Get started

Privacy Policy

This privacy policy applies to the Arc0 platform, website and related services (together, the "Service"), operated by Exa Labs LLC ("Exa Labs", "we" or "us"). Arc0 lets AI agents act in third-party apps on behalf of the people who connect those apps, with the permissions they approve.

Whose information this covers

Arc0 handles two kinds of personal information, and our role differs for each:

  • Customer information: information about you, our customer, and the people on your team who use the Service. We are the controller of this information.
  • End-user connection data: information about the people who connect their apps through a product built on Arc0, the credentials for those connections, and the data that passes through them when an agent acts. We process this on our customer's behalf and under their instructions. If you use Arc0 for yourself on the Personal plan, you are both the customer and the end user.

Information we collect

  • Account information: your name, email address, organization, team members and roles, and billing details.
  • Connection data: OAuth tokens, API keys and other credentials for connected apps, stored encrypted with per-tenant keys; and connection metadata, such as which app was connected, the scopes granted, and when.
  • Audit entries: a record of each action an agent takes through Arc0: which agent acted, for which user, in which app, with which scope, and the policy decision.
  • Request and response content: the content of calls passes through Arc0 so they can be executed, but is not stored by default. If you turn on retention for debugging, it is kept for the period you choose.
  • Contact submissions: the details you send through our contact form.
  • Technical data: IP address, browser and device information, and diagnostic data needed to run and secure the Service.

How we use information

We use information to provide, secure and support the Service: to authenticate you, execute the actions your agents request within the permissions granted, enforce your policies, keep the audit log, bill you, respond to your requests, and detect and prevent abuse. We do not sell personal information, and we do not use customer or end-user data to train AI models.

Google user data

Arc0's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Analytics and the website

We use Plausible for website analytics, which collects aggregate usage data without cookies and without tracking individuals across sites. The website also loads Google Tag Manager, which manages third-party tags; depending on the tags configured, those may set cookies and share data with Google. Our contact form is processed by Formspark.

On app.arc0.ai, we use PostHog US cloud for product analytics through our first-party proxy, p.arc0.ai. Signed-in analytics use only our internal user ID and an organization group keyed by our internal organization ID, without your name or email address. Page URLs are reduced to fixed screen categories, excluding IDs, queries and fragments. The browser also sends sanitized error reports to PostHog, omitting raw error messages and action content.

Masked session replay is limited to authenticated Apps and Overview dashboard screens without URL queries or fragments. All text and input values are masked, and forms, dialogs and content such as code and images are blocked from recordings. Masked replays retain page layout and interaction positions. Hosted Connect pages do not load PostHog analytics or session replay.

We also send backend product milestone events to PostHog, such as account creation, connection activation and completed executions. These contain internal user or organization identifiers and fixed event categories, without names, email addresses, credentials or the content of agent actions. On arc0.ai, PostHog collects cookieless pageviews on supported marketing pages, without identifying visitors or recording their sessions. Analytics and error-reporting tools never receive connection credentials or the content of agent actions.

Sharing

We share information only as needed to run the Service: with the third-party apps you or your users connect (to perform the actions requested), cloud hosting and infrastructure providers, email and support tools, analytics and error-reporting providers, and payment processors. We may also disclose information where required by law, or to protect the rights and safety of our users, the public or Exa Labs.

End users of products built on Arc0

If you connected an app through a product that uses Arc0, that product decides how your connection is used, and its privacy policy applies to it. You can revoke a connection from that product or from the connected app's own security settings at any time. Our customers are responsible for having a lawful basis to process their users' information and for giving any notices it requires.

Retention

  • Credentials are kept until the connection is revoked or the account is deleted, and are then deleted.
  • Audit entries are kept for the period of your plan, currently 7 days on Personal, 30 days on Build and 90 days on Launch, or as agreed for Scale.
  • Request and response content is not stored unless you turn on retention.
  • Account information is kept while you use the Service and for a reasonable time afterwards to meet legal, tax and accounting obligations.

Your choices and rights

You can export your connections' tokens, revoke connections, and ask us to access, correct or delete your information by emailing contact@arc0.ai from your registered address. Depending on where you live, you may have further rights under local law; we will honour them as required. End users of a product built on Arc0 should contact that product first; we will help our customer respond.

Security

We protect information with per-tenant encryption, server-side execution that keeps credentials out of AI models, access controls and audit logging. See Security for how the Service is designed and what is still planned. Report vulnerabilities to security@arc0.ai.

International transfers

Exa Labs LLC is based in the United States. Information may be processed in the United States and in other countries where our service providers operate, with safeguards appropriate to the transfer.

Children

The Service is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has provided us with personal information, contact us and we will delete it.

Changes

We may update this policy as the Service changes. We will post the new version on this page and update the effective date, and for material changes we will notify customers by email.

This privacy policy is effective as of 2026-10-17.

Contact us

Questions about this policy or our privacy practices: email contact@arc0.ai.