Privacy Policy

This Privacy Policy applies to personal information processed by us, including on our website (getarbol.com), mobile applications, APIs, and other online or offline offerings. To make this Privacy Policy easier to read, our website, products, solutions, and other offerings are collectively called "Services."

Important Note About Customer Data

This Privacy Policy does not apply to any personal information that our customers may process using Arbol AI's products and services ("Customer Data"). Our customers' respective privacy policies govern the collection and use of Customer Data. Our processing of Customer Data is governed by the contracts we have in place with our customers, not this Privacy Policy.

If you are an end user of the Services through our customer (for example, if you receive a call from an AI Employee configured by one of our customers), please direct any questions or requests relating to Customer Data to our customer directly.

For clarity:

• Arbol AI is a Controller for the personal information we collect from customers in order to market, service, and provide access to and use of the Services.
• Arbol AI is a Processor for Customer Data that is entered into the Services. The customer is the Controller, and we will only process Customer Data as agreed to provide Services under our Terms of Service or other contract with a customer.

The categories of personal information we collect depend on how you interact with us, our Services, and the requirements of applicable law. We collect information that you provide to us, information we obtain automatically when you use our Services, and information from other sources such as third-party services and organizations.

2.1 Information You Provide to Us Directly

2.2 Information Collected Automatically

2.3 Cookies and Similar Technologies

We, as well as third parties that provide content or functionality on our Services, use cookies, pixel tags, local storage, and other technologies ("Technologies") to automatically collect information through your use of our Services.

• Essential Cookies: Required for login, security, and core functionality.
• Functional Cookies: Remember your preferences and settings.
• Analytics Cookies: Help us understand how you use our Services to improve them.

We use Google Analytics to analyze how users interact with our Services. To opt out, visit tools.google.com/dlpage/gaoptout . We use Sentry to track errors and performance issues, which may capture device information and user actions leading to errors.

You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent some features from functioning properly.

2.4 Information From Other Sources

We may obtain information about you from other sources, including:

• Third-party authentication providers when you sign in
• Integration partners when you connect third-party services
• Publicly available sources for business development purposes

We use your information for a variety of business purposes:

3.1 Providing Our Services

• Managing your account and providing access to the Services
• Operating AI Employees and processing voice communications
• Generating transcripts, summaries, and analytics
• Processing payments and managing subscriptions
• Providing customer support
• Enabling third-party integrations you authorize

3.2 Improving AI Employee Performance (Within Your Organization)

We use your organization's data to improve AI Employee performance within your organization only. This means:

• Your AI Employees learn from previous calls and interactions to improve future conversations
• Call history and interaction patterns personalize AI Employee responses for your business context
• This learning is isolated to your organization and benefits only your AI Employees
• We DO NOT use your data to train general AI models or improve services for other customers
• Your data is NEVER combined with data from other organizations

3.3 Administrative Purposes

• Detecting and preventing fraud, security incidents, and illegal activity
• Debugging and improving our Services
• Enforcing our Terms of Service and policies
• Complying with legal obligations
• Auditing and compliance activities

3.4 Marketing (With Your Consent)

• Sending information about our Services and features
• Providing content we believe may interest you

Note: We do NOT use Customer Data (call recordings, transcripts, contacts) for marketing. Marketing communications are based solely on your account information and preferences.

3.5 De-identified and Aggregated Information

We may create de-identified or aggregated information that cannot identify you. We may use such information for any lawful purpose, including analytics and service improvement.

We disclose your information to third parties only in the following circumstances. We do not sell your personal information.

4.1 Service Providers (Sub-Processors)

We share information with service providers who help us provide our Services. All service providers are contractually obligated to protect your information and can only use it as we instruct.

4.2 Third-Party Integrations

When you connect third-party services (such as Google Calendar or Microsoft Outlook), we share the minimum information necessary for the integration to function. Your use of those services is governed by their respective privacy policies.

4.3 Legal Requirements

We may disclose information when required by law, including:

• Valid subpoenas, court orders, or warrants
• Government or regulatory requests
• Law enforcement investigations

We will attempt to notify you of such requests unless legally prohibited or if notification would be futile or create a risk of harm.

4.4 Protection of Rights and Safety

We may disclose information when necessary to:

• Protect our rights, property, or safety
• Protect users or third parties
• Prevent fraud or illegal activity
• Enforce our Terms of Service

4.5 Business Transfers

If we are involved in a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or uses of your personal information.

4.6 With Your Consent

We may share your information for other purposes with your explicit consent.

5.1 Your Privacy Choices

• Email Communications: Use the unsubscribe link in any marketing email. You cannot opt out of service-related communications.
• Cookies: Adjust your browser settings or use our cookie preferences.
• Analytics Opt-Out: Google Analytics — tools.google.com/dlpage/gaoptout
• Do Not Track: We do not currently respond to DNT signals.

