Privacy Policy

1. Overview

Arlo is a private AI productivity and operations platform. This Privacy Policy explains what information we collect when you use Arlo, how we use it, how we store it, and the choices you have. It applies to the Arlo web application and its integrations with third-party platforms, including Facebook and Instagram (Meta Platforms, Inc.).

By connecting an account or using the service, you agree to the practices described in this policy.

2. Information We Collect

Account information: your name, email address, and login credentials used to access Arlo.

Connected platform data: when you connect a third-party platform (such as Facebook, Instagram, Google, Microsoft, or YouTube), we receive OAuth access tokens and basic profile information (name, username, profile picture) as permitted by the scopes you approve. For Meta platforms this may include the list of Facebook Pages you manage and the Instagram business accounts linked to those Pages.

Content you create: posts, documents, messages, tasks, schedules, media (images and videos), and other content you create or upload within Arlo.

Usage data: logs of actions performed in the app (e.g., publishing events, agent activity) used for diagnostics, security, and product improvement.

3. How We Use Your Information

To provide the core service: authenticating you, storing your content, and operating the features you use.

To act on your behalf at your explicit request: for example, publishing or scheduling posts to the Facebook Pages and Instagram accounts you select. We only publish content you create or approve, to the specific accounts you choose.

To power AI features: prompts and relevant context may be sent to the AI model provider you have selected (e.g., Google Gemini, OpenAI, Anthropic, Groq) solely to generate the response you requested.

To maintain security, debug issues, and monitor system health.

4. Meta (Facebook and Instagram) Data

We request only the permissions needed for the features you use, such as reading your Pages and linked Instagram business accounts, and publishing content you have created or scheduled.

Meta platform data is used solely to provide these user-facing features. We do not sell Meta user data, use it for advertising, or share it with data brokers.

Access tokens are stored encrypted (AES-256-GCM) and are never exposed to the browser or to other users.

You can disconnect Facebook or Instagram at any time from Arlo's platform settings, which deletes the stored tokens. You can also revoke access from your Facebook settings under Settings & Privacy > Settings > Apps and Websites.

5. Data Storage and Security

Your data is stored in MongoDB Atlas. Access tokens and other credentials are encrypted at rest using AES-256-GCM. Traffic between your browser and our servers is encrypted with HTTPS.

Media generated or uploaded for publishing is stored in our database and served over HTTPS so that platforms such as Facebook and Instagram can retrieve it when publishing content you have approved.

No system is perfectly secure, but we apply industry-standard measures to protect your information.

6. Data Sharing

We do not sell your personal data. Data is shared only with: (a) the third-party platforms you explicitly connect, and only for the actions you request; (b) the AI provider you select, limited to the content of your requests; and (c) infrastructure providers (hosting and database) that process data on our behalf under appropriate safeguards.

7. Data Retention and Deletion

We retain your data for as long as your account is active or as needed to provide the service.

You may delete content (posts, documents, media) at any time within the app. Disconnecting a platform deletes its stored tokens.

To request deletion of all data associated with your account, including any data obtained from Meta platforms, contact us at the email address below from your account email and we will delete it within 30 days. Alternatively, revoking Arlo's access in your Facebook settings and contacting us will trigger the same deletion process.

8. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Contact us to exercise any of these rights.

9. Changes to This Policy

We may update this policy from time to time. The 'last updated' date at the top reflects the latest revision. Continued use of Arlo after changes take effect constitutes acceptance of the updated policy.

10. Contact

Questions about this policy or your data? Contact us at privacy@your-domain.com.