Arvin provides AI assistants that businesses add to their own websites. An assistant answers questions from the pages a business asks us to read, and — where the business turns those options on — can capture a lead, take a booking, or hand the conversation to a person on its team.
This policy explains what we do with information on our own website and dashboard, and what we do with information an assistant handles on a customer's website. It applies to business owners and their teams, to visitors who chat with an assistant, and to anyone who contacts us. We wrote it to be read rather than skimmed past; if anything here is unclear, write to us and we will answer in plain terms.
1. Who is responsible for your information
Arvin is a brand of Quartrek LLP, a limited liability partnership registered in India, which owns the technology behind the service (the “Technology Owner”). The service is operated in the United States by QuarTEQ LLC, a limited liability company registered in the State of Georgia, USA, at 11720 Amber Park Dr Ste 160, Alpharetta, GA 30009, USA, under a technology licence from Quartrek LLP (the “US Operator”). Where this policy says “Arvin”, “we”, “us” or “our”, it means QuarTEQ LLC as the contracting entity and Quartrek LLP as the technology owner, operating the platform together.
QuarTEQ LLC is the entity you contract with and the first place to send any request. Quartrek LLP builds and maintains the platform and handles information for that purpose, under written terms that bind it to this policy and to the same security commitments. Both stand behind what is written here, and a request sent to either address below reaches both.
Beyond that, two different roles matter, because they decide who you ask for what:
- We are the controller of information about accounts, teams, billing, support, and visits to our own website and dashboard. We decide how that information is used, and this policy governs it.
- We are a processor — a service provider — for everything an assistant handles for a business: its website content, its visitor conversations, and the leads and bookings those conversations produce. The business decides why that information is collected and how long it is kept; we act on its instructions and under our agreement with it. Its own privacy notice applies to those interactions alongside this one.
So if you chatted with an assistant on a company's website and want that conversation corrected or deleted, that company is the fastest route and is usually the only one that can identify you. Write to us anyway if you would rather start here — tell us which website it was and roughly when — and we will pass the request on, help the business answer it, or act ourselves where the law puts the duty on us.
You can reach us about anything in this policy at [email protected].
2. How we approach this
These are commitments, not aspirations, and the rest of the policy should be read against them.
- We ask for what the service needs to work, and no more.
- We use information for the purposes described here, and tell you before using it for a materially different one.
- We keep it only as long as there is a reason to, then remove it.
- We never sell personal information for money, and we never use a business's visitor conversations to build advertising profiles or to advertise to anyone.
- Optional analytics and advertising technologies on our own website stay switched off until you accept them, and you can change your mind at any time.
- We hold the companies that process information for us to written terms at least as protective as this policy.
- We say what we actually do. Where something is not automated — a deletion request, for instance, is carried out by a person — we say so rather than implying a button exists.
3. What we collect
- Account and team information: your email address, authentication identifiers, name and business details where you give them, team roles, invitations sent to colleagues, and the content of your messages to support.
- Business setup: the website address you enter, the public pages and other material you ask an assistant to read, assistant settings and instructions, the domains you approve, opening hours and timezone, and the settings of any integration you connect.
- Visitor interactions: the messages a visitor sends and the replies an assistant or a human operator gives, a conversation identifier, and whatever a visitor chooses to provide when asked — typically a name and a way to be contacted for a lead, and a name, email address, phone number and note for a booking.
- Payment information: subscription and plan status, invoice and transaction identifiers, amounts, and the country used for tax. Card details are entered directly with our payment processor; we never receive or store a full card number.
- Technical and security information: the website domain an assistant was loaded on, request records, browser and device information, IP address in service and security logs, error reports, and counts of use such as conversations handled.
- Analytics and advertising measurement on our own site: if you accept optional cookies, the pages you visit on our website and dashboard, the actions you take on them, and related browser, device and request information, collected through the technologies named in our Cookie Policy.
- Preferences stored in your browser: your cookie choice, display theme, currency, sidebar state, and the settings of the toy on our home page. The assistant widget remembers for the rest of a browser session that you dismissed its greeting. None of this is used to identify you.
We get this information from you and your team; from visitors to a customer's website; from public web pages a customer asks us to read; from the authentication, payment and integration providers you choose to use; and automatically from your use of the service.
