Privacy Policy

Last updated: October 18, 2026

This Privacy Policy explains how ARIA Wholesale Software (“ARIA,” “we,” “us”) collects, uses, and safeguards information when you use the ARIA CRM web application and website (collectively, the “Service”). By using the Service you agree to the practices described here.

1. Information We Collect

Information you provide

  • Account data: name, email address, mobile number (if you provide one), and password (stored hashed) when you register.
  • Billing data: subscription tier and payment status. Card details are handled entirely by our payment processor, Stripe — we never see or store full card numbers.
  • Business data you enter: property leads, seller and buyer contact details, deal figures, notes, contracts, and other records you create in the CRM.

Information collected automatically

  • Log and device data (IP address, browser type, pages viewed) for security and diagnostics.
  • Cookies and similar technologies used to keep you signed in and to measure product usage.
  • On our public marketing pages only: how you found us (the ad campaign, the page you first landed on, and the referring website), kept in a first-party cookie and saved with your account when you sign up, and the Meta Pixel’s cookies. See “Advertising measurement (Meta)” below.

Information from third parties

When you use features like property auto-fill, comps, or skip tracing, we send an address or property identifier to third-party data providers and store the results on your account’s records. See “Third-Party Services” below.

2. How We Use Information

  • To provide, operate, and improve the Service.
  • To authenticate you and secure your account.
  • To process subscription payments and send billing-related notices.
  • To power AI features (e.g., deal analysis and negotiation coaching).
  • To respond to support requests and send service announcements.
  • To send the text messages described in “Text Messaging (SMS)” below.
  • To detect, prevent, and address fraud, abuse, and security issues.
  • To measure how well our own advertising works, as described in “Advertising measurement (Meta)” below.

3. Legal Bases

Where applicable law requires it, we process personal data to perform our contract with you, to comply with legal obligations, for our legitimate interests in operating the Service, and with your consent where needed.

4. Third-Party Services

We rely on the following processors, each under their own privacy terms:

  • Supabase — authentication and database hosting.
  • Vercel — application hosting and delivery, and Vercel Web Analytics (cookieless page-view counts).
  • PostHog — product analytics and session replay so we can see where the product is confusing and fix the problems you report. During our beta, session replay inside the app records what is on screen and what you type, including your leads’ names and numbers; we never record passwords, verification codes or sign-in links. We honour Do Not Track and Global Privacy Control.
  • Google Analytics — visit measurement on our public marketing pages only, never inside the app.
  • Stripe — subscription billing and payment processing.
  • Anthropic — AI coaching and analysis (deal context is sent to generate responses).
  • Retell AI — voice-agent orchestration, telephony, and call recording storage.
  • ElevenLabs — synthetic speech for the AI voice agent.
  • OpenAI — the conversational model behind the voice agent and its post-call summaries.
  • Twilio — text message delivery and one-time verification codes (see “Text Messaging (SMS)” below).
  • Google Calendar — only if you connect it, to place your appointments on your calendar (see below).
  • Property & skip-trace data providers — used only when you invoke those features.
  • Meta Platforms — measurement of ARIA’s own Facebook and Instagram ads (see “Advertising measurement (Meta)” below).

We do not sell your personal information for money. We share data with these processors to operate the Service, and with Meta only to measure our own advertising, as described below. Some state privacy laws may treat that advertising measurement as “sharing” or a “sale” of personal information; you can opt out of it at any time, as explained below.

If you connect Google Calendar

Connecting is optional. When you connect, ARIA asks Google for permission to create and manage one calendar of its own in your Google account, named “ARIA Appointments”. ARIA writes the appointments from your ARIA account to that calendar (the appointment title, time, property address, seller name and phone number, and your notes) and keeps them up to date. That permission does not let ARIA read, change or delete any other calendar or event in your Google account. We also receive the email address of the Google account you connect, so we can show you which account is connected.

The access tokens Google issues are encrypted before they are stored. You can disconnect at any time in Settings, which revokes ARIA’s access at Google; deleting your ARIA account does the same. The calendar and its events remain in your Google account, where you can delete them.

ARIA’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use that information for advertising, do not sell it, and do not use it to train AI models.

Advertising measurement (Meta)

ARIA advertises on Facebook and Instagram. To learn which ads bring people to ARIA, we use two tools from Meta Platforms:

  • The Meta Pixel, a script that runs only on our public marketing pages (the home page, the pricing and about pages, the comparison and guide pages, and the sign-up and sign-in pages). It is never loaded inside the ARIA app, so it never sees your leads, contacts, deals, or anything else in your account, and it is set up with Meta’s automatic collection of button and page text turned off.
  • The Conversions API, which our servers use to tell Meta when certain milestones happen: submitting the “Have Aria call me” form, creating an account, verifying your phone number, starting a trial, subscribing, completing your welcome call, and adding your first lead.

With those events Meta receives your email address and phone number (and your name, where we have it) in hashed form — converted with SHA-256 before they leave our servers — a hashed account identifier, Meta’s browser identifier and, if you arrived from a Meta ad, its click identifier, your IP address, your browser’s user agent, the kind of event, and for trials and subscriptions the plan and its price. We never send Meta the contents of your ARIA account, and never information about the sellers, buyers, or other people in it.

