Privacy Notice
Arina is built privacy-first. The short version: we don't log your searches, there are no trackers or cookies, and the beta runs on EU infrastructure.
What Arina is
Arina is a curated directory search (beta) over vaicat's own curated European reference data — educational institutions, study programmes, companies, places, and our help content. ArinaBot is also beginning limited, allowlisted public-web crawl pilots; those crawled pages are governed by our separate crawled-content privacy notice.
Your searches are private
- We do not log or store your search queries. Search requests go to the read-only Arina query API, whose application logging is disabled and whose nginx access log is off.
- The public static website may keep short operational web-server logs for page requests
such as
/and/privacy; those requests do not contain your search terms. - No cookies, no analytics (client- or server-side), no advertising, no trackers.
- No third-party fonts, scripts, or CDNs — fully self-hosted.
- Search and detail requests are sent with
referrerPolicy: no-referrer, so your terms are not leaked onward.
Data we process
(a) Data you provide by using Arina
To serve a search and protect the service we transiently process your request (including your IP address and the search terms) in memory only — we do not store search terms or write them to access logs. Ordinary static page requests may appear briefly in operational web-server logs, without search terms. If you email us to exercise a right, that message contains your contact details, which we use only to handle your request.
(b) Data in the directory index (not collected from you)
The index holds vaicat's curated records about European institutions, programmes, companies, places, and our help content.
- Categories of personal data: limited — names, professional roles/titles, institutional/professional contact details, and content authorship, where these appear in a published, professional context.
- Source: publicly accessible official and institutional sources (e.g. institutions' and companies' own published information) and our own editorial research — not private accounts.
- We do not build profiles of individuals, combine sources to enrich person records, or keep behavioural history.
Why, and on what basis
Purpose: to operate a curated, privacy-preserving directory that keeps European institutions, education, companies, and public information findable, accurate, and secure.
Lawful basis: legitimate interests — GDPR Art. 6(1)(f). The interests pursued: vaicat's interest in offering a privacy-respecting discovery tool, and the public interest in finding this professional/reference information. We pursue them in a data-minimising way (no profiling, no query logging), and you can object at any time (below).
Recipients
- The public — directory results are shown to anyone using Arina.
- Processors acting for us — our EU hosting provider (Leaseweb, Netherlands)
and the email provider that handles the
privacy@vaicat.commailbox. - Competent authorities, only where we are legally required to disclose.
- We do not sell personal data or share it with advertisers or data brokers.
Where it is hosted / international transfers
The search service and index run on EU infrastructure we control (Netherlands);
OpenSearch is not exposed to the internet and there is no CDN. The only routine processing outside
the EU concerns our email provider for the privacy@vaicat.com mailbox, which may
process that correspondence outside the EU under appropriate safeguards (e.g. EU
Standard Contractual Clauses / an adequacy mechanism).
Automated decision-making
We do not carry out automated decision-making that produces legal or similarly significant effects on individuals (GDPR Art. 22). Search ranking only orders directory results; it makes no decisions about people.
Your rights
You have the right to access, rectification, erasure, and restriction (GDPR Art. 15–18). Data portability (Art. 20) does not apply to this legitimate-interest processing.
You have the right to object (Art. 21): you may object at any time to our processing based on legitimate interests — including asking us to remove a record about you.
To exercise any right, email privacy@vaicat.com with the record/URL concerned (we may need enough detail to identify it). We respond without undue delay and within one month. You may also lodge a complaint with the Autoriteit Persoonsgegevens or your local EU/EEA supervisory authority.
Retention
- Directory records: kept while accurate and relevant; removed on a valid request and noted so they stay removed.
- Your searches: not retained — search terms are not stored or logged.
- Rights-request emails: kept only as long as needed to handle the request and meet legal obligations, then deleted.
- Operational data: minimal static-site web logs may be kept briefly for security and troubleshooting; query API access logs are disabled.
Changes
We will update this notice as Arina evolves and post the revised version here.