Privacy Statement

Armage LLC (“Armage”, “we”, “us”) is a limited liability company organized in Florida, United States.

For most of the personal data described here, Armage is the controller (the “business” under US state privacy laws): we decide why and how it is processed. For data we handle on behalf of a client, such as the subscribers to a client’s newsletter, the client is the controller and Armage is its processor (see Data we process for our clients).

This Statement covers:

• the public website at arm-age.com, its forms and the emails that follow from them;
• the Armage app at app.arm-age.com: accounts, client workspaces, approvals and billing;
• internal tools used only by Armage staff;
• newsrooms and newsletters we run for clients, and the Armage News digest;
• payments for Armage plans.

It does not cover websites and services run by others, even when we link to them or connect to them for a client. Where a signed agreement with a client sets different terms for that client’s data, the agreement prevails.

What you give us

What is collected automatically

• Connection data. Like every website, ours receive your IP address, browser type, the page requested and the time of the request. Our hosting provider processes this to deliver the pages and protect them from attacks.
• Visitor statistics. On the website, our hosting and security provider records which pages are viewed and how fast they load. It sets no cookies, does not track you across websites and does not build a profile of you.
• Sign-in and security records. In the app we keep security records of sign-ins and account activity, and an audit trail of actions such as approvals, publishing and changes to people and settings, with who did them and when.
• Abuse prevention. When you send a form or sign up, and when a sign-in looks automated, a bot check from our hosting and security provider confirms that you are a person, using your IP address and similar technical signals. They are not used to identify or profile you.
• Email delivery events. For emails we send, our email provider reports whether a message was delivered, bounced or marked as spam.

What we do not collect

• No analytics cookies, and no advertising or social media trackers (see Cookies and Storage).
• No full card numbers: card details are entered on pages hosted by Stripe.
• No health information. Armage does not process patient data. Do not send or upload patient, medical or other health information through our forms, the app or by email. If we receive it, we delete it and ask you to resend without it.

Please only send personal data about other people, such as colleagues you invite, when you are entitled to share it.

We use personal data only for the purposes below. Where the EU or UK GDPR applies, each has a legal basis.

We do not add you to marketing lists because you contacted us or bought a plan. Newsletters are opt-in only, with an unsubscribe link in every email. The Armage News digest starts only after you confirm by email, and its unsubscribe link stops the digest.

When a client uses Armage, some personal data is processed on the client’s behalf: the people in its workspace, the clinicians and experts named in its stories, and the subscribers to its newsletter, which Armage sends for the client from Armage’s email service. For that data the client is the controller and Armage is a processor (a “service provider” under US state laws). We use it only to provide the service to that client, never for our own purposes, and never for another client.

If you subscribed to a newsletter from one of our clients, or appear in a client’s content, the client’s own privacy notice applies, and requests are best sent to the client. If you write to us, we will pass your request on and help the client answer it. Every newsletter has an unsubscribe link, and new subscriptions can require you to confirm by email.

Payments for Armage plans are handled by Stripe, Inc. You enter your card on a checkout page hosted by Stripe, and Stripe stores it. Armage never receives or stores your full card number or security code. Stripe shares with us your billing details, the status of each payment and invoice, and the card’s brand, last four digits and expiry date, which we show on your Billing page. Stripe also processes payment data for its own fraud prevention and legal obligations, as described in Stripe’s privacy policy.

When you check out, Stripe records that you accepted our Customer Terms, and we keep the version you accepted and when.

No decision about you that has legal or similarly significant effects is made solely by automated means. People at Armage read and answer inquiries and review applications.

Armage uses AI models, run by our AI model providers, to draft stories from public sources and a client’s instructions, and to create illustrations. Drafts are reviewed and approved by people before anything is published. We do not send the personal data in your forms, account or billing records to AI models, and we do not use any personal data to train AI models.

The website sets no cookies of its own; see Cookies and Storage. The Armage app and the staff console set only cookies that are strictly necessary or remember a choice you made. They are first-party, locked to the site that set them (“__Host-” cookies), sent only over HTTPS, and never used for tracking or advertising:

• __Host-armage_session: keeps you signed in; ends when the session does.
• __Host-armage_csrf: protects forms against cross-site requests.
• __Host-armage_flow and __Host-armage_oauth: carry a sign-in step, such as an email code or two-factor check, for 10 to 15 minutes.
• __Host-armage_theme and __Host-armage_sidebar: remember light or dark mode and whether the menu is collapsed.

The bot check from our hosting and security provider, and Stripe’s checkout pages, may set their own strictly necessary cookies for security and fraud prevention.

