Privacy Policy

Effective November 5, 2026

This policy explains what information Arcaro Labs LLC ("gyve", "we", "us") collects, why, who we share it with, how long we keep it, and the choices you have. It covers our website, catalog, dashboard, API and MCP server (together, the "Service"), and what the gyve command-line tool sends us.

The short version: we keep your projects and what your agents record, the keys your services use stay on your own computer, and we never sell anything or use your data to train AI models.

What we collect

Account and organization

• Account details: your name, email address and a hash of your password (never the password itself). If you sign in with Google, we receive your name, email address and Google account ID. If your organization uses single sign-on, we receive the details your identity provider sends, usually your name and email.
• Security settings: your two-factor secret, stored encrypted, and recovery codes, stored as hashes.
• Organization details: its name, members, roles and invitations.
• Billing details: your plan, billing contact and subscription status. Card details go straight to Stripe, our payment processor; we never see or store your full card number.
• Activity: a log of actions in your organization, such as who made a project or a key, with the time and, for sign-ins and security events, the IP address and browser.
• Messages: what you send us through the contact form or by email.

Projects and agents

• Projects: each project's name, its path and kits, which steps are done, by whom, when, and the notes you or your agents add.
• Agent keys: their names and which projects they can reach, stored with only a one-way hash of each key.
• Agent calls: each call an agent makes to our MCP server is recorded with the key, the tool it used and when, so you can see what your agents did and so we can count usage.

From the gyve tool

The gyve tool runs on your own computer. To build a harness it asks us for catalog content, sending which path and kits your project uses, and your agent key if you've set one. When gyve up sets up a service, it calls that service directly from your computer, with keys from your own environment. Those keys, and the secrets services send back, never reach us.

From our website

Our marketing site counts page views for our own use: the page's path, the referring site, and a count of visitors that can't identify anyone and resets every day. It uses no cookies and no advertising or third-party analytics trackers. If your browser sends Do Not Track or Global Privacy Control, we don't count the view at all. Like most websites, our servers record basic request information, such as IP address and browser, to run and secure the site.

Cookies

We use only the cookies the Service needs: a session cookie that keeps you signed in, and cookies that protect against cross-site attacks. Your browser may also store small preferences, such as light or dark mode. We don't use advertising cookies, and we don't track you across other sites.

How we use it

• To provide the Service: serving the catalog, keeping your projects and their progress, and answering your agents.
• To keep it secure: verifying sign-ins and keys, enforcing rate limits and key restrictions, and detecting misuse.
• To communicate: account and security emails, trial and billing notices, and replies to your messages.
• To bill you, including counting agent calls, and keep the records the law requires.
• To meet legal obligations and enforce our terms of service.

Where privacy laws ask for a legal basis, we rely on performing our contract with you, our legitimate interest in running a secure and reliable service, your consent where we ask for it, and legal obligations.

We don't sell or rent personal information, we don't use it for advertising, and we don't use your projects, notes or code to train AI models.

Who we share it with

• Your organization. Members see the organization's projects, progress, notes and the record of agent calls, according to their role.
• Service providers that help us run the Service, under contracts that limit their use of the data to the work they do for us:
  • Google Cloud, for hosting, our database, file storage and secrets management
  • Stripe, for payments
  • Our email delivery provider, for sending email
  • Google, if you choose to sign in with Google
• Arcaro Labs' own operations system, which receives counts of events such as sign-ups and subscriptions (not who made them), error summaries, and our marketing site's page views, so we can run the company's products.
• When the law requires it, or to protect the rights, safety and security of our users, the public or us. We'll push back on requests that are too broad, and tell the people affected where we're allowed to.
• In a business change, such as a merger or sale, where the new owner keeps the protections in this policy.

The AI models your agents use are chosen and run by you, under your own agreements with their providers. We don't send your data to them.

How long we keep it

• Projects and their notes: until you delete the project or your organization.
• Accounts: until you delete your account or your organization is deleted.
• Sessions: up to 30 days, or until you sign out.
• Notifications: 90 days.
• Activity log, including agent calls: 2 years, including after the organization it belongs to is deleted, so security incidents and disputes can still be looked into. Failed sign-ins and password reset requests, which record email and IP addresses, are kept for 30 days.
• Billing records: as long as tax and accounting law requires.

Deleted data may remain in encrypted backups for a limited time until they're replaced.

How we protect it

Agent keys, sessions and recovery codes are stored only as hashes, and secrets such as two-factor keys are encrypted. Traffic is encrypted in transit. Our security page explains more.

No system is perfectly secure. If a breach affects your information, we'll tell you without undue delay, as the law requires.

Your choices and rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict how we use it, and to withdraw consent. You also have the right not to be treated differently for using these rights.

You can update most details in the dashboard, delete projects and keys, delete your account, or delete your organization. For anything else, email us. We'll respond within the time the law requires, and may need to confirm your identity first. If you're in the EU, UK or another region with a data protection authority, you can also complain to it.

California residents

This section is for California residents, under the California Consumer Privacy Act as amended (CCPA). In the last 12 months we have collected these categories of personal information, for the purposes in "How we use it":

• Identifiers: name, email address, IP address, account identifiers.
• Customer records and commercial information: billing contact, plan and subscription history. Card details are collected by Stripe.
• Internet activity: sign-ins, actions in the dashboard and the record of agent calls.
• Professional information: your organization and your role in it.
• Sensitive personal information: account sign-in credentials, used only to sign you in and keep your account secure.

We disclose these categories for business purposes only to the parties listed in "Who we share it with". We don't sell or share personal information for cross-context behavioral advertising, and haven't in the last 12 months. We don't use sensitive personal information for anything beyond what the CCPA allows, so the right to limit its use doesn't apply. We keep each category for the periods in "How long we keep it".

You may ask us to tell you what we collect, use and disclose about you; to delete it; and to correct it. You won't be treated differently for asking. To make a request, email us from the address on your account, or have an authorized agent email us with your written permission. We'll confirm your identity and answer within 45 days.

International transfers

We're based in the United States, and we and our service providers process information there and may process it in other countries. Where the law requires, we protect those transfers with safeguards such as the European Commission's Standard Contractual Clauses.

Children

The Service is for developers and businesses. It isn't directed to children, and we don't knowingly collect information from anyone under 16. If you think a child has given us information, contact us and we'll delete it.

Changes to this policy

If we change this policy in a way that matters, we'll tell customers by email or in the dashboard before it takes effect, and update the date at the top.

Contact

Questions, requests or concerns about privacy:

Arcaro Labs LLC
hello@gyve.dev