Privacy Policy

ArdaBot, Inc. (“ArdaBot,” “we,” “us,” or “our”) is a Delaware C corporation. This Privacy Policy describes how we collect, use, disclose, and protect personal information when you use the websites at arda.bot and app.arda.bot, Arda Orchestra, Orchestra Studio, and related services (collectively, the “Service”).

By accessing or using the Service, you acknowledge this Privacy Policy. If you do not agree, please do not use the Service.

1. Information We Collect

a. Information You Provide

• Account information: your name, email address, phone number, passkey, organization details, and other supported authentication information.
• Billing information: subscription, transaction, and billing details processed by Stripe. We do not store full payment-card numbers on our servers.
• Workflow content: workflow definitions, prompts, inputs, outputs, execution logs, files, integration settings, human-review decisions, and related data you submit to or generate through the Service.
• Support and sales communications: information you provide when you contact us, request support, or submit an enterprise inquiry.

b. Information Collected Automatically

• Usage data: feature use, workflow and instance activity, credit consumption, event timestamps, and service interactions.
• Device and connection data: IP address, browser type, operating system, device identifiers, and referring pages.
• Log and security data: request metadata, error information, audit events, authentication events, and signals used to prevent fraud and abuse.

c. Information from Third Parties

• Authentication providers: identity information from Privy or another provider configured for your organization.
• Integrations and AI providers: information returned by services you connect to a workflow, including Arda Gateway and customer-selected model providers.
• Payment providers: subscription and transaction status from Stripe.

2. How We Use Information

We use information to:

• Provide, maintain, secure, and improve the Service.
• Authenticate users and administer organizations, workspaces, roles, and access.
• Provision shared or dedicated Orchestra infrastructure and execute workflows.
• Route AI inference and connected-service requests that you initiate.
• Process payments, trials, subscriptions, credits, and billing communications.
• Monitor reliability, investigate errors, enforce limits, and prevent abuse.
• Respond to support, privacy, and sales requests.
• Comply with legal obligations and enforce our agreements.

3. How We Protect Information

We use administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit, access controls, audit logging, tenant-scoped authorization, workload isolation, and encryption at rest where supported by the relevant storage and infrastructure provider. No system is completely secure, and we cannot guarantee absolute security.

4. Service Providers and Disclosures

We may disclose information to providers that help us operate the Service, including:

• Authentication: Privy and organization-configured identity providers.
• Payments: Stripe.
• Infrastructure and hosting: DigitalOcean and Vercel.
• AI inference: Arda Gateway and the model providers selected or authorized for your workspace.
• Connected services: third-party applications and APIs you choose to use in workflows.

Workflow data may be transmitted to these providers when necessary to perform an action you configure. Their handling of information is also governed by their own terms and privacy policies. We may also disclose information when required by law, to protect rights and safety, or as part of a merger, financing, acquisition, or sale of assets. We do not sell personal information.

5. Data Retention

We retain personal information for as long as needed to provide the Service, maintain security and audit records, comply with law, resolve disputes, and enforce agreements. Retention may vary by data type, plan, workspace configuration, and legal requirement. When an account or workspace is deleted, we delete or de-identify associated information within a reasonable period, subject to backups, fraud-prevention records, billing records, and other legally permitted retention.

6. Your Rights and Choices

Depending on your location, you may have the right to:

• Access, correct, or delete personal information.
• Receive a portable copy of certain information.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Appeal a decision concerning a privacy request.

To exercise a right, email support@ardabot.ai. We may need to verify your identity and authority before completing a request.

7. U.S. State Privacy Rights

Residents of certain U.S. states, including California, may have additional rights to know, access, correct, delete, or receive information about our use and disclosure of personal information. We do not sell personal information or share it for cross-context behavioral advertising.

8. International Data Transfers

The Service is operated from the United States. If you use it from another country, your information may be transferred to, stored in, and processed in the United States and other locations where our providers operate, subject to applicable safeguards.

9. Children’s Privacy

The Service is not intended for individuals under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided personal information, contact us so we can take appropriate action.

10. Cookies and Similar Technologies

We use cookies and similar technologies that are necessary for authentication, security, session continuity, preferences, and operation of the Service. We do not use third-party advertising cookies on the Orchestra sites as of the effective date of this Policy.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy with a revised effective date and provide additional notice when required by law. Continued use of the Service after an update means the revised policy applies to subsequent use.

12. Contact Us

If you have questions or requests concerning this Privacy Policy, contact: