Privacy Policy

Last updated: 10 August 2026

This policy explains what information we collect when you use the hosted Arbr AI Gateway at app.projectarbr.com (the "Service"), and what we do with it. Arbr is run by DAI Labs Private Limited ("we", "us"). It does not cover the open-source Arbr software you can run yourself, since when you self-host, none of your data reaches us.

1. What we collect

• Your account details. When you sign in with Google or GitHub, we receive your name and verified email so we can create and recognise your account.
• Your session. A server-side session tied to a secure, httpOnly cookie. We never see or store your Google or GitHub password.
• Your provider keys (BYOK). The LLM provider API keys you add are stored encrypted in your own database and used only to send your requests to the providers you pick. We never use them for anything else, and never for another customer.
• Usage data. Records of your gateway activity, such as the time, model, token counts, cost, latency, status, and any label you attach. This is what powers your analytics, budgets, and plan limits. We store the actual content of requests and responses only if you turn on payload capture in your own settings.
• Payment details. Payments run through Razorpay. We keep your plan and your Razorpay subscription and customer IDs. We do not store your card or bank details; Razorpay handles those.

2. How we use it

We use your information to run and secure the Service, route your requests to the providers you choose, show you your usage and enforce your plan limits, process your subscription, prevent abuse, answer your questions, and meet our legal and tax obligations.

3. Your data stays yours, and separate

Arbr gives every account its own database. Your settings, provider keys, API keys, and request records live in a database that belongs only to you, and requests are never served across accounts.

4. Who we share it with

We share the least we can with the companies that help us run the Service, and only under confidentiality terms:

We do not sell your personal information.

5. How long we keep it

We keep your usage records for as long as the retention period you set in your instance. We keep account and billing records while your account is active, and after that only as long as we need to for the reasons above or to meet the law. When you delete your account, we remove your database.

6. Keeping it safe

We use standard protections, including encryption in transit, encryption of your provider keys at rest, a separate database per account, and access controls. No system is perfectly secure, but we work hard to protect your information.

7. Your rights

Depending on where you live, you may have the right to see, correct, export, limit, object to, or delete your personal data, including under the EU GDPR and the California CCPA, and to not be treated differently for using those rights. To make a request, just email team@projectarbr.org.

8. Children

The Service is not meant for children under 16, and we do not knowingly collect their information. If you think a child has given us data, please contact us and we will delete it.

9. Changes

We may update this policy now and then. The "Last updated" date at the top shows the latest version, and we will flag any big changes inside the Service.