Privacy · in three lines

With your admin’s consent Aristo reads Microsoft 365 usage signals, shows leaders only teams of 5 or more, never trains on your data, and erases a person who says “forget me”.

the same five-person floor on every page and every export

Aristo — Privacy Policy

Aristo is a product of PhoenixHalo, Inc. · Effective 9 August 2026

Aristo is built on one promise: care, not surveillance. Aristo reads your organization as the application, through the read permissions your administrator granted, and sends its Teams messages and weekly digest as the application; anything it does for one person — reading or sending that person’s mail, reading their calendar — runs as that person, only when they ask. Every number a leader sees is a whole team at a time, anonymized — never an individual. The single exception is a named department view under your organization’s named-data contract. Eligible people are included by default unless a privacy exclusion applies; earlier “do not name me” choices remain honored. The five-person floor still applies, and the view shows only a name and cohort membership—never a personal activity ledger, prompts, documents, timeline, or usage ranking.

Who we are

Aristo is operated by PhoenixHalo, Inc. (“PhoenixHalo”, “we”). For any privacy question or request, contact email a person.

What Aristo accesses, and why

With your Microsoft 365 administrator’s explicit consent, Aristo reads Microsoft 365 usage signals through Microsoft Graph — six read permissions across your organization — to recommend Copilot “recipes” for each person and to measure adoption at the team level; the same consent lets it read a person’s own mail and calendar, and send mail as them, only when that person asks. Actions for a person run as that person, only after they ask; Aristo’s own Teams messages and weekly digest run as the application, and so does an approved seat move once the separate extended consent is granted.

What we do NOT do

We do not sell your data. We do not read the content of your messages or files for monitoring. We do not show managers any individual’s activity — every leader view is aggregated across a whole team and suppressed unless it covers at least five people. The single exception is a named department view under your organization’s named-data contract. Eligible people are included by default unless a privacy exclusion applies; earlier “do not name me” choices remain honored. The five-person floor still applies, and the view shows only a name and cohort membership—never a personal activity ledger, prompts, documents, timeline, or usage ranking. We do not use your tenant’s data to train shared models.

Data we store

Aristo stores the minimum needed to do its job: which recipes were offered and tried (per user, to avoid repeating), team-level adoption counts, your tenant’s configuration, and an aggregate governance ledger. Records carry a time-to-live and age out automatically.

Your choices and rights

Any user can say “forget me” in Aristo and their personal records are erased — the operational audit trail of actions already taken is retained, and can name the people involved in a seat move. Leaving during the pilot is a white-glove step: write to Aristo support and an accountable operator walks your organization out — new work is frozen first, your pilot data is removed and re-checked for anything left behind, then Aristo’s own access is revoked and independently verified. Your completion record is provided once its publication is confirmed. There’s no self-service “erase our org” button during the pilot — a person does it with you. Aristo keeps the operational record of the offboarding itself — the audit trail that proves it was done right. You may request access to, or deletion of, your data at any time via email a person. Aristo’s nudges are opt-out, always honored.

Where your data lives & who processes it

Aristo runs on Microsoft Azure. Our sub-processors are Microsoft (hosting and Microsoft Graph) and the AI provider(s) used to generate recommendation text. Your tenant’s data is isolated per tenant and encrypted in transit and at rest.

Security

We follow least-privilege access, per-tenant isolation, and encryption. Aristo requests only the Microsoft permissions it needs, and explains each one in plain words before you grant it.

Changes

If we change this policy, we will update the date above and, for material changes, notify your administrator.

This page is the privacy policy referenced in the Microsoft commercial marketplace listing for Aristo. PhoenixHalo, Inc.