We do not sell personal data, and we do not share it for cross-context behavioral advertising. We share personal data only with service providers that process it on our instructions under contract, in these categories:

A current list of our providers is available on request, and in our data processing agreement.

We may also disclose personal data:

• to professional advisers, such as lawyers and accountants, under confidentiality duties;
• when required by law, or to protect the rights, safety or property of Armage or others;
• as part of a merger, acquisition or sale of assets, in which case this Statement continues to apply to your personal data.

We will update these categories before we add a provider in a new one, and keep the list of providers current.

Armage is based in the United States, and our database is in the United States. Our providers may process personal data in the United States and in other countries where they operate; pages are served from the location nearest to you.

If you are in the European Economic Area, the United Kingdom or Switzerland, transfers of your personal data are protected by the safeguards in our providers’ data processing terms, such as the European Commission’s Standard Contractual Clauses and the UK Addendum, or by the EU–US Data Privacy Framework where the provider is certified.

We keep personal data only as long as we need it:

• Inquiries: for as long as we are in conversation or working together, then up to 24 months after our last contact, unless a contract or the law requires longer.
• Applications: up to 12 months after we decide on your application, so we can consider you for other roles. Ask us and we will delete it sooner.
• Accounts and workspaces: while your organization uses Armage, then as set out in our Customer Terms: you can ask for an export, and we delete on your organization’s written instruction, except what the law requires us to keep. The audit trail of approvals and changes is kept with the workspace.
• Sessions: end after a period of inactivity, and after a fixed maximum length.
• Billing records and terms acceptance: as long as tax, accounting and other laws require, and while they may be needed to resolve a dispute.
• Newsletter subscriptions: until you unsubscribe; an unused confirmation link is cleared once it expires.
• Encrypted backups: overwritten within 35 days.
• Abuse-prevention signals: only briefly. Connection and email delivery logs: the limited periods set by our providers for security and troubleshooting.

When personal data is no longer needed, we delete it or make it anonymous.

We protect personal data with measures appropriate to the risk, including:

• encrypted connections everywhere, and secure, first-party-only cookies;
• strict technical controls on what can run on our pages;
• two-factor authentication for staff, and for approvals and other sensitive actions;
• database rules that keep each client’s data separate, and an audit trail of changes;
• access limited to the people who need it.

No method of transmission or storage is completely secure. If you believe you have found a vulnerability, please follow our Vulnerability Disclosure Policy.

Depending on where you live, you may have the right to:

• know what personal data we hold about you and get a copy;
• correct inaccurate personal data;
• have your personal data deleted;
• object to, or ask us to restrict, how we use it;
• receive it in a portable format;
• withdraw consent where we rely on it, without affecting earlier processing.

We honor these requests wherever you live, as far as the law allows. To make one, email info@arm-age.com from the address you used with us. We may ask for information to confirm your identity. If the data is held for one of our clients, we pass your request to that client.

We acknowledge requests within five business days. Completing a request can take longer, within the deadline set by the law that applies to you:

• EEA, UK and Switzerland: within one month of receiving your request. For complex or numerous requests this can be extended by up to two further months, in which case we tell you within the first month and explain why.
• California and other US states with privacy laws: within 45 calendar days of receiving your request. When reasonably necessary this can be extended once by a further 45 days, in which case we tell you within the first 45 days.

If you are in the EEA, the UK or Switzerland, you can also complain to your data protection authority. We would appreciate the chance to address your concern first.

This section applies to residents of California and other US states with comprehensive privacy laws.

• Categories collected in the last 12 months: identifiers (name, email address, IP address), commercial information (plans bought, billing records), professional or employment information (organization, role, experience) and internet activity limited to connection and security records. Sources, purposes and recipients are described above.
• Sale and sharing: we do not sell or share personal information, and have not in the last 12 months.
• Sensitive personal information: account sign-in details are used only to sign you in and keep the account secure; we do not use any sensitive personal information to infer characteristics about you.
• Opt-out signals: we honor Global Privacy Control. Because we do not sell or share personal information, no further opt-out is needed.
• Your rights: to know, access, correct and delete, and not to be discriminated against for using them. An authorized agent may make a request for you with your written permission; we will verify both of you.

Armage is for businesses and professionals and is not directed to children under 16. We do not knowingly collect their personal data. If you believe a child has sent us personal data, contact us and we will delete it.

We update this Statement when our practices change, for example before we add a new provider or a new way of collecting data. The date at the top shows the latest version. If a change is significant, we will say so on this page, and tell account owners by email.

Armage LLC. Email info@arm-age.com for privacy questions and requests.