Privacy Policy

Effective October 23, 2026

This policy explains what information Arcaro Labs LLC ("Operate As", "we", "us") collects, why, who we share it with, how long we keep it, and the choices you have. It covers our website, dashboard, API, MCP server and client pages (together, the "Service").

The short version: we collect what we need to connect your clients' tools and run your calls, we encrypt the secrets, we don't keep the data your calls carry, and we never sell anything or use it to train AI models.

Two roles

For agencies and their teams, we decide how your account information is used, so we're responsible for it (the "controller").

For an agency's clients, the agency decides what access to request and how to use it, and we handle the client's information on the agency's behalf (a "processor" or "service provider"). If you're a client, your agency's own privacy notice also applies, and they're the first place to go with questions about how they use your data. We'll help them answer.

What we collect

From agencies and team members

• Account details: your name, email address and a hash of your password (never the password itself). If you sign in with Google, we receive your name, email address and Google account ID. If your organization uses single sign-on, we receive the details your identity provider sends, usually your name and email.
• Security settings: your two-factor secret, stored encrypted, and recovery codes, stored as hashes.
• Organization details: its name, members, roles, invitations, and the branding you add for clients, such as a logo, a message and the sites allowed to embed your client page.
• Billing details: your plan, billing contact and subscription status. Card details go straight to Stripe, our payment processor; we never see or store your full card number.
• Keys and settings: the names, limits and allowed addresses of your API keys, stored with only a one-way hash of each key. Webhook addresses and the secrets that sign them.
• Activity: a log of actions in your organization, such as who invited a client or revoked a key, with the time and, for sign-ins and security events, the IP address and browser.
• Messages: what you send us through the contact form or by email.

From clients

• What the agency enters: your name or business name, an optional email address for alerts, and the services they asked you to connect.
• Your passkey: when you save one, we keep its public key and an ID for it. Your fingerprint, face or device PIN never leaves your device, and we never receive it.
• Your connections: for each service you connect, the access it hands back (an access token, and usually a token to renew it) or the key you paste, stored encrypted. Also the permissions you approved, any account details calls need (such as an account or workspace ID), and when and by which agency key it was last used.
• What we never receive: your password for a connected service. You type it only on that service's own sign-in screen.

From calls

When an agency's agent, workflow or code makes a call, the data it carries, such as a spreadsheet's rows or a message's text, passes through our servers to the connected service and back. We don't store it. We do keep a record of each call: the key that made it, the client, the service and action, the method and path (without the query string, which can hold secrets), the response status and how long it took.

From our website

Our marketing site doesn't use advertising or analytics trackers. Like most websites, our servers record basic request information, such as IP address, browser and pages requested, to run and secure the site. We may collect performance traces to find and fix errors; these describe requests, not their content.

Cookies

We use only the cookies the Service needs: a session cookie that keeps you signed in, and cookies that protect against cross-site attacks. Your browser may also store small preferences, such as light or dark mode. We don't use advertising cookies, and we don't track you across other sites.

How we use it

• To provide the Service: creating accounts, connecting clients' services, renewing connections, running and checking calls, and showing your dashboard.
• To keep it secure: verifying sign-ins and passkeys, enforcing rate limits and key restrictions, detecting misuse, and alerting you to unusual activity.
• To communicate: account and security emails, client link and reconnect emails, alerts when a connection or key needs attention, trial and usage notices, and replies to your messages.
• To bill you and keep the records the law requires.
• To meet legal obligations and enforce our terms of service.

Where privacy laws ask for a legal basis, we rely on performing our contract with you, our legitimate interest in running a secure and reliable service, your consent where we ask for it, and legal obligations.

We don't sell or rent personal information, we don't use it for advertising, and we don't use your data or your clients' data to train AI models.

Data from Google and other connected services

Operate As's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

For Google and every other connected service, we use the access a client grants only to make the calls their agency directs through the Service, within the permissions the client approved. We don't use it for advertising, we don't sell it, and our staff don't read the data those calls carry, except with permission, for security, or where the law requires.

