Legal

Privacy Policy

Last updated: July 15, 2026 · Effective immediately.

ARFactor AI, Inc. ("ARFactor AI", "we", "us", or "our") is committed to protecting the privacy of our customers and their end users. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website, sign up for our service, or use the ARFactor AI autonomous treasury platform (collectively, the "Service").

1. Information We Collect

1.1 Information you provide

Account information: name, work email, company name, role, and password (stored as a bcrypt hash) when you create an account or contact our sales team. Payment information is handled directly by our PCI-DSS compliant payment processor; we never see your card number.

1.2 Financial data you choose to connect

When you connect an ERP (e.g., QuickBooks, NetSuite, Xero, SAP) or a bank via Plaid, we receive the minimum data necessary to operate the Service: open invoices, vendor master records, payment terms, and transaction history. You can revoke any connection at any time from the Connections screen, and we will delete the corresponding data within 30 days.

1.3 Automatically collected information

Standard web logs (IP address, user agent, pages visited, referrer), performance telemetry, and cookies essential to operating the Service. We do not sell or share this data with advertising networks.

2. How We Use Your Information

  • To provide, operate, and improve the ARFactor AI Service.
  • To power our autonomous agents (Extractor, Analyst, Negotiator, Executor).
  • To train and fine-tune models only on data for which you have provided explicit opt-in consent. By default, your data is never used to train shared models.
  • To send you transactional emails (invoices, security alerts, agent decisions that require your approval).
  • To respond to support requests and comply with legal obligations.

3. AI, Open-Source Models, and Your Data

ARFactor AI runs on premium open-source LLMs (Mixtral, Llama 3, Qwen, etc.) deployed on our infrastructure. Your financial data is processed by these models in real-time, in our tenant-isolated environment, and is never transmitted to third-party model providers for inference. Model outputs (e.g., vendor negotiation emails) are generated on your behalf and stored in your tenant only.

4. Data Sharing

We do not sell your personal information. We share data only with:

  • Service providers acting on our behalf under written agreements (e.g., Vercel for hosting, Supabase for database, Plaid for bank connectivity).
  • Your authorized integrations when you explicitly connect an ERP, bank, or factor.
  • Legal authorities when required by valid legal process.
  • Successor entities in the event of a merger, acquisition, or sale of assets, with notice to you.

5. Data Security

We protect your data with AES-256 encryption at rest, TLS 1.3 in transit, role-based access control (RBAC), SSO/SAML on Enterprise tiers, immutable audit logs, and continuous vulnerability scanning. Our SOC 2 Type II report is available under NDA on request.

6. Data Retention

We retain your account data for as long as your account is active. When you delete your account, we erase your tenant data within 30 days, except where retention is required for legal, tax, or audit purposes (typically 7 years for financial records).

7. Your Rights (GDPR · CCPA · UK GDPR)

Depending on your jurisdiction, you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate or incomplete data.
  • Request deletion of your data.
  • Object to or restrict processing.
  • Data portability in a machine-readable format.
  • Withdraw consent at any time without affecting prior lawful processing.
  • Lodge a complaint with your data protection authority.

To exercise any of these rights, email privacy@arfactor.ai. We respond within 30 days.

8. International Data Transfers

By default, your data is stored in the United States (us-east-1). Enterprise customers may select EU or APAC residency. For transfers from the EEA, UK, or Switzerland to the US, we rely on Standard Contractual Clauses (SCCs) and supplementary technical safeguards.

9. Children's Privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email and a prominent in-product banner at least 30 days before they take effect.

11. Contact

ARFactor AI, Inc.
548 Market Street, Suite 32000
San Francisco, CA 94104
Email: privacy@arfactor.ai

Read our Terms of Service →