Our commitment to you

Overview

A Letter to all Arc Users,

Welcome to privacy at the Browser Company. To us, privacy means a web browser that the people we know and love can feel safe using. It means you don't have to worry that your data is being misused, misappropriated, or bought and sold in ways you're not aware of. It means we're not now, not ever, in the business of profiting from your data.

We care about your privacy and want to be upfront about how we treat your personal data: what we do collect, why we collect it, where it all goes, and for how long. So we wrote this privacy policy to explain it to you in the clearest, simplest way we know how.

In addition to this privacy policy, please read our Terms of Service which also applies to your use of the product. It's also where you can find any terms not directly defined in this policy.

One more reminder before you get started. We care about your privacy, but unfortunately, not everyone on the internet does. Just because we don't collect a particular piece of information doesn't mean websites you visit or services you use won't try to. We do offer settings and tools to help you limit the information collected by other websites—read the section "Additional Ways to Enhance Privacy Online" below for more.

You can print a copy of this Privacy Policy by clicking here. if you have any questions about this Privacy Policy or suggestions, give us a shout at [email protected]. We're all ears!

What personal data do we collect?

Before we get into the details, we want you to know that "Personal Data" includes any information that identifies or relates to a particular individual (often referred to "personal information," "personally identifiable information" or "PII"). Data that is de-identified or anonymized (in other words, it can't identify you) is NOT considered Personal Data. The Personal Data we collect about you will vary depending on your relationship with us.

When you visit our websites, arc.net or thebrowser.company

We do NOT use advertising or similar tracking technologies on our website. To measure site traffic, we sought out a privacy-first service provider. Our provider uses IP addresses to maintain unique visitor counts and the geographic distribution of the site traffic. However, they're contractually obligated not to collect any other Personal Data or sell your Personal Data.

When you reach out directly or otherwise choose to give us feedback or other information

For instance, when you submit a bug report or request support, we'll collect the information you share with us to help solve your problem. Specifically, if you submit a bug report, we'll automatically collect the names of browser extensions you have installed in case they're responsible for the issue you're reporting.

When you purchase products such as merchandise, stickers, or the Arc Manual

You will have to provide certain payment information such as your payment card number (we can only access the last 4 digits) and billing address, phone number and email. This information is predominantly processed by our payment processor, Stripe, Inc. ("Stripe").

When you sign up for an Arc account and use our Browser

We will collect certain profile or contact information, such as your name and email address, IP/device data such as your IP address (and related, general, location data), and the type of device and operating system used to access our Services. We may also collect certain product usage data, such as how often you use various product features. Additionally, additional data or processing may apply to specific Browser products or features, as described below:

• Easels. Easels allow you to create content, including text, images, and links. When you create an Easel, it's automatically stored so that you can access it on other devices. We do not use or access your Easels for anything other than displaying your content to you. If you decide to share an Easel publicly, it will be viewable by anyone with the link.
• Boosts. Boosts are a feature of Arc that lets you customize your web interface including changing the colors, fonts, and even removing entire sections from sites. Similarly to Easels, Boosts are automatically stored with our Service Provider so that you can access them on other devices.
• Sharing features. For some features of Arc, like Easels and Folders, you can optionally create arc.net links that allow you to share those objects with others. If you choose to opt in to share an object, data about that object (for example, the title of the folder and the URLs it contains) is automatically stored with our Service Provider, and the content will be viewable by anyone with the link. When someone opens this link, we collect anonymous statistics about their usage.
• Sidebar sync. If you choose to sync your sidebar via Arc Sync, data about your sidebar items will be encrypted and sent to our cloud provider. This data is end-to-end encrypted, and no one except you can view it. Learn more here. You can switch from iCloud to Arc Sync, or turn syncing off, in the desktop app in Settings.
• Third-party connections. Some features of the Browser rely on third-party APIs (Application Programming Interfaces) for their functionality. In these instances, the Browser directly connects you with the third party. If you choose to use these features, the third party may receive certain data as detailed below. This data never passes through our servers, and we have no way of knowing its contents.
  • Website translation: If you choose to use the website translation feature, the text to be translated will be sent to the Google Translate API.
  • Search suggestions: When you type search queries or URLs, the Browser fetches search suggestions from your default search engine. Search suggestions are on by default when you install the Browser. In the desktop app, you can change your default search engine or turn off search suggestions in Preferences > General. In the mobile app, the default search engine is Google and cannot be changed at this time.
  • Google Calendar and Outlook Previews: Previews allow you to glance at top sites without leaving your current tab. If you choose to connect your Google account to the Google Calendar Preview or Microsoft account to an Outlook preview, you will be prompted to sign in and grant certain permissions to Arc. If you allow access, Arc will read and display this information in the Preview. We do not store any of this information on our servers or use it for any other purpose. You can read more about your Google Calendar data in the Google API Services User Data Policy.

