Privacy Policy

This Privacy Policy describes how Arbium Inc. ("Arbium," "we," "us," or "our") collects, uses, and discloses personal data when you use the Arbium desktop application, our hosted service, our websites, and related services (collectively, the "Service").

This policy explains the information we collect, how we use it, and the choices available to you.

1. How Arbium Works

With the operating-system permissions you grant, Arbium uses OS-level frameworks to collect content from the applications you use, including text from documents, messages, emails, code, form fields, and interface labels in the active window.

Collected content and changes are transmitted securely and processed to provide the Service, including AI-assisted organization, summarization, and retrieval of your work or your team’s work.

The substance of your work is collected, transmitted and stored to be used by AI agents.

2. Which Version of Arbium You Are Using

Your rights, and our role in the law, depend on how you obtained Arbium.

• Personal use. You signed up yourself. Arbium is the controller of your personal data and this policy governs directly.
• Organization deployment. Your employer or another organization deployed Arbium and assigned you a seat. That organization is the controller of your data and Arbium acts as its processor. The organization decides what is captured, what is blocked, how long data is kept, and who may access it. Our agreement with them, including any Data Processing Addendum, governs. Where their instructions differ from this policy, theirs control. Direct access and deletion requests to your organization first.
• Self-hosted deployment. Where we have separately licensed your organization to run Arbium on infrastructure it controls, your captured data does not reach Arbium's systems at all, and this policy applies only to the account, license, and support data the organization exchanges with us. Self-hosting is not generally available; talk to us if you need it.

3. What the Agent Captures on Your Device

From the applications you use, the agent captures:

• Text collected through OS-level frameworks, meaning the readable content of the window you are working in, and the differences from one moment to the next.
• The application name and the window title.
• Timestamps for the above.
• The address of the page you are viewing, when you are in a web browser on Windows. This is used to apply your blocklist rules by domain, and it is uploaded with the capture. The macOS agent does not capture it.

This requires the Accessibility permission on your operating system, and nothing more. Arbium does not request Screen Recording and does not take screenshots. You can revoke the Accessibility permission at any time in your operating system's settings, which stops capture entirely.

4. What Never Leaves Your Device

These are properties of how the software is built:

• The inventory of applications and websites you have used is kept in a local file on that computer, so that you can manage per-app and per-site capture switches. It is not uploaded.
• Blocked content is discarded on the device, as described in the next section.

5. Blocking and Redaction Before Anything Is Sent

The blocklist

You, and in an organization deployment your administrator, can block capture by application, by domain, or by URL pattern. Blocking is enforced on your device. A capture that matches a rule is discarded there and is never transmitted to us, so it never reaches our servers or our logs.

The agent fetches its rules at startup, caches them to disk, and refreshes them periodically. It fails closed: until rules have loaded at least once, captures are held on your device rather than sent. Once the rules arrive they are applied to whatever is waiting, and the matches are discarded before anything is uploaded.

Redaction

Captures that are not blocked are then scanned on your device and the following are removed before upload:

• Credentials and secrets, detected using the community-maintained gitleaks ruleset (API keys, access tokens, private keys, and similar).
• Payment card numbers, detected by Luhn checksum combined with real card-network prefixes.
• U.S. Social Security numbers, detected by Social Security Administration format and range rules.

Blocklist matching runs on the un-redacted text so that titles and addresses still match rules; redaction then runs on whatever survived.

Detection is automated and we do not promise it is exhaustive. It will not catch every sensitive item, and it is not a substitute for blocking applications you do not want observed.

6. Other Data We Collect

Account and identity data

You sign in through an identity provider: Google, Microsoft Entra ID, or Okta, depending on your deployment. We receive and store basic profile information such as your email address and display name, and we use it to authenticate you and to associate captured data with your account. In organization deployments, user accounts and group membership may be provisioned and deprovisioned automatically by your organization's identity system over SCIM.

Device and session data

We store a per-device credential for each computer running the agent, and we record when an agent last checked in, so that you and your administrator can see which machines are enrolled and active.

Product analytics

We collect product analytics such as feature usage, performance metrics, and error rates. These events carry your account identifier. They do not carry captured content. Analytics are routed through a relay inside our own infrastructure rather than sent directly from your device to the analytics vendor.

Crash and error reports

We collect crash reports and error diagnostics, including stack traces, error messages, and device and operating-system metadata, to find and fix defects. These are routed through the same in-cluster relay. They may include your account identifier and email address. They are not intended to contain captured content, though a diagnostic payload can incidentally include fragments of data being processed at the time of a fault.

Early-access requests

If you ask for early access through our website, we collect your email address, whether you intend to use Arbium personally or at a company, any notes you write, the page you submitted from, your IP address, and your browser's user-agent string. We use this to evaluate and respond to your request and to rate-limit abuse of the form. These records are stored in a Cloudflare D1 database.

7. How We Use Your Data

• To provide the Service: build and maintain your system of record and answer queries against it.
• To derive structure: generate episode titles, summaries, facts, entities, and relationships using AI model providers.
• To authenticate you and manage your account, devices, and sessions.
• To operate organization deployments: enforce blocklist rules, provision seats, and produce the aggregate administrator reporting described in Section 10.
• To improve the Service: diagnose errors and analyze usage patterns, using analytics and crash data.
• To communicate with you about the Service and respond to your inquiries.
• To protect the Service: detect and address abuse, security incidents, and violations of our Terms.

We do not sell your personal data, and we do not use your captured content to train our own models or anyone else's.

