Privacy Policy

Last Updated: June 30, 2026

This Privacy Policy explains how Arn ("Arn," "we," "us," or "our") collects, uses, discloses, and protects information when you visit getarn.com, use our application, connect third-party services, or otherwise interact with our products and services collectively, the "Services".

Arn provides a B2B communications application that helps companies organize, classify, search, and generate business communications and related operational context across connected systems.

This Privacy Policy applies to information we process for our own business purposes, such as website data, account data, product usage data, security logs, support communications, and billing-related information. When we process content submitted, synced, connected, or otherwise made available by a customer through the Services, we generally process that information on behalf of the customer under our agreement with that customer.

1. Information We Collect

We collect information in the following categories.

Account Information

When you create an account or use the Services, we may collect information such as your name, email address, company name, role, workspace membership, login credentials, authentication information, preferences, and other information you provide.

Customer Content

Customers and authorized users may submit, sync, connect, upload, generate, or otherwise make available content through the Services. This may include emails, messages, threads, documents, files, notes, attachments, comments, customer records, account records, deal records, relationship context, workflow data, metadata, and other business communications or operational information.

Customer Content may come from connected services, including Gmail, Microsoft Outlook, Slack, Microsoft Teams, HubSpot, Salesforce, Google Drive, and similar business systems that a customer or authorized user chooses to connect.

Integration Data

If you or your organization connects third-party services to Arn, we may access and process information from those services according to the permissions granted and the customer's configuration. This may include message content, email content, file content, document metadata, channel or folder names, contact information, customer records, CRM records, timestamps, senders, recipients, thread participants, and related metadata.

You can limit Arn's access by changing permissions in the connected third-party service or disconnecting the integration, subject to your organization's settings and applicable agreements.

AI Processing Data

Arn uses large language models and related AI systems to support features such as classification, generation, summarization, routing, extraction, drafting, search, and workflow assistance.

AI features may process Customer Content, integration data, account information, usage data, and related metadata as necessary to provide the Services. We do not use Customer Content to train general-purpose AI models unless expressly stated in a written agreement with the applicable customer.

Generated outputs may be inaccurate, incomplete, or require human review. Customers and users are responsible for reviewing AI-generated content before relying on it or sending it externally.

Usage, Device, and Log Information

We may collect information about how users access and use the Services, including IP address, browser type, device type, operating system, referring pages, pages viewed, dates and times of access, authentication events, session activity, feature usage, API activity, error logs, performance data, security events, and similar diagnostic information.

We use Dash0 for observability, logging, debugging, monitoring, reliability, and performance analysis.

Communications and Support Information

If you contact us, request support, provide feedback, or communicate with us, we may collect your contact information, message contents, diagnostic information, and any other information you choose to provide.

Billing Information

If you purchase paid Services, we may collect billing-related information, such as company billing details, subscription plan, payment status, invoice details, and transaction history. Payment card information may be processed by our payment processor and may not be stored directly by Arn.

Cookies and Similar Technologies

We may use cookies, local storage, pixels, and similar technologies to operate the Services, keep users signed in, remember preferences, protect against fraud and abuse, understand usage, and improve performance.

2. Cloudflare and Cloudflare Turnstile

Arn uses Cloudflare to host, secure, operate, and deliver the Services.

We also use Cloudflare Turnstile in invisible mode to help protect our website and Services from spam, abuse, bots, automated activity, credential attacks, and other security threats.

Because Turnstile operates in invisible mode, users may not see a visible challenge. Turnstile may process certain technical signals from your browser or device, such as IP address, user-agent information, browser characteristics, sitekey, origin, and related security signals, to determine whether a request appears to come from a human user or automated traffic.

Cloudflare processes Turnstile data as described in the Cloudflare Turnstile Privacy Addendum, which is available from Cloudflare. The Cloudflare Turnstile Privacy Addendum is incorporated into this Privacy Policy by reference for purposes of describing Cloudflare's processing of Turnstile data.

3. How We Use Information

We use information to:

provide, operate, maintain, secure, and improve the Services;
create, authenticate, and manage accounts and workspaces;
connect and sync authorized third-party integrations;
organize, classify, search, route, summarize, and generate business communications and related context;
provide AI-powered features, including classification and generation;
monitor system performance, debug issues, and improve reliability;
maintain observability, logging, security monitoring, and abuse prevention;
protect against spam, bots, fraud, unauthorized access, and security incidents;
provide customer support and respond to inquiries;
communicate about product updates, administrative notices, security alerts, and service-related messages;
process subscriptions, payments, and invoices;
enforce agreements and protect legal rights;
comply with applicable laws and legal obligations.

We do not sell Customer Content. We do not use Customer Content for cross-context behavioral advertising.

4. How We Share Information

We may share information in the following circumstances.

Service Providers

We may share information with vendors and service providers that help us operate the Services, including hosting, infrastructure, security, observability, logging, analytics, authentication, support, payments, email delivery, and AI processing providers.

Our core infrastructure is hosted on Cloudflare. We use Dash0 for observability and related logging, tracing, monitoring, and debugging workflows.

