arveoPrivacy Policy
Effective Date: May 9, 2026
Last Updated: September 11, 2026
Controller: Arveo Inc.
Address: Boca Raton, Florida
Contact: privacy@arveo.ai
1. Introduction
Arveo Inc. ("Arveo," "we," "us," or "our"), a Delaware corporation, operates the Arveo AI bookkeeping and financial intelligence platform, accessible at https://arveo.ai (the "Platform"). This Privacy Policy explains what personal information we collect about you, how we use it, who we share it with, how long we keep it, and what rights you have over it.
By accessing or using the Platform, you agree to the terms of this Privacy Policy. If you do not agree, do not use the Platform.
If you are using the Platform on behalf of an employer or other organization (for example, as an employee of an accounting firm that subscribes to Arveo), your organization is the data controller for your use of the Platform, and you should also review your organization's own privacy policies.
2. Who We Are and Our Role
Arveo acts as a data controller with respect to information collected directly from visitors to our marketing website and from individual users who create accounts on the Platform.
Where Arveo processes personal data on behalf of a subscribing accounting firm or business customer (the "Controller"), Arveo acts as a data processor under the terms of a Data Processing Addendum. In those situations, the Controller's own privacy policy and the terms of the DPA govern the processing of that personal data.
For questions about this Privacy Policy, contact us at privacy@arveo.ai.
3. What We Collect
3.1 Information You Provide
| Category | Examples |
|---|---|
| Account registration data | Name, email address, firm name, password (hashed) |
| Profile and settings | Job title, notification preferences, scheduled briefing time |
| Payment information | Billing name, billing address, payment card details (processed and stored by Stripe — we do not store raw card numbers) |
| Communications | Content of emails or support messages you send to us |
3.2 Information from Third-Party Integrations
When you connect a third-party service to your Arveo account, we receive data from that service as authorized by you:
- QuickBooks Online (Intuit): Financial transaction records, account balances, merchant names, and other accounting data that you authorize Arveo to access via QuickBooks Online's OAuth API. The QuickBooks accounting OAuth scope supports both reading and writing. Enabled workflows can write approved changes back to QuickBooks. We store encrypted access and refresh tokens to maintain the connection.
- Plaid: When enabled, linked-account identifiers, account and transaction information, connection status, and encrypted access tokens.
- Messaging and connected applications: Enabled Slack, email, SMS/WhatsApp, voice, Pipedream, and ServiceTitan workflows can process message contents, attachments, contact details, financial context, and authorized integration data. Optional integrations only apply when configured.
The service is not designed to hold tax returns, SSNs, health records, or full payment-card data. Do not upload or send these categories. Financial documents may nevertheless contain personal information or account numbers; automated filtering is not a guarantee that such information is removed. Report an accidental submission to privacy@arveo.ai.
3.3 Information Collected Automatically
When you use the Platform or visit our website, we automatically collect:
| Category | Examples |
|---|---|
| Usage data | Pages visited, features used, clicks, session duration |
| Device and network data | IP address, browser type and version, operating system |
| Authentication events | Login timestamps, MFA events, session activity |
| Error and performance data | Crash reports and stack traces collected by Sentry (see Section 7) |
3.4 Cookies and Tracking Technologies
We use the following types of cookies and similar technologies:
- Strictly necessary cookies: Required for the Platform to function, including session authentication cookies managed by Supabase Auth. You cannot opt out of these while using the Platform.
- Preferences: Local browser storage may retain interface preferences, such as light or dark mode. Optional analytics must be disclosed and configured before activation.
- Advertising: The application does not require advertising cookies. A separate marketing deployment may have different disclosed tracking settings.
You can control cookies through your browser settings. Disabling strictly necessary cookies will prevent the Platform from functioning correctly.
4. How We Use Your Information
We process your personal information for the following purposes and on the following lawful bases:
| Purpose | Lawful Basis (GDPR) | CCPA Business Purpose |
|---|---|---|
| Providing the Platform: authentication, account management, data display, financial transaction sync | Contract performance | Performing services |
| Generating AI-powered financial summaries and daily briefings | Contract performance | Performing services |
| Sending transactional emails and SMS alerts | Contract performance | Performing services |
| Processing payments via Stripe | Contract performance / Legal obligation | Performing services |
| Monitoring platform security and detecting fraud | Legitimate interests (security) | Security / fraud detection |
| Error monitoring and performance optimization via Sentry | Legitimate interests (improvement of service) | Debugging / quality assurance |
| Responding to support requests | Contract performance / Legitimate interests | Performing services |
| Complying with legal obligations (e.g., tax, financial recordkeeping) | Legal obligation | Legal obligation |
| Maintaining audit logs for SOC 2 and regulatory compliance purposes | Legitimate interests (compliance) | Internal research and compliance |
We do not use your personal information for automated decision-making that produces legal or similarly significant effects on you without human review.
5. Financial Data
Arveo is a workflow layer connected to your accounting system. It retrieves and processes accounting records, supports document extraction, reconciliation preparation, categorization, reports, and approved accounting writes. QuickBooks remains the source accounting system.
AI requests may include transaction details, vendor/customer names, chat content, selected client knowledge, and complete uploaded PDFs or images needed for a requested task. Documents can contain account numbers or other personal information. Credentials should not be placed in chat or documents. Customer-derived promotion into shared industry/global knowledge is disabled.
We do not sell or rent financial records. AI providers process enabled inference requests under the applicable service agreement; their retention, regional processing, and training terms must be confirmed for the account and configuration in use. This notice does not promise zero retention or that every document has been anonymized.