When you use certain Arc Max features

When you use certain Arc Max features certain personal data will be sent to either or both of our service providers, OpenAI and Anthropic, relevant to the particular feature:

• Tidy Tab/Tidy Tab Titles: When enabled, tabs you pin will be renamed to help keep you organized throughout the day and pressing the broom icon will organize your tabs into groups. These features involve the sharing of your name of tab title, tab URL to be shared.
• Tidy Downloads: When enabled, files you download will be renamed to help keep you organized throughout the day. This involves the sharing of the name of tab title, filename of downloaded file.
• 5-Second Previews: When enabled, hovering over a URL will provide a summary of the webpage. This requires sharing the contents of that webpage.
• ChatGPT in the Command Bar: When enabled, asking a question in the command bar via ChatGPT site search will open an answer in ChatGPT. This involves sharing the content of the command bar.
• Ask on Page: When enabled, asking a question about a webpage will provide an answer based on the content of that page. This involves sharing the content of the relevant webpage and webpage URL.
• Instant Links: When enabled, the top search results will be instantly opened. This involves the sharing the content of the command.

When you use Browse for Me

Browse for Me provides AI-generated summaries of webpages related to your search query. To provide this feature, content of the command bar, and content search results are shared with our service provider, OpenAI.

How we collect personal data

We collect your personal data from you either directly when you provide to us (such as when you create an account), from our service providers (such as OpenAI or Anthropic if you are using certain AI-powered features), or automatically when you use our Services (such as information regarding the device on which you're accessing our Services).

Our purposes for processing personal data

We process your personal data to provide you with the Services. This could include:

• Creating and managing your account or other user profiles.
• Processing orders or other transactions; billing.
• Providing you with the Services or information you request.
• Meeting or fulfilling the reason you provided the information to us.
• Providing support and assistance for the Services.
• Communicating with you in connection with our Services.

In addition, we may also process your personal data in relation to the following legal purposes:

• meet certain legal requirements and enforcing legal terms
• fulfilling our legal obligations under applicable law, regulation, court order or other legal process,
• preventing, detecting and investigating security incidents and potentially illegal or prohibited activities;
• protecting the rights, property or safety of you, us, or another party;
• enforcing any agreements with you; and
• responding to claims that any posting or other content violates third-party rights; and resolving disputes.

We will not collect additional categories of personal data or use the personal data we collected for materially different, unrelated or incompatible purposes without providing you notice or obtaining your consent.

How we may disclose your personal data

We will only disclose your personal data to the following parties:

• Service Providers, These trusted partners help us provide Arc and support our business, such as
  • Hosting, technology and communication providers.
  • Analytics providers that help us analyze usage of our Services.
  • Security and fraud prevention consultants.
  • Support and customer service vendors. OpenAI and/or Anthropic, if you are using our AI-powered features.
• Parties You Authorize, Access or Authenticate
  • Third parties you access through the Services.
  • Other users or individuals you share information with.

However, we may need to provide your Personal Data to third parties under certain circumstances, including:

• If required to fulfil the legal purposes described in the section above,
• If we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part).

