1. Who we are
Arbitr is run by Arbitr BV (“Arbitr”, “we”, “us”), Fortsebaan 56, 2930 Brasschaat, Belgium, enterprise number 1044.828.768, RPR Antwerpen, afdeling Antwerpen. For anything about your personal data, email team@arbitrhq.ai.
2. Our two roles
- We're in charge (controller) when you visit arbitrhq.ai, talk or write to us, sign up, or use Arbitr for the company you work for. Section 3 lists what we collect then, and why.
- A company is in charge, and we handle it for them (processor), when you chat with an assistant on that company's website, or write to that company and our support agent answers. Section 4 explains how that works. The company's own privacy notice applies too.
3. What we collect when we're in charge
- Visiting arbitrhq.ai. Which pages you view and what you click, the page you came from, and your browser and device type: without your IP address, without cookies, and with nothing stored on your device, through PostHog in the EU. We use it to see how the site is used and to improve it (our legitimate interest). If your browser sends Do Not Track, we collect none of it. Kept for up to 12 months.
- Asking us a question, or writing to us. What you ask or write, and your email address if you give it. We use it to answer you (our legitimate interest, or steps you asked for before a contract). Our own chat on this site is answered by AI, through the providers in section 6. Kept for 2 years after our last contact.
- Asking for the free assistant or a demo. Your work email, your company, and what you tell us about it, to get you started (steps you asked for before a contract). Kept for 2 years after our last contact if you don't become a customer.
- Updates from our blog. Your email address, only if you sign up (your consent). Kept until you unsubscribe, which you can do at any time.
- Your Arbitr account. The names, work email addresses and roles of the people at a customer who use Arbitr, and their logins and activity in it. We use it to provide the Services and keep them secure (our contract with your employer, and our legitimate interest). Kept while the account is open and for 30 days after; security logs for up to 12 months.
- Billing. Your company's name, address and VAT number, its contact person, and invoices and payments (our legal obligations). Kept as long as Belgian accounting and tax law requires, currently up to 10 years.
- Business contacts. The name, work email, phone number, company and role of people we talk to about Arbitr, and our conversations with them (our legitimate interest). Kept for 2 years after our last contact. Ask us to stop, and we do.
4. Conversations on our customers' websites and in their inboxes
When you chat with an assistant on a company's website, or write to a company that uses our support agent, that company decides what happens with your conversation, and we process it on its behalf, under a data processing agreement. To see, correct or delete your conversation, contact that company. If you contact us, we pass your request on.
- The answer. Your message and the company's own sources, such as its website, documents and systems, go to an AI model, which writes the answer.
- The conversation. It's stored, so the company's team can read it, take over, and see insights on what customers ask. It's deleted 24 months after it ends at the latest, or earlier if the company asks.
- A person. When the assistant can't help, or the question is beyond what the company lets it settle, it passes your question to the company's team with a short summary. You can always ask for a person.
- An AI, and it says so. The assistant tells you it's an AI. Where a company lets it settle something itself, such as a small claim, that's the company's decision, and a person can look at it if you ask.
5. Counts and de-identified conversations
Two things we do with conversations on our own account:
- Counts. We count conversations, questions and answers across our customers, and may publish the totals, like the counter on our homepage. These are numbers only, and they identify no one.
- Improving Arbitr, on the free website assistant only. We may use conversations to improve Arbitr, for example to find questions it answers badly and to test changes. First, we remove names, email addresses, phone numbers, addresses and other details that identify a person, and we never try to identify anyone again. We do this out of our legitimate interest in a better Arbitr, and the company using the free assistant has agreed to it. You can object: email us the website and roughly when you chatted, and we leave your conversation out. De-identified conversations are kept for up to 24 months.
Conversations from companies on our paid support agent are used for that company only.
6. Who we share it with
We don't sell personal data. We share it only with the providers who help us run Arbitr, bound by contract to use it only for us and to protect it. They may not use it to train their AI models.
| Provider | Where | What for |
|---|---|---|
| Anthropic | United States | Its Claude models write answers, summaries and insights (by default) |
| TypeSafe | United States | Sorts incoming questions into topics (by default) |
| Mistral AI | France (EU) | Its models do all of the above instead, when a company switches on EU-only models |
| PostHog | EU | Statistics on how arbitrhq.ai is used (our own website only) |
| Calendly | United States | Booking a demo with us |
We tell our customers at least 30 days before we add or replace a provider that handles their data. We may also disclose personal data when the law requires it, to protect our rights or someone's safety, or to a buyer if Arbitr is sold, under this policy.
7. Outside the EU
Where a provider handles personal data outside the European Economic Area, as Anthropic, TypeSafe and Calendly do in the United States, we use the safeguards the GDPR requires, such as the European Commission's Standard Contractual Clauses. With EU-only models switched on, the AI models run in the EU.
8. Security
We protect personal data with appropriate technical and organisational measures, including encryption in transit, access only for the people who need it, and each customer's data kept apart. Everyone at Arbitr is bound to confidentiality. If a breach puts your data at risk, we tell the authority, the companies concerned and, where needed, you, as the GDPR requires.
9. Your rights
You have the right to see the personal data we have about you, to correct it, to have it deleted, to restrict or object to how we use it, and to get a copy to take elsewhere. Where we rely on your consent, you can withdraw it at any time. Email team@arbitrhq.ai; we answer within a month, and may first ask you to confirm who you are.
If you think we handle your data wrongly, please tell us. You can also complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, dataprotectionauthority.be, or to the authority where you live.
10. Cookies and storage
- arbitrhq.ai sets no cookies, and our statistics store nothing on your device.
- The chat, on our site and on our customers' sites, keeps the open conversation in your browser tab's session storage, so it stays when you move to another page. It's cleared when you close the tab. The chat can't work without it, so it needs no consent.
11. Children
Arbitr is a service for businesses, and our website isn't aimed at children.
12. Changes to this policy
We may update this policy. The date at the top shows when it last changed; for a change that matters, we tell our customers by email first.
13. Contact
Questions or requests about your personal data? Email team@arbitrhq.ai.