8. Where Your Data Is Stored and Processed

For the Arbium-hosted service, collected data is encrypted in transit and stored on hosted infrastructure provided by Google Cloud Platform. We store collected content, information derived from that content, and the account and configuration data needed to operate the Service.

Our hosted infrastructure is located in the United States. If you are outside the United States, using the Service involves transferring your personal data there. Organizations with data-residency requirements should contact us before deploying.

9. Sub-Processors

We use the following third parties to operate the hosted Service:

AI model providers process the content we send in order to return a response. They are engaged under terms that do not permit training on your content. Self-hosted deployments may be configured with different providers, chosen by the operator.

We will update this list when it changes. Organizations under a Data Processing Addendum receive advance notice of new sub-processors as that agreement provides.

10. Who Can Access Your Data

You

Through the Arbium application and through your own account's connections.

AI agents you connect

You can connect Arbium to Claude, which reads your system of record through an authorized connector: your profile, entities, facts, episodes, threads, workflows, captures, and activity totals. You authorize this connection and can revoke it. Services you connect this way are not our sub-processors. You are the one directing the disclosure, and once data reaches that assistant, its own terms govern what happens to it there.

Your organization's administrators

In an organization deployment, administrators manage seats and blocklist rules and see two kinds of reporting, both scoped to their own organization.

Aggregate dashboards show capture volume over time, hours of work captured, and how many applications were seen. Above a threshold these are estimated from a sample.

A per-person list shows each member and whether their agent is running and reporting in. This is an administration view, in the same spirit as any IT or HR console: it is there so an administrator can confirm the software is deployed and working.

Administrators cannot read the content of what was captured, and they cannot see which applications or sites you personally used. Your documents, messages, and browsing are not available to them through Arbium.

Arbium personnel

Access to stored data is restricted to authorized personnel. We retain an operator credential that permits broader access for operations, incident response, and debugging. We use it only for those purposes.

Legal process

We may disclose data where required by law. Where we are permitted to notify you, or the controlling organization, before disclosing, we will.

11. Data Retention

We keep captured data, and the episodes, facts, and entities derived from it, for as long as your account exists, unless you or the controlling organization ask us to delete it. We do not currently apply an automatic expiry to captured data. Organizations that require a defined retention period should agree one with us in writing.

Account data is kept for as long as your account exists. Early-access records are kept until we have evaluated the request and for as long as we are in contact with you about it, and you can ask us to delete yours at any time. Analytics and crash reports are kept according to those providers' standard retention periods.

12. Deletion and Your Choices

• Stop capture at any time by pausing the agent, blocking specific applications or sites, quitting the application, or revoking the Accessibility permission in your operating system.
• Request deletion of your account and associated data by writing to privacy@arbium.ai. On a verified request we delete the data we hold about you, including raw captures and everything derived from them, and instruct our sub-processors to do the same where applicable.
• Request access to the personal data we hold about you at the same address.

If you use Arbium on a seat provided by an organization, send these requests to that organization. We act on its instructions and will refer you to it.

Depending on where you live, you may have further rights under laws including the GDPR and the CCPA, such as the right to know what we collect, to correct it, to delete it, to restrict or object to processing, to receive a portable copy, and not to be discriminated against for exercising these rights. Contact us to exercise them. You may also complain to your local supervisory authority.

13. Security

• All communication between the agent, the application, and our servers uses HTTPS/TLS.
• Sensitive content is dropped or redacted on the device before upload, as described in Section 5.
• Every request that reads or writes captured data, account data, or organization data carries a bearer credential that our servers resolve to a single account. A client cannot reach another account's data by naming it. Our public website endpoints, such as the early-access form, are open by design and carry no account credential.
• In organization deployments, an agent may run under an application credential issued by your organization's identity provider that does not itself name a person. In that case the agent states which signed-in user it is acting for, and the server maps that to an account. Our servers verify the application credential, not the asserted user.
• Device credentials are stored on our side as hashes, not in usable form.
• Administrative access is limited to people your organization has designated. On our hosted service that designation is held in your organization's membership records. Deployments wired to your identity provider grant it through group membership instead, fail closed when membership cannot be confirmed, and revalidate every few minutes so deprovisioning takes effect promptly.
• Third-party credentials are held as encrypted server-side secrets and are not present on client devices.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. To report a vulnerability, see our security page.

14. Cookies and Website Analytics

Our public website uses optional PostHog analytics to understand visits and improve the website. PostHog loads only after you choose “Accept.” It uses a first-party cookie and browser storage for pseudonymous visitor and session identifiers, alongside page visits, referral information, browser and device information, and specific actions such as opening research articles or diagrams, clicking demo or research links, and successfully sending an inquiry. Inquiry analytics record only the inquiry type and outcome; they do not include your email address or message. We disable automatic interaction capture, session recordings, and person profiles on this website. These website analytics are not linked to your Arbium application data.

You can choose “Reject” and continue using the site. We remember either choice in your browser for six months. You can change it at any time using Cookie settings in the footer; withdrawing consent stops future collection and removes this analytics project’s identifiers from your browser. Withdrawal does not delete previously collected data; to request deletion, contact privacy@arbium.ai. Browser settings can also block or clear storage.

15. Children's Privacy

The Service is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@arbium.ai and we will delete it.

16. Changes to This Policy

We may update this policy. If we make a material change, and in particular if we change what the agent captures or who can access it, we will notify you through the application, the website, or by other reasonable means before it takes effect where we can. The effective date above shows when this version was issued.

17. Contact

Questions about this policy, or to exercise your rights: privacy@arbium.ai. Arbium Inc.