Privacy Policy

Kybernesis operates ARP Cloud at cloud.arp.run. This policy describes how we handle personal data when you use the hosted Service.

2.1 You provide

• Account identifiers: email, billing details via Stripe.
• Public cryptographic material: your principal DID (the public key portion), agent DIDs, consent tokens you have signed.
• Support correspondence.

2.2 Automatic

• Request metadata: IP address, user agent, timestamps.
• Usage counters per tenant: message volume, audit entries.
• Rate-limit hits for anti-abuse.

2.3 We do NOT collect

• Principal private keys. Your keypair is generated in your browser; the private key never leaves your device.
• Recovery phrases. Stored in your browser only; transmit them yourself if you need to copy them.
• Full message payloads (transport is end-to-end).

Operating the Service, enforcing acceptable use, billing, customer support, service announcements. No behavioral advertising.

We use the following processors (subprocessors):

• Stripe — billing.
• Vercel — hosting + deployment.
• Neon — managed Postgres.
• [TODO: counsel — add any others].

We do not sell personal data. We do not share personal data with advertising networks.

Account data is retained for the life of your account + [TODO: counsel — TBD] days after termination. Audit entries are retained per plan tier (see pricing). Request logs ≤ 90 days.

Depending on your jurisdiction, you may have rights to:

• Access a copy of your personal data.
• Correct inaccurate data.
• Delete data (subject to legal retention requirements).
• Port data to another provider.
• Object to specific processing.

Requests: privacy@arp.run. We respond within 30 days.

Our infrastructure runs on Vercel + Neon regions that may be outside your country of residence. Standard Contractual Clauses or equivalent safeguards apply where required.

Principal keys are browser-held. Transport is authenticated + integrity-protected. Audit entries are hash-chained to allow tamper detection. The full security posture is documented in the public spec.

The Service is not directed at children under 16. We do not knowingly collect personal data from children.

Material changes will be announced with 30 days' notice where practical.

Privacy questions: privacy@arp.run.