Privacy

What Arbo keeps

Your account, meaning your name, email address and hashed password (never readable).

Your projects, their pages, comments and versions, to show them to you and share them with the people you choose.

What you type on the Try page without an account, with a fingerprint of your IP address (not the address itself) used to cap generations per day. A generation that is not claimed by an account is deleted after 30 days.

Who processes this data

Hostinger hosts the server and the database.

Anthropic (United States) receives the text of AI requests to produce the structure. If you plug in your own OpenAI or Mistral key, the request goes to that provider.

Resend (United States) sends account emails (confirmation, password, invitations).

Polar (United States) processes payments. Arbo never sees your card number.

PostHog (United States) measures usage, see below.

No data is sold or used for advertising.

Analytics and cookies

Arbo sets a session cookie to keep you signed in. It is required and used for nothing else.

Until you accept analytics, PostHog counts page views anonymously, without storing anything on your device and without recording your session.

If you accept, PostHog keeps an identifier on your device to link your visits, remembers the page you arrived on and may record your navigation in Arbo (input fields are masked). You can change your mind at any time with the Cookies link at the bottom of the page.

Retention

Your account and projects are kept while your account exists. When you ask for deletion, they are erased within 30 days, except invoices the law requires us to keep.

Your rights

You can ask to access, correct, export or delete your data by writing to pro.allali.ilies@gmail.com. Answer within a month. You can also contact the French data protection authority (cnil.fr).