Privacy notice for internal testing

This notice describes Aman Customer, Aman Business and their websites during internal testing. Use synthetic message content and customer records. Your real sign-in email and device information are still personal information even when the messages are synthetic.

Who to contact

The SpaarxLab team operates this test environment. Contact Harsh at harsh@spaarxlab.com for privacy questions, access, correction, deletion or concerns. A participating company's authorized administrators manage its memberships and company conversations. Contact the test operator if you are unsure who can access your company workspace.

Information processed

• Account and membership information: email, display name, preferred language, company, role, assignments and account status.
• Signup records where the installed version supports them: age confirmation, terms version and acceptance time, email challenge records, authenticator enrollment and protected recovery-code records.
• Communications: submitted messages, available translations, participants, group membership, message times, read and delivery states.
• Security and operations: sessions, access and administration audit events, request/network information used for service operation and abuse limits, and operational error records.
• Notifications: device registration and push tokens, platform information, notification preferences and delivery records when notifications are enabled.
• Support correspondence and information you choose to send when reporting a problem.

How the information is used

Aman uses this information to verify access, manage company membership, deliver and display conversations, maintain sessions, send requested authentication and service notifications, investigate test failures, enforce access controls and answer support requests. Required session storage on the website or app keeps you signed in. Notification permissions can be changed in your device settings.

Who can receive information

Messages are made available to the intended conversation participants and authorized company staff. Company administrators can review company conversations, with audit records. The test operators can access service information as needed to operate and troubleshoot the environment.

The hosted environment uses Microsoft Azure infrastructure. Resend processes transactional email, including recipient addresses and email contents. Enabled mobile notifications use Expo and Apple APNs or Google FCM as applicable to the device and delivery path. These providers may process information in other countries. The current Resend sending domain is configured in Tokyo; this is not a promise that all Aman data stays in Japan or any single country.

The current internal-test setup has no identified advertising use or sale of data. This notice does not claim end-to-end encryption: the service processes message content to store and deliver it, and authorized administrators can read company conversations.

Retention and removal

Account, message, delivery and audit records remain stored unless removed through an operator action or a test-environment reset. There is currently no automatic schedule that deletes all test data after a fixed number of days. A sign-in code expiring or a session being revoked does not mean its underlying records have been erased. Backups can retain earlier copies after a change in the active system.

You may request deletion or correction through the contact above. Requests require verification of your control of the account and assessment of the relevant company records. The operator will explain what can be removed and any retained records or backup limitations for that request. This notice does not promise a fixed deletion deadline or that every company message is removed automatically when an account is closed.

Your choices

You can stop participating, sign out, adjust available notification preferences, and contact the operator to request access, correction or deletion of your personal information. Use the deletion request page for the details needed. Never send a password, authentication code, recovery code or identification document in the initial request.

Audience and changes

The internal test is intended for adults aged 18 or over. It is not intended to collect children's information. Contact the operator if such information is submitted accidentally. This notice is version internal-2026-09-29-v1, dated 29 September 2026. A broader public release requires updated disclosures matching its actual operations.