BOWTY Expert Privacy Statement
Version 1.0 · Last updated in October 2026
This statement explains what personal data Arborion Global Private Limited (Arborion Global, we, us) processes when you use BOWTY Expert, why, and the rights you have. It covers the BOWTY Expert desktop application for macOS and Windows, the BOWTY Expert licensing service at bowty.arborionglobal.com (including buying BOWTY Expert, free trials, activation and revision checkpoints), and Arborion accounts used to sign in to BOWTY Expert. We handle personal data in keeping with the India Digital Personal Data Protection Act and, where it applies, the General Data Protection Regulation. It is also published at www.arborionglobal.com/bowty/privacy.
Arborion Global Private Limited, 4th Floor, Hiranandani Circle, Hiranandani Business Park, Chitalsar Manpada, Ghodbunder Road, Thane 400607, Maharashtra, India, is the controller of the personal data described here. You can reach us at support@arborionglobal.com or on +91 9099487340.
1. The short version
- Your bow ties stay with you. Bow tie diagrams, risk assessments, reports, templates and logos are files on your computer or in the shared folders you choose. BOWTY Expert never sends their content to us.
- No tracking. BOWTY Expert has no analytics, advertising or usage tracking.
- We never store your password in BOWTY Expert. You sign in inside the app; BOWTY Expert sends your password only to Arborion Accounts, our own account service, over an encrypted connection. Arborion Accounts keeps only a one-way hash of it, never the password itself. The licensing service receives only a signed confirmation of your e-mail address and name.
- We never see your card details. Online payments are made through Razorpay, which handles card, UPI and bank details.
- We process only what buying, sign-in, activation, licensing and checkpoints need: your e-mail and name, your billing details if you buy, an activation record for each activated computer (with one-way hashes of its identifiers, its name, operating system and BOWTY Expert version), revision checkpoint records, audit records and request logs.
2. What we process, and why
| Data | When | Why (legal basis) |
|---|---|---|
| Purchase: the name and address for the invoice, your e-mail, your GSTIN (optional) and state (place of supply), the order details (plan, number of computers, amounts and any promotional code), the order and payment references, and the GST tax invoices and credit notes we issue. Card, UPI and bank details are handled by Razorpay and are not stored by us | When you buy a licence through our checkout page | To take payment, issue and manage the licence and invoice you (contract, and legal obligation for tax records) |
| A 6-digit verification code, kept only as a one-way hash and valid for 15 minutes | When you start a free trial, or activate a computer without internet at bowty.arborionglobal.com/activate | To confirm that the e-mail address is yours (contract, and legitimate interest in preventing misuse) |
| Free trial record: your account, e-mail address and, unless it is a public e-mail provider, the domain of that address | When you start a free trial | To allow one trial per person and per organisation (legitimate interest in preventing misuse) |
| Your Arborion account as known to the licensing service: e-mail, display name, the account identifier issued by Arborion Accounts, and when the account was first and last seen | When you sign in to BOWTY Expert | To sign you in securely and apply your licence (contract, and legitimate interest in secure sign-in) |
| Your e-mail address as a user of a team licence | When your organisation or we add you to a licence | To apply your organisation's licence to you (contract, and legitimate interest of your organisation) |
| Device sessions: a one-way hash of the session token and of the device identifier, and when the session was created, last used and expires | At sign-in and each licence check | Account security and seat control (legitimate interest) |
| Activation record for each activated computer: its activation ID, a one-way hash of the device identifier created by BOWTY Expert and a one-way hash of the computer's hardware identifier (never the identifiers themselves), the computer's name, operating system and BOWTY Expert version, the account that activated it, and when it was created, last renewed, replaced or deactivated | When a computer is activated, and at each licence check | To allow one seat per computer, to reuse the seat when BOWTY Expert is reinstalled, to enforce the number of seats, for security, and so you and we can recognise your activated computers (contract, and legitimate interest in preventing unlicensed use) |
| Revision checkpoint: the file's identifier, the revision number, a one-way hash of the revision, the signing account and the time. The signed checkpoint returned to BOWTY Expert also names the signer's e-mail and name and is stored in the file. The content of the file is never sent | When you sign off a revision while online | To let anyone with the file verify that a signed-off revision has not been changed (contract, and legitimate interest in the integrity of records) |
| Audit records: the action (for example sign-in, activation, deactivation, purchase or refund), the account or staff member, the time and, for some actions, the IP address | When these actions happen | Security, accountability and fault finding (legitimate interest, and legal obligation for tax records) |
| IP address and time of each request | At each request to the licensing service (server logs) | Security, abuse prevention and fault finding (legitimate interest) |
| Anything you send us | When you contact support, by e-mail or through a contact form, for example with a file or screenshot you choose to send | To answer you (contract and legitimate interest) |
BOWTY Expert checks the licence when you sign in, then at least every seven days while in use, and it tries again after each update of BOWTY Expert. While online it also confirms your Arborion account with Arborion Accounts at least once a day.