Connected Integration Providers

When a customer or authorized user connects Arn to a third-party service, we may exchange information with that service as necessary to provide the integration. For example, we may access, retrieve, process, update, or transmit information through Gmail, Microsoft Outlook, Slack, Microsoft Teams, HubSpot, Salesforce, Google Drive, or other connected services, depending on the customer's configuration and permissions granted.

Customer Organizations

If you use the Services through your employer, company, or another organization, that organization may access and control information associated with its workspace, including users, roles, settings, integrations, activity, Customer Content, and generated outputs.

Legal, Security, and Safety Reasons

We may disclose information if we believe it is necessary to comply with law, regulation, legal process, or governmental request; protect the rights, property, or safety of Arn, our customers, users, or others; detect or prevent fraud, abuse, or security incidents; or enforce our agreements.

Business Transfers

If Arn is involved in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction, information may be transferred as part of that transaction.

With Consent or Direction

We may share information when you or the applicable customer directs us to do so or gives us permission.

5. Customer Content and Workspace Data

Arn is designed for business use. Customer organizations decide which users are authorized, which integrations are connected, what Customer Content is submitted or synced, and how workspace data is configured.

If you are an end user of a customer organization and have questions about data in your organization's workspace, you should contact that organization first. We may refer privacy requests relating to Customer Content to the applicable customer.

6. AI Features

Arn uses AI systems, including large language models, to provide product features such as classification, generation, summarization, extraction, routing, drafting, and workflow support.

AI features may process Customer Content and integration data to provide requested outputs. For example, Arn may classify a message, summarize a thread, generate a draft, extract structured fields, or suggest a workflow action based on connected communications and business records.

We do not use Customer Content to train general-purpose AI models unless expressly stated in a written agreement with the applicable customer.

AI-generated outputs are provided to assist users and may require human review. Users should review outputs before relying on them, sending them, or using them for business decisions.

7. Data Retention

We retain information for as long as reasonably necessary to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and support legitimate business purposes.

We retain logs for 90 days, unless a longer retention period is required for security, legal, compliance, backup, or dispute-resolution purposes.

Customer Content is retained according to the applicable customer agreement, workspace settings, product functionality, and deletion controls. Customers may be able to delete or disconnect certain Customer Content through the Services or through the connected third-party service.

Backups and residual copies may persist for a limited period after deletion before being overwritten or removed in the ordinary course of business.

8. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information from unauthorized access, loss, misuse, alteration, or disclosure.

These safeguards may include access controls, authentication, encryption, logging, monitoring, rate limiting, bot detection, and infrastructure-level protections. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of your account credentials and for using appropriate access controls within your organization.

9. International Data Transfers

We may process and store information in the United States and other countries where we or our service providers operate. If you access the Services from outside the United States, your information may be transferred to and processed in countries that may have different data protection laws than your location.

Where required by applicable law, we use appropriate safeguards for international transfers of personal information.

10. Your Privacy Rights and Choices

Depending on your location and relationship with Arn, you may have rights to request access, correction, deletion, portability, restriction, or objection regarding certain personal information.

To make a privacy request, contact us at privacy@getarn.com or notices@getarn.com.

We may need to verify your identity before responding. For requests involving Customer Content or workspace data, we may direct the request to the applicable customer organization.

You may also have choices related to cookies, marketing communications, account settings, and third-party integrations. You can unsubscribe from marketing emails by using the unsubscribe link in those emails. You may still receive transactional, administrative, security, or service-related messages.

11. California Privacy Notice

If you are a California resident, California law may provide you with additional rights regarding personal information, including the right to know, access, correct, delete, and opt out of certain sales or sharing of personal information.

Arn does not sell personal information. Arn does not use Customer Content for cross-context behavioral advertising.

To exercise California privacy rights, contact us at privacy@getarn.com or notices@getarn.com.

12. European Economic Area, United Kingdom, and Swiss Users

If you are located in the European Economic Area, United Kingdom, or Switzerland, our legal bases for processing personal information may include:

performance of a contract, such as providing the Services;
legitimate interests, such as securing, improving, and operating the Services;
compliance with legal obligations;
consent, where required.

Where Arn processes Customer Content on behalf of a customer, the customer is typically the controller and Arn is typically the processor. Where Arn determines the purposes and means of processing, such as for account administration, website analytics, billing, security, and direct communications, Arn may act as the controller.

13. Children's Privacy

The Services are intended for business use and are not directed to children. We do not knowingly collect personal information from children under 13 or under the age required by applicable law. If you believe a child has provided personal information to us, contact us at privacy@getarn.com or notices@getarn.com.

14. Third-Party Services

The Services may integrate with or link to third-party websites, applications, and services. This Privacy Policy does not apply to third-party services. Their privacy policies and terms govern how they collect, use, and disclose information.

Third-party services that may be connected to Arn include Gmail, Microsoft Outlook, Slack, Microsoft Teams, HubSpot, Salesforce, Google Drive, and other services authorized by a customer or user.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we may provide notice by updating the date at the top of this policy, posting a notice in the Services, emailing account administrators, or using another legally appropriate method.

16. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us at:

Arn
Website: getarn.com
Email: privacy@getarn.com or notices@getarn.com