Privacy Policy
1. Introduction and Scope
This Privacy Policy (this “Policy”) describes how ARBR Inc., a Delaware corporation (“ARBR,” “we,” “us,” or “our”), collects, uses, discloses, and otherwise processes personal information in connection with (a) the website located at this domain and any associated pages (the “Website”), and (b) the Arbiter Network Intelligence software service and related services (collectively, the “Services”).
The Services are provided to organizations pursuant to a written agreement between ARBR and each such organization (each, a “Customer Agreement”). In the event of any conflict between this Policy and a Customer Agreement with respect to information processed under that Customer Agreement, the Customer Agreement shall control.
2. Definitions
For purposes of this Policy:
- “Customer” means an organization that has entered into a Customer Agreement with ARBR.
- “Authorized User” means an individual whom a Customer has authorized to access and use the Services on its behalf.
- “Customer Data” means all information, including personal information, that is submitted to the Services by or on behalf of a Customer, or that is collected, compiled, or generated by the Services at the direction of a Customer.
- “Research Subject” means an individual about whom Customer Data is processed, including any individual connected to a person whom a Customer has directed the Services to research.
- “Personal information” means information that identifies, relates to, describes, or is reasonably capable of being associated with a particular individual, and includes equivalent terms as defined under applicable law.
3. Our Role
With respect to information collected through the Website and account information concerning Authorized Users, ARBR determines the purposes and means of processing.
With respect to Customer Data, ARBR acts as a service provider and processor on behalf of the applicable Customer. Each Customer determines which individuals are researched and the purposes for which Customer Data is processed, and ARBR processes Customer Data solely in accordance with the Customer Agreement and the Customer’s documented instructions, as set forth in the Customer Agreement and in the Customer’s configuration and use of the Services. Customer Data of each Customer is logically segregated from that of every other Customer.
Where Customer Data includes nonpublic personal information subject to the Gramm-Leach-Bliley Act and its implementing regulations, including Regulation S-P, ARBR uses and discloses such information only as necessary to provide the Services to the Customer and as otherwise permitted by the Customer Agreement and applicable law, does not use or disclose it for any other purpose, and handles it as further set forth in the Customer Agreement.
4. Information Collected Through the Website
4.1 Server Logs
The service that hosts the Website automatically records certain information with respect to each request, including the Internet Protocol (IP) address of the requesting device, browser type, the page requested, and the date and time of the request. This information is used to operate and secure the Website.
4.2 Demonstration Requests
The “Book a demo” link directs you to a scheduling page operated by Calendly, LLC (“Calendly”). Information you provide on that page, such as your name, email address, and any notes, is collected by Calendly and made available to ARBR for the purpose of scheduling and conducting the requested meeting. Calendly’s collection and use of information, including through cookies, is governed by Calendly’s privacy policy.
4.3 Correspondence
If you contact us by email, we receive the contents of your message and any information contained in it.
4.4 Website Practices
The Website does not use analytics or advertising technologies, does not set cookies, does not load content from third-party servers, and does not track visitors across other websites.
5. Information Concerning Authorized Users
Authorized Users authenticate to the Services using a Google account through our authentication provider, Auth0. In connection with each Authorized User, we collect and maintain name, email address, the Customer accounts to which the Authorized User belongs, the permission level assigned within each Customer account, and records of actions taken within the Services.
6. Customer Data
6.1 Categories of Personal Information
Depending on the instructions of the applicable Customer, Customer Data may include the following categories of personal information concerning Research Subjects:
- Identifiers, including names, aliases, postal and email addresses, telephone numbers, online account identifiers, membership numbers, and identifiers assigned by the Customer;
- Personal characteristics, including age, nationality, and whether an individual is deceased;
- Professional and educational information, including employment history, professional licenses and registrations, board positions, and organizational memberships;
- Family and relationship information, including family members (who may include minors) and relationships among individuals;
- Property and financial information, including real property holdings and the manner in which they are held, estimated property values, investments, digital asset holdings, political contributions, and philanthropic activity;
- Public records information, including court proceedings, criminal records, liens, bankruptcies, regulatory and disciplinary actions, sanctions screening results, and media coverage;
- Information regarding the presence of an individual’s information on data broker and people-search websites, and the online accounts associated with an email address or telephone number;
- Information regarding interests, events, and achievements;
- Inferences generated by the Services, including estimated wealth ranges and assessments of fit; and
- Notes, files, and other content submitted by a Customer, and summaries and analyses generated by the Services.
