Privacy Policy

Effective November 5, 2026

This policy explains what information Arcaro Labs LLC ("ItsOpen", "we", "us") collects, why, who we share it with, how long we keep it, and the choices you have. It covers our website, dashboard, API, agent API, browser script, status pages and report forms (together, the "Service").

The short version: we check sites from the outside, our browser script sets no cookies and sends no identifiers, session replay hides what visitors type before it leaves their browser, and we never sell anything or use it to train AI models.

Two roles

For customers and their teams, we decide how your account information is used, so we're responsible for it (the "controller").

For visitors to our customers' sites, the customer decides whether to use ItsOpen and what to collect, and we handle visitors' information on the customer's behalf (a "processor" or "service provider"). If you're a visitor, the site's own privacy notice applies too, and its owner is the first place to go with questions. We'll help them answer.

What we collect

From customers and team members

• Account details: your name, email address and a hash of your password (never the password itself). If you sign in with Google, we receive your name, email address and Google account ID. If your organization uses single sign-on, we receive the details your identity provider sends, usually your name and email.
• Security settings: your two-factor secret, stored encrypted, and recovery codes, stored as hashes.
• Organization details: its name, members, roles and invitations.
• What you set up: projects, the addresses you monitor and how to check them, status pages, alert channels and their settings, such as webhook addresses.
• Billing details: your plan, billing contact and subscription status. Card details go straight to Stripe, our payment processor; we never see or store your full card number.
• Keys and apps: the names and scopes of your API keys and the apps you've approved, stored with only a one-way hash of each secret.
• Activity: a log of actions in your organization, such as who added a monitor or made a key, with the time and, for sign-ins and security events, the IP address and browser.
• Messages: what you send us through the contact form or by email.

From the sites we monitor

• Checks: for each address you add, whether it answered, its status code, how long it took, and whether an expected word was on the page. We check from our own servers; this doesn't involve your visitors.

From visitors, through the browser script

When a site adds our script, a visitor's browser sends us:

• Page views and speed: the page's path (never the query string), how long it took to load, and the referring site, counted together in five-minute totals.
• Errors: uncaught errors and the page's own failed requests. Email addresses are removed from error messages before they're stored.

The script sets no cookies, stores nothing on the visitor's device, and sends no identifier that follows a person from page to page or site to site.

From visitors, through session replay

Only if a site's owner turns it on, the script also records how a visit looks: the pages, clicks and scrolling, and the page's structure, so it can be played back to find a bug. What visitors type, passwords and email addresses are replaced with dots before anything leaves their browser. Site owners can hide more. We never record visitors whose browser sends Do Not Track or Global Privacy Control. If a site has chosen OpenReplay instead of our recorder, recordings go to OpenReplay under that site's own arrangement.

From reports and status pages

• Reports: when a visitor reports a problem, the category they choose, what they write, the page they were on, their browser, operating system and device type, the page's recent errors, a link to their replay if there is one, and their email address only if they give it.
• Counting reporters: to tell how many different people are reporting a problem without identifying anyone, we keep a keyed hash of the reporter's network address that changes every day.
• Status pages and "is it down?": we check the address requested and show the result. Like any website, our servers record basic request information to run and secure the Service.

From our own website

Our marketing site counts page views for our own use: the page's path, the referring site, and a count of visitors that can't identify anyone and resets every day. It uses no cookies and no advertising or third-party analytics trackers. If your browser sends Do Not Track or Global Privacy Control, we don't count the view at all.

Cookies

We use only the cookies the Service needs: a session cookie that keeps you signed in, and cookies that protect against cross-site attacks. Your browser may also store small preferences, such as light or dark mode. We don't use advertising cookies, and we don't track you across other sites.

How we use it

• To provide the Service: checking sites, finding slowdowns and error spikes, opening and resolving incidents, publishing status pages and showing your dashboard.
• To keep it secure: verifying sign-ins, enforcing rate limits and key scopes, refusing checks of private networks, and detecting misuse.
• To communicate: account and security emails, incident alerts, report notices, trial and billing notices, and replies to your messages.
• To bill you and keep the records the law requires.
• To meet legal obligations and enforce our terms of service.

Where privacy laws ask for a legal basis, we rely on performing our contract with you, our legitimate interest in running a secure and reliable service, your consent where we ask for it, and legal obligations. For visitors' data, the site's owner chooses the basis.

We don't sell or rent personal information, we don't use it for advertising, and we don't use anyone's data to train AI models.

