Privacy policy

Who this covers

Customers of Arlo — the businesses and their team members who sign in at arlo.autobricks.ai. Their contacts — the people who message those businesses through a channel the business has connected. For contacts, the business is responsible for its own customer relationship, and we process their messages on its behalf.

What we collect

• Account data — name, email address and password, used to sign you in. Passwords are held by our authentication provider and never stored in plain text.
• Workspace content — documents you upload, web pages you ask Arlo to read, and the knowledge base, chatbot settings, products, calendars and bookings built from them.
• Conversations — messages and attachments that arrive through connected channels (web chat, Gmail, Outlook, Telegram, WhatsApp, Facebook Messenger, Instagram, TikTok), Arlo's replies, and the sender details the channel provides, such as a name, email address, phone number or profile id.
• Contact records — what your team or Arlo notes about a contact, such as their stage in a sales pipeline, reminders and important dates.
• Channel credentials — access and refresh tokens for the accounts you connect. They are stored encrypted.
• Waitlist and technical data — the email and answers you give on the waitlist, and standard server logs (IP address, browser, time) used for security and rate limiting.

How we use it

• To run the product you asked for: answer, qualify and follow up with your contacts, and show your team the conversation.
• To build your workspace's knowledge base, and to suggest answers learned from your team's own replies — for your workspace only, and only after a person on your team approves each one.
• To keep the service secure, prevent abuse, and fix problems.

We do not sell personal data, use it for advertising, or use it to train generalised AI models. Each workspace's data is separated from every other workspace's at the database level.

Who we share it with

Only the providers needed to run Arlo, and only what each one needs:

• AI model providers — to draft a reply, the relevant message and excerpts of your knowledge base are sent to the model provider configured for your workspace: OpenRouter by default, or the AutoBricks AI API if you choose it. Text is also sent to an embeddings provider to make it searchable.
• Infrastructure — our database and authentication provider (Supabase), our servers, and Cloudflare for network protection and bot checks.
• The channels you connect — Google, Microsoft, Meta, Telegram, TikTok and WhatsApp (directly, or through our WhatsApp Business provider Kapso) receive the replies Arlo sends through them.
• Web search — if you give a chatbot the web-search tool, its search queries are sent to Brave Search.

We may also disclose data where the law requires it.

Google user data (Gmail)

When you connect a Gmail inbox, Arlo requests exactly two scopes:

• gmail.readonly — to read messages in the inbox received on or after a start date you choose (sender, recipients, subject, body and attachments), and the connected mailbox's own address.
• gmail.send — to send Arlo's and your team's replies from that inbox.

Arlo does not change, label, archive or delete anything in your Gmail account. Messages it reads are stored in your workspace so your team can see and answer them, and the relevant text is sent to your workspace's AI model provider to draft a reply.

Arlo AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is used only to provide and improve the user-facing features of Arlo described above.
• It is not transferred to others except as needed to provide those features, for security, to comply with law, or as part of a merger or acquisition with notice to you.
• It is not used for advertising, is not sold, and is not used to develop, improve or train generalised or non-personalised AI or machine-learning models.
• No person at AutoBricks AI reads it unless you ask us to for a specific message, it is needed for security or to comply with law, or it has been aggregated and anonymised.

Outlook works the same way through Microsoft Graph, with Mail.Read, Mail.Send, User.Read and offline_access.

Meta (Facebook, Instagram, WhatsApp)

When you connect a Facebook Page, an Instagram professional account or a WhatsApp Business number, Arlo receives the messages sent to it and sends replies through Meta's APIs. It uses this only to answer those conversations. Meta can also send us a data-deletion request through its callback; we delete what we hold under the account id Meta gives us. To have a Page's or a customer's conversations deleted, disconnect the channel or email us (see data deletion).

How long we keep it

• Account and workspace data: while your account is active.
• Conversations from a channel: while that channel is connected. Disconnecting a channel deletes its stored token and the conversations, messages and attachments that arrived through it. Contact records and answers your team already approved stay until you delete them.
• Server logs: kept for a limited period for security, then deleted.

Your choices and rights

• Disconnect any channel from Arlo's settings at any time. For Google you can also revoke access at myaccount.google.com/permissions.
• Ask us to access, correct, export or delete your data — see data deletion.
• If you are a contact of a business that uses Arlo, you can ask that business, or write to us and we will pass it on and help.

Security

Data is encrypted in transit, channel tokens are encrypted at rest, and access inside the product is limited to members of your workspace. No system is perfectly secure; if we learn of a breach affecting your data we will tell you.

Changes

If this policy changes in a way that matters, we will update the date above and tell account holders by email.

Contact

AutoBricks AI · [email protected]