6.2 Sources
Customer Data is obtained from the following categories of sources:
- The Customer, including files uploaded and notes entered by its Authorized Users;
- Publicly available sources, including websites, search engines, court records, government registers and filings, sanctions lists, public social media accounts, and news media; and
- Commercial data providers, including people-search services and services that identify publicly available accounts associated with an email address or telephone number.
The Services retain copies of the source materials from which findings are derived for the purpose of verification. A list of the commercial data providers used in the Services is available upon request.
7. How We Use Personal Information
We use personal information collected through the Website to schedule and conduct demonstrations, to respond to inquiries, to communicate with you regarding the Services where you have expressed interest, and to operate and secure the Website.
We use Authorized User information to provide, administer, support, and secure the Services, to enforce access permissions, and to maintain records of use.
We process Customer Data solely to provide the Services to the Customer on whose behalf it is processed, including to identify, verify, and organize information and to generate summaries and analyses for that Customer. We do not use Customer Data of one Customer for the benefit of any other Customer, and we do not use Customer Data to train artificial intelligence or machine learning models.
8. Artificial Intelligence Processing
The Services use large language models developed by Anthropic, PBC (“Anthropic”) and provided by Google LLC (“Google”) as a managed service on Google Cloud, together with embedding models provided by Google, to analyze source materials and generate findings and summaries. Google processes information submitted to these models as ARBR’s processor under the Google Cloud Data Processing Addendum. Google’s terms and documentation provide that Google does not use such information to train or fine-tune any artificial intelligence or machine learning model without ARBR’s permission and does not share prompts or responses with Anthropic or any other third party. ARBR has not enabled optional logging of prompts and responses.
Where a Customer elects to connect the Services to its own Anthropic account, information requested through that connection is transmitted to that account and is governed by the Customer’s agreement with Anthropic.
9. Disclosure of Personal Information
We disclose personal information only as follows:
- Customers. To the Customer on whose behalf Customer Data is processed and, at the Customer’s direction, to services the Customer connects to the Services, as described in Section 8.
- Service providers. To vendors that process personal information on our behalf, subject to contractual obligations, including: Google LLC (hosting of the Website and the Services, database, storage, email, and artificial intelligence services, including the Anthropic models described in Section 8); Okta, Inc. (Auth0) and Google LLC (authentication); Functional Software, Inc. (Sentry) (error monitoring, configured to minimize the personal information it receives); and the commercial data providers described in Section 6.2, which receive only the information necessary to perform a search.
- Search and public data sources. To search engines and public data sources, which receive the search terms (such as a name, email address, or telephone number) necessary to retrieve publicly available information.
- Legal requirements. Where we believe in good faith that disclosure is required by law, regulation, subpoena, court order, or other legal process.
- Protection of rights. Where necessary to protect the rights, property, or safety of ARBR, our Customers, or others.
- Business transfers. To a successor or acquirer in connection with a merger, acquisition, reorganization, or sale of all or a portion of our business or assets, subject to this Policy.
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under applicable law.
10. Cookies and Similar Technologies
The Website does not set cookies. The Services use browser local storage to maintain authenticated sessions and to remember interface preferences, including the Customer account last selected by an Authorized User. The Services do not use analytics or advertising technologies. Google and Auth0 may set cookies in connection with authentication, subject to their respective privacy policies.
11. Data Location
Customer Data and Authorized User information are stored in the United States. Information submitted to the artificial intelligence models described in Section 8 may be processed in Google Cloud facilities outside the United States.
12. Data Security
We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest and role-based access controls. Access to Customer Data is limited to the Customer’s Authorized Users, in accordance with the permission levels established by the Customer, and to ARBR personnel who require access to operate, support, and secure the Services. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We will notify affected Customers without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a breach of security resulting in unauthorized access to their Customer Data.