Who we share it with

• The site's owner. A customer sees the page views, errors, reports and replays from their own sites, and the people they invite can too, according to their role.
• Alert channels you choose. When you connect email, a webhook, Slack, Discord, the Arcaro Labs hub, or a GitHub repository through Operate As, we send incidents and reports there. Email addresses are removed from reports sent to GitHub.
• Apps and agents you approve. Keys and apps you authorize can read your monitoring within the scopes you give them.
• Service providers that help us run the Service, under contracts that limit their use of the data to the work they do for us:
  • Google Cloud, for hosting, our database, file storage and secrets management
  • Stripe, for payments
  • Our email delivery provider, for sending email
  • Google, if you choose to sign in with Google
• Arcaro Labs' own operations system, which receives counts of events such as sign-ups and subscriptions (not who made them), error summaries, and our marketing site's page views, so we can run the company's products.
• When the law requires it, or to protect the rights, safety and security of our users, the public or us. We'll push back on requests that are too broad, and tell the people affected where we're allowed to.
• In a business change, such as a merger or sale, where the new owner keeps the protections in this policy.

How long we keep it

• Single checks: 30 days. Daily uptime totals: 400 days.
• Page view and speed totals: 90 days.
• Error groups: 30 days after the error was last seen.
• Reports: 180 days.
• Session replays: 30 days.
• Accounts: until you delete your account or your organization is deleted.
• Sessions: up to 30 days, or until you sign out.
• Notifications: 90 days.
• Activity log: 2 years, including after the organization it belongs to is deleted, so security incidents and disputes can still be looked into. Failed sign-ins and password reset requests, which record email and IP addresses, are kept for 30 days.
• Billing records: as long as tax and accounting law requires.

Deleted data may remain in encrypted backups for a limited time until they're replaced.

How we protect it

Traffic is encrypted in transit. Secrets such as two-factor keys are encrypted, and API keys, sessions and recovery codes are stored only as hashes. Our checks never reach private networks, so a monitor can't be used to reach systems behind a firewall. Replays are rebuilt in a sandbox that can't run anything a page contained.

No system is perfectly secure. If a breach affects your information, we'll tell you without undue delay, as the law requires.

Your choices and rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict how we use it, and to withdraw consent. You also have the right not to be treated differently for using these rights.

• Customers and members can update most details in the dashboard, delete their account, or delete their organization. For anything else, email us.
• Visitors can turn on Do Not Track or Global Privacy Control to never be recorded. For anything else about a site's data, ask its owner, or email us and we'll work with them.

We'll respond within the time the law requires, and may need to confirm your identity first. If you're in the EU, UK or another region with a data protection authority, you can also complain to it.

California residents

This section is for California residents, under the California Consumer Privacy Act as amended (CCPA). In the last 12 months we have collected these categories of personal information, for the purposes in "How we use it":

• Identifiers: name, email address, IP address, account identifiers.
• Customer records and commercial information: billing contact, plan and subscription history. Card details are collected by Stripe.
• Internet activity: sign-ins and actions in the dashboard; for customers' sites, page views, errors and, where turned on, session replays.
• Professional information: your organization and your role in it.
• Sensitive personal information: account sign-in credentials, used only to sign you in and keep your account secure.

We disclose these categories for business purposes only to the parties listed in "Who we share it with". We don't sell or share personal information for cross-context behavioral advertising, and haven't in the last 12 months. We don't use sensitive personal information for anything beyond what the CCPA allows, so the right to limit its use doesn't apply. We keep each category for the periods in "How long we keep it".

You may ask us to tell you what we collect, use and disclose about you; to delete it; and to correct it. You won't be treated differently for asking. To make a request, email us from the address on your account, or have an authorized agent email us with your written permission. We'll confirm your identity and answer within 45 days. If you're a visitor to a customer's site, we'll pass your request to the site's owner.

International transfers

We're based in the United States, and we and our service providers process information there and may process it in other countries. Where the law requires, we protect those transfers with safeguards such as the European Commission's Standard Contractual Clauses.

Children

The Service is for businesses and developers. It isn't directed to children, and we don't knowingly collect information from anyone under 16. If you think a child has given us information, contact us and we'll delete it.

Changes to this policy

If we change this policy in a way that matters, we'll tell customers by email or in the dashboard before it takes effect, and update the date at the top.

Contact

Questions, requests or concerns about privacy:

Arcaro Labs LLC
hello@itsopen.dev