Data that is not personal data

We may create aggregated, de-identified, or anonymized data from the personal data we collect. We would do so by removing information that makes the data personally identifiable to a particular user. We may use such aggregated, de-identified, or anonymized data and disclose it with third parties for our lawful business purposes, including to analyze, build, and improve our Services and promote our business, provided that we will not disclose such data in a manner that could identify you.

How we store and protect your personal data

We keep personal data for as long as necessary to provide our Services, to perform our business, or commercial purposes for collecting your personal data. When deciding how long to retain specific types of data, we consider who the data came from, whether we need it, why we collected the personal data, and how sensitive it is. We may keep personal data for longer, if needed to meet with legal obligations, resolve disputes, collect fees owed, or as otherwise allowed or required by applicable law. We may also retain information in an anonymous, de-identified, or aggregated form where that information would not identify you personally.

For example:

• We retain your profile information and credentials for as long as you have an account with us.
• We retain your IP/device data for as long as we need it to ensure that our systems are working appropriately, effectively and efficiently.

As an important reminder, Arc's data practices may not extend to the websites you visit when using our browser, which we can't control. We do offer settings and tools to help you limit the information collected by websites you visit. You can change your default search engine and settings for search suggestions by going to Arc > Preferences > General > Privacy Preferences to control cookies and change other privacy and security settings. In the General preferences window, you can also change your default search engine and turn search suggestions on and off. Another way to protect your personal data is to practice password hygiene around your credentials such as by avoiding repetitive patterns, duplicating passwords, and rotating passwords on a regular basis.

Children's data

As noted in our Terms of Service, we do not knowingly collect or solicit personal data about children under 16 years of age; if you are a child under the age of 16, please do not attempt to register for or otherwise use the services or send us any personal data. if we learn we have collected personal data from a child under 16 years of age, we will delete that information as quickly as possible. if you believe that a child under 16 years of age may have provided personal data to us, please contact us at [email protected].

U.S. state privacy rights

If you reside in certain U.S. states such as California, Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia you may have certain rights afforded to you (as described below) depending on your state of residence. Please see the 'Exercising Your Rights under U.S. State Privacy Laws' section below for instructions regarding how to exercise these rights. Please note that we may process personal data of our customers' end users or employees in connection with our provision of certain services to our customers. If we are processing your personal data as a service provider, you should contact the entity that collected your personal data in the first instance to address your rights with respect to such data. Please note that your rights may be subject to certain conditions or exceptions, including as otherwise described to you, in accordance with applicable U.S. State Privacy Laws. If you have any questions about this section or whether any of the following rights apply to you, please contact us at [email protected].

• Access: You may have the right to ask for confirmation of or access to the personal data that we process about you. You can also request access to a portable copy of your personal data. If you are an Oregon resident or Minnesota resident, you also have the right to request a list of specific third parties, other than natural persons, we've shared your personal data with.
• Deletion: You may have the right to ask us to delete the personal data we have collected about you. You can delete your Arc account within your account Settings; however, deletion of your Arc account will not automatically delete the personal data we have collected about you. To request deletion of such data, please see the 'Exercising Your Rights under U.S. State Privacy Laws' section below.
• Correction: You may have the right to ask that we correct any inaccurate personal data we have collected about you.
• Portability: You may have the right to ask for a copy of your personal data in a machine-readable format, to the extent technically feasible.

"Selling," "sharing," or "targeted advertising"

We do not sell, share, or process your personal data for the purposes of targeted advertising, and have not done so over the last 12 months.

Sensitive personal data

If you provide personal data that may be deemed "sensitive" under certain U.S. State Privacy Laws ("Sensitive Personal Data") to Arc, we will not process that information to infer characteristics about you or any other person. We will only process sensitive personal data to provide the particular service or to help with the related request, or if you are a California resident, another permitted purpose set forth in 7027(m) of the regulations California Consumer Privacy Act.