13. Data Retention
We retain Customer Data for the term of the applicable Customer Agreement. A Customer may delete information concerning a Research Subject at any time. Upon deletion, the associated Customer Data is removed from the active Services, except that we retain a minimal record identifying the deleted individual solely to prevent that individual’s information from being collected again for that Customer. Within thirty (30) days following the termination or expiration of a Customer Agreement, or earlier upon the Customer’s written request, we will delete that Customer’s Customer Data, including associated activity and system logs, from the active Services. Backup copies are overwritten in the ordinary course within fourteen (14) days thereafter. Before deletion, a Customer may request an export of its Customer Data in accordance with the Customer Agreement.
We retain Authorized User account information and records of activity within the Services for the term of the applicable Customer Agreement and for a reasonable period thereafter as necessary to maintain the security of the Services, resolve disputes, comply with legal obligations, and enforce our agreements.
We retain demonstration requests and correspondence for so long as reasonably necessary for the purposes described in this Policy and for our ordinary business records. Server logs are retained for a limited period determined by our hosting provider.
14. Requests Concerning Customer Data
Because each Customer controls the Customer Data processed on its behalf, requests by a Research Subject to access, correct, or delete Customer Data should be directed to the applicable Customer. If you are unable to identify the applicable Customer, or prefer to contact us directly, you may submit your request to us at the address below. We will forward the request to the applicable Customer and assist the Customer in responding, and we will respond directly where required by applicable law.
15. Your Privacy Rights
This Section applies to personal information for which ARBR determines the purposes and means of processing, as described in Section 3. Requests concerning Customer Data are addressed in Section 14.
Subject to applicable law, you may have the right to request access to, correction of, or deletion of personal information we hold about you, and to obtain information regarding the categories of personal information we collect, the sources from which it is collected, the purposes for which it is used, and the categories of third parties to which it is disclosed. Residents of California and certain other jurisdictions may have additional rights under applicable law. We will not discriminate against you for exercising any of these rights.
To exercise these rights, contact us at the address below. We will verify your identity before responding to a request, and you may designate an authorized agent to submit a request on your behalf as permitted by applicable law. We will respond within forty-five (45) days, or such other period as applicable law permits. If we decline your request, you may appeal by replying to our decision, and we will respond to the appeal within the period required by applicable law. If you are dissatisfied with our response to an appeal, you may contact the Attorney General of your state.
We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit its use under applicable law.
16. Permitted Use
The Services are intended to assist Customers in researching and preparing for business and social relationships. The Services may not be used, in whole or in part, as a factor in determining an individual’s eligibility for employment, housing, credit, insurance, or the opening or maintenance of an account, or for any other purpose described in Section 604 of the Fair Credit Reporting Act or similar laws. The Services, including any sanctions screening results, are not a substitute for a Customer’s customer identification, anti-money laundering, or sanctions compliance procedures. ARBR is not a consumer reporting agency, and the Services do not furnish consumer reports.
17. Do-Not-Track and Global Privacy Control
Because the Website and the Services do not track users across third-party websites or use personal information for targeted advertising, they do not respond differently to Do-Not-Track browser signals. We honor Global Privacy Control signals as an opt-out of the sale or sharing of personal information to the extent required by applicable law, although we do not engage in such sale or sharing.
18. Children
The Website and the Services are intended for business use and are not directed to children under the age of sixteen (16). We do not knowingly collect personal information from children under sixteen (16) through the Website.
19. Third-Party Websites and Services
The Website and the Services may contain links to, or integrate with, third-party websites and services, including Calendly. Such third parties are governed by their own privacy policies, and ARBR is not responsible for their practices.
20. Changes to This Policy
We may amend this Policy from time to time. Amendments will be posted on this page with a revised effective date. We will notify Customers of any material amendment affecting the processing of Customer Data, and Authorized Users of any material amendment affecting information concerning them, before such amendment takes effect.
21. Contact Us
Questions regarding this Policy and requests concerning personal information may be directed to ARBR Inc. at network@arbiterdefense.group.