Who we share it with

• The agency. A client's agency sees the client's details, which services are connected, what permissions were approved, and the record of calls made with them. Agencies never see a client's tokens.
• Connected services. When an agency makes a call, we send it, with the client's access, to the service it's meant for.
• Service providers that help us run the Service, under contracts that limit their use of the data to the work they do for us:
  • Google Cloud, for hosting, our database, file storage and secrets management
  • Stripe, for payments
  • Our email delivery provider, for sending email
  • Google, if you choose to sign in with Google
  • Our monitoring provider, for error and performance traces
• When the law requires it, or to protect the rights, safety and security of our users, the public or us. We'll push back on requests that are too broad, and tell the people affected where we're allowed to.
• In a business change, such as a merger or sale, where the new owner keeps the protections in this policy.

How long we keep it

• Connections: until the client removes them, the agency removes the client, or the organization is deleted. Then we cancel the access with the service where it allows, and delete our copy.
• Accounts: until you delete your account or your organization is deleted.
• Sessions: up to 30 days, or until you sign out.
• Call records: for as long as your plan's call history covers, from 7 days to a year.
• Notifications: 90 days.
• Activity log: 2 years, including after the organization it belongs to is deleted, so security incidents and disputes can still be looked into. Failed sign-ins and password reset requests, which record email and IP addresses, are kept for 30 days.
• Billing records: as long as tax and accounting law requires.

Deleted data may remain in encrypted backups for a limited time until they're replaced.

How we protect it

Connection tokens and keys are encrypted, and the encryption keys are kept in a secrets manager, apart from the database. API keys, sessions and recovery codes are stored only as hashes. Agents receive short-lived keys that can be locked to your servers, never a client's token. Traffic is encrypted in transit. Our security page explains this in detail.

No system is perfectly secure. If a breach affects your information, we'll tell you without undue delay, as the law requires.

Your choices and rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict how we use it, and to withdraw consent. You also have the right not to be treated differently for using these rights.

• Agencies and members can update most details in the dashboard, download a copy of their account's data from their account page, delete their account, or delete their organization. For anything else, email us.
• Clients can see and remove any connection from their page at any time. To have your details removed entirely, ask your agency, or email us and we'll work with them.

We'll respond within the time the law requires, and may need to confirm your identity first. If you're in the EU, UK or another region with a data protection authority, you can also complain to it.

California residents

This section is for California residents, under the California Consumer Privacy Act as amended (CCPA). In the last 12 months we have collected these categories of personal information, from you, your organization, your clients and the services they connect, for the purposes in "How we use it":

• Identifiers: name, email address, IP address, account and device identifiers.
• Customer records and commercial information: billing contact, plan and subscription history. Card details are collected by Stripe.
• Internet activity: sign-ins, actions in the dashboard and the record of API calls.
• Professional information: your organization and your role in it.
• Sensitive personal information: account sign-in credentials, used only to sign you in and keep your account secure.

We disclose these categories for business purposes only to the service providers and parties listed in "Who we share it with". We don't sell or share personal information for cross-context behavioral advertising, and haven't in the last 12 months. We don't use sensitive personal information for anything beyond what the CCPA allows, so the right to limit its use doesn't apply. We keep each category for the periods in "How long we keep it".

You may ask us to tell you what we collect, use and disclose about you; to delete it; and to correct it. You won't be treated differently for asking. To make a request, email us from the address on your account, or have an authorized agent email us with your written permission. We'll confirm your identity by matching the request to your account, and answer within 45 days. If you're a client, much of your information belongs to your agency, and we'll pass your request to them.

Health and other sensitive data

The Service isn't built to hold protected health information under HIPAA unless we've signed a business associate agreement with you. Until then, please don't connect services that hold patient records.

International transfers

We're based in the United States, and we and our service providers process information there and may process it in other countries. Where the law requires, we protect those transfers with safeguards such as the European Commission's Standard Contractual Clauses.

Children

The Service is for businesses. It isn't directed to children, and we don't knowingly collect information from anyone under 16. If you think a child has given us information, contact us and we'll delete it.

Changes to this policy

If we change this policy in a way that matters, we'll tell agencies by email or in the dashboard before it takes effect, and update the date at the top.

Contact

Questions, requests or concerns about privacy:

Arcaro Labs LLC
hello@operate.as