Privacy Policy

1. Introduction

ArrowSmart Inc. ("ArrowSmart", "we", "us", or "our") is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our products, services, and websites.

Privacy is not a feature at ArrowSmart — it is a foundational principle. We design our products from the ground up to minimise the data we collect and to process sensitive information on your device rather than on our servers.

2. Information We Collect

We collect information you provide directly to us, information collected automatically, and information from third parties:

• Account information: name, email address, and password when you create an ArrowSmart account.
• Purchase data: billing address, payment method (processed by PCI-compliant third parties — we do not store card numbers), and order history.
• Device diagnostics: anonymised, aggregated crash reports and performance metrics to improve ArrowOS. These are opt-in only.
• Website activity: first-party cookies store only the current UTC day and hour markers to estimate browsers, arrivals, browsers using internal links, and owner-dashboard opens. We store aggregate daily visitor counts, hourly arrival counts, page opens by page, the first page visited in each browser-hour, internal link-click totals, source domains from available referrers, and successful non-owner Employee Portal sign-in totals. The owner dashboard is counted at most once per browser per UTC day. Referrers are reduced to their domain; full referring URLs, visitor IDs, IP addresses, account names, and passwords are not stored in this analytics. Missing or unavailable referrers are grouped as direct/unavailable. Aggregate counts are kept in a public GitHub repository and are publicly visible. Each analytics update purges counts older than 90 days; if there are no new events, older totals remain in the repository until the next update.
• Support communications: messages and attachments you send our support teams.

3. What We Do Not Do

• We do not sell your personal data to third parties. Ever.
• We do not build advertising profiles based on your behaviour.
• We do not allow third-party apps to access your data without your explicit permission.
• Health and financial data on your device is processed locally and is not accessible to ArrowSmart.

4. How We Use Your Information

We use the information we collect to provide, maintain, and improve our products and services; to understand aggregate website traffic, internal navigation, and referring domains; to count successful non-owner Employee Portal sign-ins without recording account identities in the analytics; to process transactions; to send administrative and product update communications; to respond to your comments and questions; and to comply with legal obligations.

5. Data Sharing

We may share your information with service providers who perform services on our behalf (e.g. payment processing, logistics), with law enforcement when required by law, and with your consent. We require all third-party service providers to maintain confidentiality and use your data only as directed by us.

6. Data Retention

We retain personal data only as long as necessary to fulfil the purposes described in this policy or as required by law. Account data is deleted within 30 days of account closure. Diagnostic data is anonymised within 90 days of collection. Aggregate website activity counts are retained for up to 90 days; we do not retain a persistent browser identifier.

7. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, or delete your personal data; to object to or restrict processing; and to data portability. To exercise any of these rights, contact us at privacy@arrowsmart.com.

8. Security

We implement industry-standard technical and organisational measures to protect your data. All data in transit is encrypted using TLS 1.3. Sensitive data at rest is encrypted using AES-256. We conduct regular security audits and penetration tests.

9. Children's Privacy

Our services are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child, please contact us immediately.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by posting a notice on our website or sending an email. Your continued use of our services after changes become effective constitutes your acceptance of the updated policy.

11. Contact Us

For privacy questions or to exercise your data rights, contact our Data Protection Officer at privacy@arrowsmart.com or write to:
ArrowSmart Inc., Privacy Team, 1 Arrow Way, San Mateo, CA 94402, USA.