BOWTY Expert installed from our website also checks, from time to time, whether a new version is available, by reading a small public file from our download storage on Microsoft Azure. That request sends no account or file information; like any web request, it reveals the computer's IP address to the storage service.
3. Data kept only on your computer
BOWTY Expert keeps these on your computer only. They are not sent to us.
- Your bow tie files, revision history, reports and exports.
- A licence record, encrypted with your operating system's protected storage: your account's e-mail and name, a device session, this computer's activation and the signed licence lease, the BOWTY Expert version at the last check and when it was last checked. It never contains your password.
- Your Arborion account session (a random token that lets BOWTY Expert confirm your sign-in without asking for your password each time), encrypted the same way. It expires 90 days after it was last used and is deleted when you sign out.
- Your settings, organisation profile (including any logo and document numbering scheme), risk matrices and templates.
- Crash-recovery copies of open bow ties, kept in your user profile until they are no longer needed.
4. Service providers and sharing
Microsoft Azure hosts the licensing service in its Central India region (Azure App Service, Azure SQL Database, Azure Blob Storage for records, invoices and downloads, and Azure Key Vault for secrets and signing keys). Microsoft acts as our processor under the Microsoft Products and Services Data Protection Addendum.
Arborion accounts are our own service (accounts.arborionglobal.com), hosted by us on Microsoft Azure in its Central India region. Your password is sent only over an encrypted connection, and we keep only a one-way hash of it, never the password itself.
Razorpay, an Indian payment provider, processes online payments for us. You enter card, UPI or bank details with Razorpay, not with us, and we do not store them. Razorpay receives the amount, our order reference and the name, e-mail and contact details you give when you pay, and tells us whether the payment succeeded.
Microsoft 365 delivers the automatic e-mails we send from no-reply@arborionglobal.com (verification and password reset codes, receipts, invoices and licence notices). Microsoft acts as our processor under the Microsoft Products and Services Data Protection Addendum, and may process these e-mails outside your country.
We do not sell personal data. We disclose it only where the law requires it.
5. Cookies
The BOWTY Expert application uses no cookies. The Arborion account pages on the web and our checkout page use only cookies and similar storage that are strictly necessary for signing in, keeping sign-in secure and completing a payment.
6. International transfers
The licensing service and its records are hosted by Microsoft Azure in India. Some of our providers may process data outside your country. Where personal data is transferred across borders we use lawful transfer mechanisms, such as standard contractual clauses where they are required, so it stays protected to the standard described here.
7. How long we keep data
- Licence, user, activation and order records are kept for the Licence Term and afterwards for as long as the law requires us to keep business and accounting records.
- GST tax invoices and credit notes are kept for eight years, as required for GST records.
- A tamper-proof record of licensing and billing events (for example account, licence, activation, order, refund and checkpoint events, which include the e-mail addresses and device details described above) is written to write-once storage and kept for eight years, so that records can be restored and audited. It cannot be changed or deleted before then. Where we delete data at your request, we do not use the archived copy except to restore or audit records or to meet a legal obligation.
- Revision checkpoint records are kept for as long as the licensing service operates, so that signed-off revisions stay verifiable.
- Verification codes stop working 15 minutes after they are sent.
- Server request logs are kept for 30 days for security and fault finding.
- Support correspondence is kept for as long as we need it to deal with your request.
After that we delete the data or make it anonymous.
8. Security
- All communication with Arborion Accounts, the licensing service and our checkout page is encrypted (HTTPS).
- Device sessions and verification codes are stored only as one-way hashes, and we receive only one-way hashes of each computer's identifiers.
- Activations, leases and checkpoints are digitally signed (Ed25519), so they cannot be forged, and activations and leases are bound to one computer.
- Access to licensing records is restricted to authorised Arborion Global staff, who must use multi-factor authentication.
More detail is in the BOWTY Expert Security Policy.
9. Your rights
Depending on where you live you may have the right to ask for a copy of the personal data we hold about you, to have it corrected or deleted, to object to or restrict how we use it, to receive it in a portable form, to withdraw a consent you have given, to nominate someone to exercise your rights, and to complain to your data protection authority. To exercise any of these rights please write to us at support@arborionglobal.com and we will respond within the time the law allows. Deleting your account or activation records ends access to BOWTY Expert on those computers. We keep records the law requires us to keep, such as invoices.
10. Children
BOWTY Expert is professional risk analysis software. It is not directed at children, and we do not knowingly process children's data.
11. Changes
We will publish any change at www.arborionglobal.com/bowty/privacy with a new version number and date. BOWTY Expert shows the new version before you continue using it.
12. How to contact us
Email support@arborionglobal.com, call +91 9099487340, or write to Arborion Global Private Limited, 4th Floor, Hiranandani Circle, Hiranandani Business Park, Chitalsar Manpada, Ghodbunder Road, Thane 400607, Maharashtra, India.