Anti-discrimination

We will not discriminate against you for exercising your rights under applicable privacy laws. We will not deny you access to Arc, charge you different prices, or provide you a lower quality of goods and services because you chose to exercise your rights under applicable privacy laws. However, we may offer different versions or tiers of Arc at different prices or service level as allowed by applicable data privacy laws in relation to the value of personal data that we receive from you.

Other state-specific privacy rights

Under California Civil Code Sections 1798.83-1798.84, California residents can contact us to prevent disclosure of personal data to third parties for such third parties' direct marketing purposes. However, we do not make any such disclosures.

If you are a resident of Nevada, you have the right to opt-out of the sale of certain personal data to third parties. We do not currently sell your personal data as sales are defined in Nevada Revised Statutes Chapter 603A.

Exercising your rights under U.S. state privacy laws

To exercise the rights described in this Privacy Policy, you or your authorized agent (if applicable and as defined below), must send us a request that (1) includes sufficient information to allow us to verify that you are the person about whom we have collected personal data (such as your account or contact data), and (2) clearly describes your request, so we can understand, evaluate, and respond to it. Each request that meets both of these criteria will be considered a "valid request." We may not respond to requests that do not meet these criteria. We will only use personal data provided in a valid request to verify your identity and complete your request. You do not need an account to submit a valid request.

We aim to respond to your valid request within the time period required by applicable U.S. state privacy laws. We will not charge you a fee for making a valid request unless your request(s) is excessive, repetitive or manifestly unfounded. If a fee applies, we'll let you know before proceeding. You may submit a valid request to delete your Arc account and/or the personal data we have collected about you within your account Settings, by submitting a valid request here or by emailing [email protected]. Please note that deletion of your Arc account will not automatically delete the personal data we have collected about you, and such deletion request must be made separately.

If you are a California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, or Texas resident, you may also authorize an agent (an "authorized agent") to exercise your rights on your behalf. To do this, you must provide your authorized agent with written permission to exercise your rights on your behalf, and we may request a copy of this written permission from your authorized agent when they make a valid request on your behalf.

Appealing a denial

If you live in Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, or Virginia and we refuse to take action on your valid request within a reasonable period of time after receipt in accordance with this section, you may appeal our decision. In such appeal, you must (1) provide sufficient information to allow us to verify that you are the person about whom the original valid request pertains and to identify the original valid request, and (2) provide a description of your appeal. Please note that your appeal will be subject to your rights and obligations afforded to you under the U.S. State Privacy Laws (as applicable). We will respond to your appeal within the time period required under the applicable law. You can submit a valid request to appeal by the emailing us at: [email protected]. (title must include "[STATE OF RESIDENCE] Appeal")'

If we deny your appeal, you have the right to contact the Attorney General of your state, including by the following links: Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, and Virginia.

European data subject rights

If you live in the European Union ("EU"), United Kingdom ("UK"), Lichtenstein, Norway or Iceland, you may have additional rights under the EU or UK General Data Protection Regulation (the "GDPR") with respect to your personal data, as outlined below.

For this section, we use the terms "personal data" and "processing" as they are defined in the GDPR, but "personal data" generally means information that can be used to individually identify a person, and "processing" generally covers actions that can be performed in connection with data such as collection, use, storage and disclosure. The Browser Company will be the controller of your personal data processed in connection with Arc.

If there are any conflicts between this section and any other section of this Privacy Policy, the policy or portion that is more protective of personal data shall control to the extent of such conflict. If you have any questions about this section or whether any of the following applies to you, please reach out at [email protected].

Personal data processing grounds

We will only process your personal data if we have a lawful basis for doing so. Lawful bases for processing may include consent, contractual necessity (in other words, as necessary to perform our Terms of Service with you, which enables us to provide you with our Services) and our "legitimate interests" or the legitimate interest of others. When we process personal data due to contractual necessity, failure to provide such personal data will result in your inability to use some or all portions of the Services that require such data. Examples of legitimate interests may be to provide you with our Services, correspond with you, meeting our legal requirements or enforcing our legal terms, or to complete corporate transactions. Lastly, we may also need to process personal data to comply with a legal obligation, if it is necessary to protect the vital interests of you or others, or if it is necessary for a task carried out in the public interest.