Opting out. If your browser sends a Global Privacy Control signal, we honor it as a request to opt out: the Meta Pixel does not load, and we send nothing about you to Meta through the Conversions API, including for later events such as a trial or a subscription. You can also opt out by emailing support@useariacrm.com. To control how Meta uses information to choose the ads you see, visit your Meta ad preferences.

5. Text Messaging (SMS)

Text messages are sent through the Service in two situations: a business using ARIA texts a property owner who has agreed to receive its texts (each text names that business and its AI assistant, Aria), and ARIA texts you a one-time verification code when you verify your phone number or confirm a new device. This section applies to both, whether or not you have an ARIA account. The texting program itself is described in our Terms of Service.

What we collect and how we use it

For texting we hold the mobile number; the record of consent (when it was given, how it was given, and, where it was given on a recorded call, that call’s recording and transcript); the texts sent and received; their delivery status; and any STOP or HELP reply. We use this information only to send the texts described in the Terms of Service, to honour opt-outs, to answer HELP requests, and to keep the consent record the carriers require.

We do not share mobile information for marketing

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except with the service provider that delivers the messages on our behalf (Twilio), and only for that purpose. The advertising measurement described in section 4 never includes a mobile number collected for texting, the content of any text, or any opt-in record.

Opting out

Reply STOP to any text to stop receiving texts from that number; you will get one final confirmation and nothing further. Reply HELP for help, or write to support@useariacrm.com. Where the texts were sent by a business using ARIA, that business decided to contact you and is the controller of your information, and ARIA acts on its instructions as a processor, exactly as described for calls in section 6; your opt-out is recorded for that business immediately.

6. AI Voice Calls & Call Recordings

ARIA includes an AI voice agent (“Aria”) that places and answers telephone calls. This section explains what happens on those calls and applies whether or not you have an ARIA account.

If you received a call from Aria

Aria is an artificial-intelligence assistant, not a person. It is required to identify itself as an AI, and to name the business it is calling on behalf of, at the start of every call and before asking you anything. That business — not ARIA — decided to contact you and is responsible for that decision. If you ask Aria to stop calling, that request is recorded immediately and permanently and no further calls are placed to your number by that business through ARIA. You can also make that request in writing to support@useariacrm.com, and we will act on it and pass it to the business concerned.

Calls may be monitored or recorded. Where the law of your state requires all parties to consent, Aria tells you this before the conversation goes any further, and we keep a per-call record of whether that notice was given. If you are not comfortable being recorded, say so and Aria will offer to have a person contact you instead.

Where the number called comes from

The business using ARIA supplies the numbers Aria dials. They come from that business’s own enquiry forms and inbound calls, from lists that business imported or entered, or from public records — such as county property, tax, probate, foreclosure and code-enforcement filings — with contact details appended by a third-party skip-tracing provider. If you ask Aria how it got your information, it is instructed to tell you plainly. ARIA does not sell personal information, and we do not use these calls to market ARIA’s own products to the people called.

What we collect from a call

  • The phone numbers involved, and the time, duration and outcome of the call.
  • An audio recording and a written transcript.
  • A summary and structured details discussed on the call — for example a property’s condition, an asking price, a timescale for selling, and an interest score — written into that business’s records in ARIA.
  • Any appointment you agree to, and any correction you give (for example the pronunciation of your name, or a better number to reach you on).

Recordings and transcripts are held by our voice provider and referenced from that business’s account in ARIA. Both are visible to that business. We use them to operate the Service, to produce the summaries above, and to investigate abuse or a complaint.

Who is responsible for what

For calls a customer places to their own leads, that customer is the controller of your information and ARIA acts on their instructions as a processor. Requests to access or delete the content of such a call are usually best directed to that business; contact us and we will help you identify and reach them, and we will act on requests we are required to act on directly.

For calls ARIA itself places — the optional demo call, the one-time welcome call after signup, and test calls you trigger from your own dashboard — ARIA is the controller. Those are described in the Terms of Service, are made only to a number you gave us for that purpose, and are limited in number.

If you use ARIA to make calls

You must have a lawful basis to contact each person you send to Aria, and you confirm this to us before the feature is enabled. You remain responsible for compliance with the TCPA, state Do-Not-Call and call-recording laws, and any other rules that apply to your outreach. See “Your Responsibilities” below. We enforce calling-hours limits, per-lead do-not-call suppression, opt-out capture, and attempt limits, but these are safeguards on top of your obligations — not a substitute for them.

7. Data Retention

We retain your account and business data for as long as your account is active. After you delete your account, we remove or de-identify your data within a reasonable period, except where retention is required for legal, tax, or fraud-prevention purposes. Call recordings and transcripts follow the same rule, and may also be deleted earlier on request as described in “AI Voice Calls” above.

8. Security

We use industry-standard measures including encryption in transit, hashed passwords, and row-level access controls that isolate each customer’s data. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

9. Your Rights

Depending on your location, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact us at support@useariacrm.com. You can delete your account at any time from the Settings page.

10. Your Responsibilities with Seller & Buyer Data

You are responsible for how you collect and use the personal information of the property owners, sellers, and buyers you store in ARIA, including complying with applicable calling, texting, and marketing laws (such as the TCPA and state Do-Not-Call rules). ARIA is a tool; you are the controller of the contact data you enter.

11. Children

The Service is not directed to individuals under 18, and we do not knowingly collect their data.

12. Changes

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date and, where appropriate, by additional notice.

13. Contact

Questions about this policy? Email us at support@useariacrm.com.