Please do not put sensitive information into a chat or a source. Arvin is not built for health records, government identifiers, financial account numbers, precise location, biometric data, or information about a person's race, religion, politics, sex life, union membership or criminal record. We do not ask for it and we do not want it; a business that must handle such data should use a system designed for it and speak to us first.
4. Why we use it, and our legal basis
Where European, UK or similar law requires a legal basis, these are ours:
- To provide the service — creating accounts, reading the pages you select, producing and citing answers, running conversations, human handover, leads, bookings and the notifications you configure. Basis: performance of our contract with you.
- To take payment — subscriptions, one-time purchases, invoices and tax records. Basis: contract, and legal obligation for records we must keep.
- To support you — answering your questions and investigating problems you report. Basis: contract and our legitimate interests.
- To keep the service secure and working — authentication, abuse and fraud prevention, rate limits, logging, debugging and capacity planning. Basis: legitimate interests, and legal obligation where security is required by law.
- To improve the service — reliability and quality measurement, aggregated or de-identified statistics, and feedback you give us. Basis: legitimate interests. We work from aggregated figures rather than reading conversations for product ideas.
- Optional analytics and advertising measurement on our own website — understanding which pages bring people to Arvin and whether our marketing works. Basis: your consent, which you may withdraw at any time.
- To meet legal obligations and protect rights — responding to lawful requests, enforcing our terms, and defending claims. Basis: legal obligation and legitimate interests.
- Visitor conversations, leads and bookings are processed on a business's instructions for the purposes it sets. That business is responsible for having a basis — consent, contract or its own legitimate interests — and for telling its visitors.
5. AI, and what is not done with your information
Answers are generated by AI models from the content a business asked us to read. Two consequences are worth stating plainly: an assistant can be wrong, incomplete or out of date even while citing a real page, and a business should check its sources and settings before and after publishing one. Nothing an assistant says is professional, medical, legal or financial advice, and nothing it says should be relied on in an emergency.
The AI providers we use are engaged under business terms that do not permit them to use your content, or your visitors' conversations, to train their general-purpose models. Those providers may hold limited diagnostic records for a short period to investigate abuse and errors, under the same terms. We do not use visitor conversations for advertising, we do not sell them, and we do not combine them across businesses to profile anyone.
Arvin does not make decisions with legal or similarly significant effects about a visitor by automated means alone. An assistant answers questions, accepts details a visitor volunteers, and offers available appointment times; a person from the business can take over a conversation at any point, and the visitor is told in the conversation when that happens and when it ends. Customers may not use Arvin to make consequential decisions about people — about employment, credit, housing, insurance, education or access to health care — without meaningful human review.
6. Who receives information
- The business operating the assistant, and the team members it authorises, can read its conversations, leads, bookings and statistics. Access is scoped to that business; no customer can see another's data.
- Services a customer chooses to connect. Connect a store or site platform and we install the assistant there. Connect a calendar and bookings and busy times travel between Arvin and that calendar, with the customer invited to the appointment. Configure a webhook and the events selected — a new lead, a booked or cancelled appointment, an unanswered question — are sent to the address chosen, which may be a team chat tool. The business picks those destinations and is responsible for them.
- Our own two companies. Information moves between QuarTEQ LLC and Quartrek LLP because one contracts with you and the other builds and operates the platform. They are not outside recipients: both are bound by this policy, by written terms between them, and by the same confidentiality and security obligations.
- Service providers that run Arvin for us, by category: cloud hosting, databases and storage; authentication; AI model and embedding providers; speech synthesis, where a business enables spoken replies; payment processing; notification delivery; error monitoring and security tooling; and support tooling. Each is bound by contract to use information only to provide its service to us, to protect it, and to delete or return it when the engagement ends. Customers may request the current list of these providers at [email protected], and we will give notice before a change that materially affects your data.
- Our payment processor, Stripe, which handles checkout, cards, invoices and the billing portal, and which is a controller of the payment details you enter with it.
- Analytics and advertising partners, only with your consent, and only for visits to our own website and dashboard. They are named and individually explained in our Cookie Policy. They never receive a customer's visitor conversations, leads or bookings.