6. Who We Share Your Information With
We share personal information only in the following circumstances:
6.1 Subprocessors
We use third-party service providers to deliver the Platform. Provider access, processing terms, and data-protection agreements must be verified before customer onboarding. Our provider register is at https://arveo.ai/legal/subprocessors.
See the subprocessor register for core providers, optional integrations, and the data categories involved. Availability in a country does not imply storage or processing exclusively in that country.
6.2 Legal Requirements
We may disclose personal information to government authorities, courts, or regulators if we have a good-faith belief that disclosure is required by applicable law, regulation, or legal process.
6.3 Business Transfers
If Arveo Inc. is acquired by or merges with another entity, your personal information may be transferred to the successor entity. We will notify you via email or prominent notice on the Platform before such a transfer takes effect, and provide you with an opportunity to delete your account if you do not wish to continue.
6.4 With Your Consent
We share information with other parties only with your explicit consent.
6.5 What We Do Not Do
We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not disclose customer financial records to any party not listed in this policy or the DPA.
7. Error Monitoring and Sentry
The application limits Sentry error reports to a small allowlisted technical envelope and omits request bodies, headers, URLs, user information, exception text, and arbitrary context. Session replay and performance tracing are disabled in the application configuration. Hosting and provider logs are separate systems with separate access and retention controls. Contact privacy@arveo.ai regarding an error-reporting concern.
8. Data Retention
We retain personal information for as long as necessary to provide the Platform and fulfill the purposes described in this Policy, and as required by applicable law.
| Data Category | Retention Period |
|---|---|
| Account data (name, email, profile) | During the account; deletion requests require identity verification and review of applicable retention obligations |
| Financial transaction data (from QBO sync) | For the duration of the subscription plus 90 days following account termination |
| Encrypted QBO/Plaid tokens | Scheduled cleanup becomes eligible after 24 hours following disconnection or recorded termination; processing time depends on the job schedule and successful completion. Other integration credentials require provider-specific revocation |
| Audit log entries (security events, role changes) | 3 years from the date of the event |
| Provider telemetry and backups | Subject to the provider's configured retention; ask for the applicable deployment schedule |
| Payment and business records | Held in Stripe and related business systems for applicable legal/accounting obligations |
| Support communications | 3 years |
Application file deletion is queued separately from database cleanup and retried if unavailable. Backups, provider copies, and legal holds may follow different schedules; a database deletion alone does not establish completion in every system.
9. Data Security
We maintain technical and organizational measures appropriate to the risk of processing, including:
- HTTPS/TLS for application connections
- AES-256-GCM application-layer encryption for stored integration secrets, with versioned keys
- Session-bound multi-factor authentication for production financial access
- Role, assignment, and tenant checks in application code and database policies
- Security testing and remediation before customer onboarding
SOC 2 readiness is a requirement, not a completed attestation. Arveo does not claim a completed SOC 2 Type I or Type II report here. Infrastructure encryption, backup recovery, vendor contracts, and operating effectiveness must also be verified for the deployed service.
Contact security@arveo.ai for available security documentation and current assurance evidence.
No security measure is perfect. In the event of a data breach affecting your personal information, we will notify you as required by applicable law and in accordance with our Incident Response Plan.
10. Your Rights
10.1 Rights Under GDPR (EU/UK Residents)
If you are located in the European Economic Area or the United Kingdom, you have the following rights with respect to personal data for which Arveo is the controller:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Request correction of inaccurate or incomplete personal data.
- Erasure: Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
- Restriction: Request that we restrict processing of your personal data in certain circumstances.
- Portability: Receive your personal data in a structured, commonly used, machine-readable format.
- Objection: Object to processing based on legitimate interests, including profiling.
- Withdraw Consent: Where processing is based on consent, withdraw consent at any time without affecting the lawfulness of prior processing.
To exercise these rights, contact privacy@arveo.ai. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.
10.2 Rights Under CCPA/CPRA (California Residents)
If you are a California resident, you have the following rights:
- Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we share it.
- Delete: Request deletion of personal information we have collected about you, subject to certain exceptions.
- Correct: Request correction of inaccurate personal information.
- Opt Out of Sale or Sharing: We do not sell personal information and do not share it for cross-context behavioral advertising. No opt-out is required, but you may contact us to confirm this.
- Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes other than those permitted under CPRA.
- Non-Discrimination: We will not discriminate against you for exercising any of these rights.
To submit a CCPA request, contact privacy@arveo.ai with the subject line "California Privacy Request."
We will verify your identity before processing rights requests by confirming the email address associated with your Arveo account.
11. Children's Privacy
The Platform is intended for use by business professionals and accounting firms. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that we have collected personal information from a minor, we will delete it promptly.
12. Links to Third-Party Sites
The Platform and our emails may contain links to third-party websites, including QuickBooks Online, Stripe, and others. This Privacy Policy does not apply to those websites. We encourage you to review the privacy policies of any third-party services you connect to through Arveo.
13. International Transfers
Arveo is based in the United States and serves business customers, including customers in the USA and India. Hosting, inference, messaging, support, and other providers may process data in the United States and other countries. We do not promise India-only, US-only, or EU-only residency without an agreed and verified deployment arrangement. Applicable transfer terms, local requirements, and customer instructions should be addressed in the DPA before onboarding.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will notify you by email (to the address associated with your Arveo account) and by posting a prominent notice on the Platform at least 30 days before the changes take effect. Your continued use of the Platform after the effective date of the updated policy constitutes acceptance of the updated terms.
15. Contact Us
For privacy inquiries, data rights requests, or DPA requests:
Email: privacy@arveo.ai
Mail: Arveo Inc., Attn: Privacy, Boca Raton, FL
We will acknowledge receipt of all privacy requests within 5 business days.
Privacy Policy — Arveo Inc. — Prelaunch revision 1.2 — September 11, 2026