member sees their imported events, inside Aristotl: not their organization's administrators, not other members and not Aristotl's support, and never in Aristotl's calendar link, reminders or AI features. Imported events are kept only for that rolling window, and the access Google or Microsoft gives Aristotl is stored encrypted.

Turning off "Meetings from Google" or "Meetings from Outlook" deletes the imported events. Disconnecting, an administrator turning the integration off, leaving the organization or deleting the account deletes the imported events and the stored access, and, unless that access had already been withdrawn, the events Aristotl added to the calendar. A member can also remove Aristotl's access in their Google or Microsoft account settings.

This data is never used to create, train or improve AI or machine-learning models or for advertising, is never sold, is shared only as needed to run Calendar sync, and is not read by any person except for security, to comply with the law, or at the member's request.

Google Calendar. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

Google and Microsoft are each the member's own provider, not Aristotl's sub-processors, and process the calendar under the member's or the Customer's own agreement with them.

Website analytics and marketing

On our website (www.aristotl.com), the analytics and advertising technologies below run only after you allow their category in our cookie banner. The one exception is the Google tag: it loads before you choose, with every storage and advertising signal denied, and in that state Google can receive cookieless pings (for example that a page was viewed) without setting cookies. Our legal basis is your consent (Article 6(1)(a) GDPR). The Cookie Policy lists every cookie and how long it is kept.

  • Measurement: Google Analytics 4 (Google Ireland Ltd.) measures how the website is used, such as the pages you visit and actions like opening the demo booking or using the ROI calculator. Google processes this data for us as our processor.
  • Marketing: Google Ads (Google Ireland Ltd.) measures our advertising campaigns on Google and lets us show our ads to visitors of our website.
  • Marketing: the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company) records visits to measure our LinkedIn campaigns and to build audiences for our ads on LinkedIn.
  • Marketing: the Meta Pixel (Meta Platforms Ireland Ltd.) records the pages you visit and events such as viewing the ROI calculator, opening the demo booking, booking a demo or receiving the ROI report, to measure our campaigns and to build audiences for our ads on Facebook and Instagram.

We never send these providers your name, your email address or what you type into our forms.

LinkedIn and Meta are joint controllers with us for collecting your visit data on our website and passing it to them (Court of Justice of the EU, Fashion ID, C-40/17). For Google Ads, Google acts as a separate controller. What LinkedIn, Meta and Google do with the data once they have received it is governed by their own privacy policies: LinkedIn, Meta and Google. You can exercise your rights with us at ben@aristotl.com or with them.

You can change or withdraw your choice at any time with “Manage cookie preferences” on our Cookie Policy page. Withdrawing does not affect processing that took place before.

Marketing emails

If you tick the box to receive product news by email on one of our website forms (the ROI report, a demo booking or a question to our team), we send you occasional emails about new features and updates to Aristotl. We only do this with your consent (Article 6(1)(a) GDPR). Leaving the box unticked never affects the form you are sending.

  • What we record: your email address, your language, the form you used, the exact wording you agreed to, the date and time, and the IP address and browser you used. This record is our proof of your consent.
  • How to stop: every marketing email contains an unsubscribe link in your language, and your email app may also show an unsubscribe button. You can also email ben@aristotl.com. Withdrawing your consent takes effect immediately and does not affect emails sent before.
  • Who helps us: our email provider (Resend) or our CRM (HubSpot Ireland Ltd.), depending on which one sends the emails, processes your email address on our behalf as a processor.
  • How long we keep it: your subscription lasts until you unsubscribe. After that we keep your email address, marked as unsubscribed, with the proof of your last consent and the date you unsubscribed, so we can show that we respected your choice. If you tick the box again later, your new consent replaces the earlier one. You can ask us at any time to delete this record by emailing ben@aristotl.com.

Security of data

Aristotl implements appropriate technical and organizational measures to protect your personal data against loss, misuse, unauthorized access, unauthorized modification and destruction. We use, among other things, encryption and secure servers to store your data.

How long do we retain your data?

We retain your personal data only as long as necessary for the purposes for which it was collected or to comply with legal obligations. If we no longer need data for the original purposes, we will securely delete it.

Retention periods vary depending on the type of data and the purpose for which it was collected:

  • Customer data is generally retained as long as you have a customer relationship with Aristotl and thereafter for the statutory retention periods.
  • Cookies are retained according to the duration indicated in our cookie statement.
  • Marketing email subscriptions are kept until you unsubscribe; after that, the record of your choice is kept as described under Marketing emails, until you ask us to delete it.

When Aristotl processes personal data as processor on behalf of a Customer, retention periods are in principle determined by the Customer (controller) and the arrangements in the DPA and Agreement. Aristotl does not retain such data longer than necessary to provide the Services, support, security and in accordance with the Customer’s instructions, subject to legal obligations.

Your rights regarding personal data

Under the GDPR you have certain rights regarding your personal data. These rights include:

  • Right of access: You have the right to know which personal data we process about you.
  • Right to rectification: If your personal data is inaccurate or incomplete, you may request that it be corrected.
  • Right to erasure: You may request that your personal data be deleted, for example when we no longer need the data for the purposes for which it was collected.
  • Right to object: You may object to the processing of your personal data, especially if it is used for direct marketing.
  • Right to restriction of processing: You may request that the processing of your personal data be restricted, for example if you believe the data is inaccurate or if you object to the processing.
  • Right to data portability: You have the right to receive your personal data in a structured, commonly used and machine-readable format so that you can transfer it to another service provider.
  • Right to withdraw consent: If we ask for your consent to process your data, you may withdraw that consent at any time.

If Aristotl is the controller (e.g. website, sales, invoicing): you can exercise your rights by contacting us at ben@aristotl.com. If Aristotl is the processor and your personal data is processed via the Services by a business Customer: please direct your request in the first instance to that Customer (the controller). Aristotl will, where appropriate, support the Customer in handling the request.

What if you are not satisfied with our response?

If you are not satisfied with the way we process your personal data, you may lodge a complaint with the data protection authority in your country. In Belgium, they are located at Drukpersstraat 35, 1000 Brussels.

Changes to this privacy policy

Aristotl reserves the right to amend this privacy policy from time to time. We will inform users of material changes via our website or by email.

Contact information

If you have questions about this privacy policy or how we process your personal data, you can contact us at:

Ben Bauwens
Co-Founder & CEO
ben@aristotl.com
Entrepotkaai 2/802, 2000 Antwerp