- Advisers, authorities and acquirers — our auditors and lawyers under confidentiality; a court, regulator or law enforcement agency where a valid legal request requires it or where we must protect rights, safety or the integrity of the service; and a buyer or successor in a merger, acquisition or reorganisation, under confidentiality and on terms consistent with this policy. Where we are legally permitted to tell a customer about a request for its data, we will.
7. Where information is processed
The service is operated from the United States, where QuarTEQ LLC is established and where the infrastructure that stores your data runs. Development, maintenance and support are carried out from India by Quartrek LLP, whose staff may access data to build and keep the service working. Our providers process information in the United States and in other countries where they run infrastructure.
So if you are in the European Economic Area, the United Kingdom or Switzerland, your information will be transferred outside your country, including to the United States and India, neither of which has a general adequacy decision. Where that happens we rely on a lawful transfer mechanism: an adequacy decision where one covers the destination, or the European Commission's Standard Contractual Clauses — with the UK Addendum or the UK International Data Transfer Agreement for the United Kingdom — between the receiving entity and the sending one, including between our own two companies, together with safeguards such as encryption in transit, access limited to the people who need it, and confidentiality obligations on everyone who has it.
Customers can request a copy of the clauses we rely on, our transfer impact assessment and our data processing addendum at [email protected].
8. How long we keep it
- Account, team and assistant settings: while the account is open. When you close it we delete or de-identify them within a reasonable period, usually within 90 days, except where we must keep something longer.
- Website content read for an assistant: while that source is attached to a live assistant. Remove the source, or the assistant, and the stored copy goes with it.
- Conversations, leads and bookings: kept for the business that owns them until it deletes them or asks us to, or until a retention period we have agreed requires removal. We do not currently expire every conversation automatically; if you want a fixed retention window for your account, ask and we will set one.
- Billing and tax records: as long as tax, accounting and limitation periods require — generally up to seven years — and then deleted.
- Security, request and error logs: short operational periods, typically weeks to months, after which they are deleted or aggregated.
- Backups: deleted records can persist in routine backups for a limited further period until those backups roll over.
We will tell you the period that currently applies to your account if you ask. Aggregated or de-identified figures that can no longer be linked to a person — how many conversations were handled in a week, for instance — may be kept indefinitely.
9. How we protect it, and what happens if something goes wrong
We encrypt data in transit with TLS, and our infrastructure providers encrypt it at rest. Each business's data is separated, and every request is authorised against the account it belongs to. Access by our staff is limited to the people whose work requires it and is subject to confidentiality obligations. An assistant's public key works only on the website domains a business has approved. Webhooks are signed so a receiver can verify that a message came from us and has not been replayed, and addresses we fetch or send to are checked so that requests cannot be aimed at internal systems. We review dependencies and configuration, and we test the parts where a mistake would be expensive.
No service on the internet can promise absolute security. You help by keeping credentials and recovery methods safe, giving team members the least access they need, removing people who leave, and protecting any webhook or calendar destination you connect.
If a personal data breach affects your information, we will notify affected customers without undue delay and give them what they need to meet their own obligations, and we will notify regulators and individuals where the law requires it and within the deadlines it sets — within 72 hours of becoming aware, where the GDPR applies.
10. Your choices
- Account and assistant settings can be changed in the dashboard at any time, including what an assistant may do, what it reads, and which domains it may load on.
- Optional cookies: choose “Only necessary” in the banner to keep analytics and advertising technologies from loading, and revisit the choice whenever you like — .
- Global Privacy Control: if your browser or an extension sends a GPC signal, we treat it as an opt-out and keep optional analytics and advertising technologies switched off, without asking you again.
- Email: service messages about billing, security and changes that affect your account come with the service. Any marketing email carries an unsubscribe link that works, and unsubscribing never affects the service you receive.
- Spoken replies and other optional features stay off unless a business turns them on.
11. Your rights
Depending on where you live, you may have some or all of these rights over personal information we hold about you: to know what we process and why; to obtain a copy; to correct it; to have it deleted; to restrict or object to a use; to receive it in a portable form; to withdraw a consent you gave; and not to be subject to a decision made solely by automated means with legal or similarly significant effect.
To exercise any of them, email [email protected]. We will verify who you are — usually by replying to the address on the account, or by asking for enough detail to identify a conversation — and we will not ask for more than that verification needs. We answer within one month where the GDPR or UK GDPR applies and within 45 days where US state law applies, and we will tell you if we need the extension those laws allow. Using these rights costs nothing, and it will never get you worse service, worse prices or fewer features.