5.2 Your Privacy Rights

Depending on your location, you may have the following rights:

• Access: Confirm whether we process your data and obtain a copy.
• Correction: Correct inaccurate or incomplete data.
• Deletion: Request deletion of your personal information.
• Data Portability: Receive your data in a portable format (CSV, JSON).
• Opt-Out of Sale: We do not sell personal information.
• Non-Discrimination: We will not discriminate against you for exercising rights.

5.3 State-Specific Rights

Delaware Residents (DPDPA): If you are a Delaware resident, you have rights under the Delaware Personal Data Privacy Act (DPDPA), effective January 1, 2025: confirm processing and access your data; correct inaccuracies; delete your data; data portability; and opt out of sale (we don't sell), targeted advertising (we don't do this), and profiling with legal effects.

California Residents (CCPA/CPRA): Please see our Supplemental Notice for California Residents in Section 10.

Other U.S. States: If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or other states with privacy legislation, you may have similar rights. Contact us at privacy@getarbol.com to exercise your rights.

5.4 How to Exercise Your Rights

• Self-Service: Use options in your account dashboard.
• Email: privacy@getarbol.com
• Mail: Arbol Artificial Intelligence, Inc., Attn: Privacy, 131 Continental Dr, Suite 305, Newark, DE 19713

We will respond within 45 days. If we need additional time, we will notify you (up to 90 days total).

5.5 Verification

To protect your privacy, we may need to verify your identity before processing your request.

5.6 Appeals

If we decline your request, you may appeal by contacting privacy@getarbol.com . We will respond to appeals within 60 days. If denied, you may contact your state's Attorney General.

We implement appropriate technical, administrative, and physical safeguards to protect your information:

• Technical: Encryption (TLS 1.2+, AES-256), secure password hashing, MFA, intrusion detection.
• Administrative: Access controls, employee training, background checks, security policies.
• Physical: SOC 2 certified data centers, access controls, environmental protections.

No system is 100% secure. While we implement strong protections, we cannot guarantee absolute security. You are responsible for keeping your account credentials secure.

For more information, see our Security Overview .

We retain personal information for as long as necessary to fulfill the purposes for which it was collected:

Your Control: You can delete call recordings, transcripts, and contacts anytime through your dashboard. Deleted data is removed from active systems within 30 days and backups within 90 days.

Account Closure: When you close your account, we delete or anonymize your data within 90 days, except data we must retain for legal compliance.

Our Services are not intended for anyone under the age of 18. We do not knowingly collect personal information from children under 18.

If we learn we have collected information from a child under 18, we will delete it promptly. If you believe a child has provided us information, contact us immediately at privacy@getarbol.com .

Our Services may contain links to third-party websites or applications. This Privacy Policy does not apply to them. We encourage you to review their privacy policies.

We are not responsible for the privacy practices or content of third-party websites or applications.

10.1 Supplemental Notice for California Residents

This section applies to California residents and supplements our Privacy Policy pursuant to the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

Categories of Personal Information Collected

In the past 12 months, we have collected the following categories of personal information:

Sources of Personal Information

• You directly
• Automatically through your use of our Services
• Third-party services you authorize

Sale and Sharing

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

Your California Rights

• Right to Know: Request disclosure of personal information collected, used, and disclosed.
• Right to Delete: Request deletion of personal information.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out: We do not sell or share personal information.
• Right to Limit: Limit use of sensitive personal information.
• Right to Non-Discrimination: We will not discriminate for exercising your rights.

Shine the Light

Under California Civil Code Sections 1798.83-1798.84, California residents may request disclosure of personal information shared with third parties for direct marketing. We do not share personal information for third-party direct marketing.

How to Exercise Your California Rights

Email privacy@getarbol.com with subject line "California Privacy Request."

10.2 Notice for Nevada Residents

If you are a Nevada resident, you have the right to opt out of the sale of certain personal information. We do not sell personal information. To exercise this right or ask questions, contact us at privacy@getarbol.com with the subject line "Nevada Do Not Sell Request."

We may update this Privacy Policy from time to time. When we make material changes:

• We will update the "Last Updated" date
• We will notify you via email or through our Services at least 30 days before changes take effect
• Your continued use of our Services after changes take effect means you accept the updated Privacy Policy

If you do not agree with changes, you should stop using our Services and close your account.

If you have questions, concerns, or complaints about this Privacy Policy or our privacy practices, reach us at privacy@getarbol.com . We will respond within 30 days.

Delaware residents with unresolved complaints may contact the Delaware Department of Justice at privacy@delaware.gov .