Privacy Policy
This policy explains what Arlo AI LLC (“we”, “us”) collects when you use Helicopter during its private beta, why, and how long we keep it. You can reach us at {{CONTACT_EMAIL}}.
1. What we collect
- Waitlist. The email address and the optional use case you type into the waitlist form.
- Account. The email address we have for your account, and an account ID we generate, once we invite you.
- API keys. Stored only as hashes. We show a key once, so we cannot read it back later.
- API usage metadata. Which routes you call, when, and for which phone IDs. We use this to run the Service, apply limits and investigate abuse.
- Connection metadata from phones. The destination, port and time of network connections that phones make. We keep it for 30 days, to enforce the Acceptable Use Policy and protect the Service.
- Your IP address. Like any web service, our servers see the IP address you connect from. We use it for rate limiting and security.
Drafting note: confirm with the gateway and web server setup which logs record IP addresses and how long they are kept, then state the period here. Remove this note before publishing.
This website does not use cookies, analytics, trackers, third-party scripts or third-party fonts.
2. What we do not store
We do not store screen contents, typed text or app data in our logs. What is on a phone stays on that phone’s disk. Each phone’s disk is encrypted with its own key, and when you delete a phone its key is destroyed.
3. How we use it
- To run, secure and support the Service, and to apply limits.
- To contact you about access to the beta and about your account.
- To detect and stop abuse and to enforce our policies.
- To follow the law and respond to valid legal requests.
We do not sell your personal information and we do not use it for advertising.
4. Subprocessors and sharing
We use these subprocessors to run the Service:
- Hetzner Online GmbH (Germany): server hosting, in data centers in Germany and Finland (European Union).
We share personal information with others only with these subprocessors, when the law requires it, to protect people or the Service, or as part of a sale or reorganization of our business (in which case we will tell you).
5. How long we keep it
- Connection metadata from phones: 30 days.
- Waitlist entries: until we have finished inviting people from the waitlist for the beta, or until you ask us to delete yours.
- Account email and API key hashes: while your account is active, and for a short time afterwards for security and record keeping.
- API usage metadata: as long as needed to run the Service, apply limits and investigate abuse.
- Phones: until you delete a phone, or we end your access or the beta. Deleting a phone destroys its encryption key.
Drafting note: the retention periods other than the 30 days for connection metadata are proposals. Replace them with real periods before publishing.
6. Deleting your data and your choices
To ask us to delete, correct or give you a copy of your personal information, email {{CONTACT_EMAIL}}. We will reply as soon as we reasonably can. To remove a phone and its data yourself, delete the phone through the API. Section 8 lists your rights in more detail.
7. Where your data is hosted
Our servers are provided by Hetzner Online GmbH and are located in the European Union, in Germany and Finland. Your information is stored and processed there. If you use the Service from outside the European Union, your information is transferred to the European Union.
Transfers outside the European Economic Area. Where personal data is transferred outside the European Economic Area, we protect it with {{TRANSFER_MECHANISM}}.
Drafting note: counsel to state how Arlo AI LLC reaches this data from where it operates and, if that is outside the EEA, the transfer mechanism (for example Standard Contractual Clauses). Sign Hetzner’s data processing agreement before launch, then say so here. Remove this note before publishing.
8. GDPR: who is responsible, legal bases and your rights
If you are in the European Economic Area, the United Kingdom or Switzerland, the GDPR (or the UK GDPR) applies to how we handle your personal data.
Controller. Arlo AI LLC is the controller. Contact: {{CONTACT_EMAIL}}.
EU representative and data protection officer. EU representative (Article 27 GDPR): {{EU_REPRESENTATIVE}}. Data protection officer: {{DPO_CONTACT}}.
Drafting note: an EU representative is needed if Arlo AI LLC has no establishment in the EU and offers the Service to people there. A data protection officer is needed only in some cases (Article 37). Counsel to confirm, then fill in or delete these two lines. Remove this note before publishing.
Why we use your data, and the legal basis.
- Waitlist email and use case, to answer your request to join and to contact you about access: taking steps at your request before entering into a contract (Article 6(1)(b)).
- Account email, account ID, API key hashes and API usage metadata, to provide the Service and apply limits: performing our contract with you (Article 6(1)(b)).
- Connection metadata from phones, API usage metadata and IP addresses, to keep the Service secure, prevent abuse and enforce the Acceptable Use Policy: our legitimate interests in security and in preventing abuse (Article 6(1)(f)).
- Keeping records and answering valid legal requests: legal obligation (Article 6(1)(c)).
Drafting note: counsel to confirm these legal bases (for example consent instead of Article 6(1)(b) for the waitlist). Remove this note before publishing.
Your rights. You can ask us for access to your personal data, to correct it, to erase it, to restrict how we use it, and to receive it in a portable format. You can object to processing that is based on our legitimate interests. To use any of these rights, email {{CONTACT_EMAIL}}. You can also complain to the data protection authority in the country where you live or work.
9. Your content: our role as processor
The content on your phones (Your Content) is yours. For that content you are the controller of the personal data in it, and we act as your processor: we process it only to run the Service for you and on your instructions. Our data processing agreement is available at {{DPA_LINK}}.
Drafting note: counsel to write the data processing agreement and set where it is published. Our hosting provider has its own agreement with us as a subprocessor; sign it before launch. Remove this note before publishing.
10. Where we get data, and whether you have to give it
Where it comes from. We get your waitlist and account information from you. We get API usage metadata, and connection metadata from your phones' network connections, from your use of the Service. We do not buy personal data from others.
What is required. An email address is required to join the waitlist and to have an account. Without it we cannot give you access. The use case is optional. API usage metadata and connection metadata are created automatically when you use the Service, and we need them to run it and keep it safe.
Withdrawing consent. Where we rely on your consent, you can withdraw it at any time by emailing {{CONTACT_EMAIL}}. Withdrawing does not affect what we did before you withdrew.
No automated decisions about you. We do not make decisions about you based only on automated processing that have legal or similarly significant effects on you. Rate limits apply automatically. Suspensions are decided by a person.
If something goes wrong. If a personal data breach is likely to put your rights at risk, we will tell you without undue delay and, where the law requires, the data protection authority.
Drafting note: confirm with the gateway and operations that suspensions are decided by a person and that there is a breach process, and counsel to confirm the wording above. Remove this note before publishing.
11. Security
Connections to the Service use HTTPS. API keys are stored only as hashes, and each phone’s disk is encrypted with its own key. No system is perfectly secure, and we cannot promise that nothing will go wrong.
12. Children
The Service is not meant for anyone under 18, and we do not knowingly collect information from children.
13. Changes and contact
We may update this policy. If a change is material, we will tell you by email or on this site. Questions: {{CONTACT_EMAIL}}.