An authorised agent may make a request for you where the law allows; we will ask for proof of authority. If we must refuse part of a request — because an exception applies, because we cannot verify it, or because the information belongs to a business for whom we are only a processor — we will say which part and explain how to challenge the decision.
Europe, the United Kingdom and Switzerland
You may lodge a complaint with your national data protection authority — in the United Kingdom, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner — though we would appreciate the chance to put things right first. Where we rely on legitimate interests you can object, and we will stop unless we have compelling grounds to continue. Where we rely on consent, withdrawing it takes effect immediately and does not affect processing already carried out lawfully.
United States
If you live in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia or another state with a comprehensive privacy law, you have the rights above to the extent that law provides them, including the right to opt out of targeted advertising and of any “sale” or “sharing” of personal information, and the right to appeal a decision of ours by replying to our response or writing to [email protected].
In the preceding twelve months we collected the categories of personal information described in section 3 — identifiers and contact details, commercial and transaction information, internet and network activity, approximate location inferred from an IP address, professional and business information, and the contents of communications, leads and bookings — for the purposes in section 4, and disclosed them to the categories of recipients in section 6. We do not sell personal information for money. If you accept optional advertising cookies on our own website, information about your visit goes to our advertising partner, which some state laws treat as “sharing” or a “sale” for cross-context behavioural advertising; choosing “Only necessary”, changing your cookie choice above, sending a Global Privacy Control signal, or emailing us opts you out. That partner never receives a customer's visitor conversations, leads or bookings. We do not use or disclose sensitive personal information to infer characteristics about people, and we do not knowingly sell or share the personal information of anyone under 16. California residents may also ask once a year about disclosures to third parties for their direct marketing purposes under the “Shine the Light” law. Browser “Do Not Track” signals have no agreed standard and we do not act on them; we do act on Global Privacy Control.
India
India's Digital Personal Data Protection Act, 2023 gives you the right to a summary of the personal data we process about you and what we do with it, to have it corrected or completed, to have it erased when the purpose it was given for has ended, to nominate someone to exercise your rights if you die or become incapable of doing so, and to a grievance procedure you can use before approaching the Data Protection Board of India.
Quartrek LLP, as the entity established in India, is the point of contact for those requests, and QuarTEQ LLC answers alongside it. For a business's visitor conversations we are a processor and that business is the fiduciary, so we will route a request about a conversation to it. Send a grievance to [email protected] with “DPDP” in the subject line; we will acknowledge it and respond within the period the Act prescribes.
Other countries
If you are in Canada, Brazil, Australia, Japan, South Africa or anywhere else with its own privacy law, the rights set out above are available to you to the extent that law provides them, and you may complain to your national regulator. Write to us at the address above and say where you are, so that we apply the right rules.
12. Children
Arvin is a tool for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 13, and only adults may create an account. A customer must not deploy an assistant on a website or service directed to children under 13, or use it to collect information from children, without a separate written arrangement with us and whatever parental consent the law requires. If you believe a child's information has reached us, write to [email protected] and we will investigate and delete it.
13. If you are a business using Arvin
You decide what your assistant does, so some duties sit with you. Tell your visitors that an assistant is available and that it is AI; keep your own privacy notice and cookie disclosures current; and obtain any consent your jurisdiction requires before a chat collects personal information. Only connect websites and services you own or are authorised to manage. Ask visitors for the least you need. Do not use Arvin to collect sensitive or special-category data, and do not paste material into a source that you are not allowed to share.
We will enter into a data processing agreement with you covering our role as your processor, our sub-processors, international transfers, security, audit and deletion, and we can provide the standard contractual clauses where your transfers need them. Request it at [email protected]. If you need a defined retention window, deletion at the end of your contract, or help answering a visitor's request, ask and we will arrange it.
14. Changes, and how to reach us
We will post any change here with a new date at the top of the page. If a change materially affects how we use information you have already given us, we will give notice — by email to account holders, or in the dashboard — before it takes effect, and will obtain consent where the law requires it. Earlier versions are available on request.
Privacy questions, requests and complaints: [email protected]. Contracts, legal notices and anything about these documents: [email protected]. Please also read our Cookie Policy and Terms of Service.