EU, UK and Swiss data subject rights

• You have certain rights with regarding your personal data, including those set forth below. Please note that your rights may be subject to certain conditions or exceptions, including as otherwise described to you, in accordance with the GDPR. For example, we may not be able to fully comply with your request, if it is frivolous or extremely impractical, jeopardizes the rights of others, or otherwise not required by law, but in those circumstances, we will still respond to notify you of such a decision. In some cases, we may also need you to provide us with additional information, which may include personal data, if necessary to verify your identity and the nature of your request. To learn more or make a request, submit an inquiry here or email us at [email protected].
• Access: You can ask for more information about the personal data we hold about you and request a copy of such personal data. You can also access some of your account and contact data by logging on to your Arc account.
• Rectification: If you believe that any personal data we are holding about you is incorrect or incomplete, you can request that we correct such data. You can also correct some of this information directly by logging on to your Arc account.
• Erasure: You can request that we erase some or all of your personal data from our systems. Please note that deleting your Arc account within your account Settings may erase some, but not all, personal data we hold about you.
• Withdrawal of consent: If we are processing your personal data based on your consent (as indicated at the time of collection of such data), you have the right to withdraw your consent at any time. Please note, however, that if you exercise this right, you may have to then provide express consent on a case-by-case basis for the use or disclosure of certain of your personal data, if such use or disclosure is necessary to enable you to utilize some or all of Arc.
• Portability: You can ask for a copy of your personal data in a machine-readable format. You can also request that we transmit the data to another controller where technically feasible.
• Objection: You can contact us to let us know that you object to the further use or disclosure of your personal data for certain purposes, such as for direct marketing purposes.
• Restriction of processing: You can ask us to restrict further processing of your personal data.
• Right to File Complaint: You have the right to lodge a complaint about The Browser Company's practices with respect to your personal data with the supervisory authority of your country or EU Member State. A list of Supervisory Authorities is available here: https://edpb.europa.eu/about-edpb/board/members_en.

Transfers of personal data

Our Servies are hosted and operated in the United States ("U.S.") through The Browser Company and its service providers. If you live outside the U.S., local laws may differ. By using Arc, you acknowledge that any personal data about you, regardless of whether provided by you or obtained from a third party, is being provided to The Browser Company in the U.S. and will be hosted on U.S. servers, and you authorize The Browser Company to transfer, store and process your information to and in the U.S., and possibly other countries. In some circumstances, your personal data may be transferred to the U.S. pursuant to a data processing agreement incorporating standard data protection clauses.

Changes to this Privacy Policy

We're constantly trying to improve our product and services, so we may need to change this Privacy Policy from time to time. we'll let you know of material changes by placing a notice on the app and on The Browser Company website and/or contacting you directly, mostly likely via email. If you opted not to receive legal notice emails (— we get it), or you haven't given us your email in the first place, the updated policy will still apply. We'll do our best to get these updates in front of you, however, the ball's ultimately in your court to read and understand them. If you continue to use the product we'll assume the updates are good with you. Of course, give us a shout if there's anything that needs further explaining.

Contact Us

Website: arc.net
Email: [email protected]
Address: 285 N 6th St, Brooklyn NY, 5th Floor, 11211

If you are located in the EU or UK and have any questions or requests related to how we handle your data, you may use the following information to contact our Data Protection Officer and our EU or UK-Based Member Representative.

By mail:

• EU: DP-Dock GmbH, Attn: The Browser Company, Ballindamm 39, 20095 Hamburg, Germany
• UK: DP Data Protection Services UK Ltd., Attn: The Browser Company, 16 Great Queen Street, Covent Garden, London, WC2B 5AH, United Kingdom

By email: [email protected]