1. Introduction and Scope
This Privacy Policy explains how ARBR Inc. d/b/a Arbiter Defense Group (“Arbiter”) collects, uses, and shares information about Provider Firm personnel — the individuals who access and use the Provider App as employees or independent contractors of a Provider Firm (“Operators”) — in their capacity as platform users. Capitalized terms not defined in this Policy have the meaning given in the Provider App Terms of Service.
This Policy covers information about you as an Operator using the platform. It does not separately cover the Client and Entity of Interest information you access, generate, or process in the course of an Engagement — that information, and Arbiter’s practices with respect to it, is addressed in the Client App Privacy Policy and the Provider App Terms of Service, both of which govern your handling of that information as an Operator. This Policy operates together with, and does not narrow, the Provider App Terms of Service, any Provider Firm Master Services Agreement in effect, the Data Minimization and Retention Policy, and, where applicable, the GDPR Article 26 Joint Controller Agreement.
2. Information We Collect From You
Account information — your name, email address, phone number, and role within your Provider Firm’s organization.
Credential and authorization information — information related to your Provider Firm’s attestation of your credentials and your assignment to an Engagement, consistent with the Provider App Terms of Service.
Device and usage information — the type of device you use to access the Provider App, your IP address, and information about how you use the platform’s features.
Communications — messages you send through the platform to Clients or other Operators. Client-facing messaging is end-to-end encrypted; Arbiter holds ciphertext only and cannot read message content.
3. How We Use Information
We use the information described in this Policy to: create and administer your Operator account; authenticate you and enforce role-based access controls; operate and improve the Provider App; provide customer support to you and your Provider Firm; maintain the security and integrity of the platform; and comply with our legal obligations, including those described in Section 7.
4. How We Share Information
With your Provider Firm. Your account and usage information is visible to your Provider Firm’s organization administrators as part of their management of your access to the platform.
With service providers. We share information with infrastructure and technology vendors that process it on our behalf to operate the platform, subject to contractual confidentiality and security obligations.
For legal and safety reasons. We may disclose information where required by law or legal process, subject to legal review, or where necessary to protect the safety of any person.
We do not sell your personal information, and we do not share it with third parties for their own independent marketing or advertising purposes.
5. Data Security
We maintain the technical and organizational measures described in the Data Minimization and Retention Policy, together with internal incident-response and legal-preservation procedures, to protect your information. No security measure is perfect, and we cannot guarantee absolute security.
6. Data Retention
Your account information is retained until your access is terminated by your Provider Firm or Arbiter, consistent with the Data Minimization and Retention Policy. Deletion of your account cascades to your profile, credentials, and organizational memberships, but does not delete your operational contributions to an Engagement, which are retained as part of your Provider Firm’s operational record with authorship anonymized, consistent with that Policy.
7. Your Privacy Rights
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), gives you the right to know what personal information we have collected about you and to request deletion or correction of that information. If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation, including the rights of access, rectification, erasure, and restriction of processing. To exercise a privacy right, contact us using the information in Section 10; we may need to verify your identity, potentially in coordination with your Provider Firm, before completing a request.
8. Law Enforcement and Legal Process
We respond to law enforcement and legal process under procedures that require legal review before any disclosure and, absent a valid non-disclosure order, notice to your Provider Firm of a request concerning your information. Some categories of information — including end-to-end encrypted message content and, where applicable, externally-held encryption keys — cannot be produced by Arbiter regardless of the legal process served, because Arbiter does not have technical access to them.
9. International Users
The Provider App is operated from the United States. If you are located outside the United States, your information will be transferred to, and processed in, the United States. Where your Provider Firm is established in, or you are located in, the European Economic Area, the United Kingdom, or Switzerland, Arbiter and your Provider Firm may act as independent controllers or, for certain Engagement-related processing, as joint controllers under the GDPR Article 26 Joint Controller Agreement between Arbiter and your Provider Firm, which also addresses the mechanism for transferring your information to Arbiter in the United States.
10. Changes to This Policy; How to Contact Us
We may update this Policy from time to time. We will post the updated Policy with a new effective date, and where a change is materially adverse to you, we will provide more prominent notice, consistent with the Provider App Terms of Service. If you have questions about this Policy or wish to exercise a privacy right, contact us at legal@arbiterdefense.group or by mail at 1209 Orange Street, Wilmington, Delaware 19801.