Privacy Policy

Arri ("we", "us") operates the service at heyarri.com. For any privacy question or request, contact us at lucas@reachbob.com — we answer every message.

Account information. Your name, email address and sign-in provider, handled through Firebase Authentication when you create an account. Advertising data. When you connect Meta or Google Ads through their official consent screens, we sync the ad accounts you select: campaign, ad-set and ad names, statuses, budgets and targeting metadata, plus performance metrics (spend, impressions, clicks, conversions, revenue and derived figures such as ROAS). Access tokens. The OAuth tokens that let us read your ad data are stored encrypted in a managed secret vault. They are never exposed to your browser and never written to our application database. Product usage. Messages you send to the assistant, product analytics events (PostHog), and error diagnostics with limited session replays (Sentry). Tokens, passwords and other secrets are automatically scrubbed from error reports before they leave our servers. Billing. Payments are processed by Stripe. We store your subscription status and Stripe customer reference — never your full card details.

We use your data to render your performance dashboards, to generate AI analysis and recommendations, to apply the changes you explicitly approve in the product (and nothing else — we never modify your campaigns without your confirmation), to provide support, and to improve the product. AI processing: relevant ad-performance data is sent to large-language-model API providers (Anthropic and Google) to generate insights and recommendations. Under the API terms we rely on, this data is not used to train their models.

Under the GDPR (EU) and the LGPD (Brazil), we process your data on three bases: performance of a contract (running the service you signed up for), consent (connecting an ad platform is always an explicit OAuth grant you can revoke at any time), and legitimate interest (keeping the service secure and understanding how it is used).

We share data only with the processors that run the service: Google Cloud (hosting and storage), Firebase (authentication), Composio (OAuth connection management and API proxy), Anthropic and Google (AI processing), Stripe (payments), Sentry (error monitoring) and PostHog (product analytics). We never sell personal data. We never share your advertising data with other customers or advertisers.

Data obtained from the Meta Marketing API and the Google Ads API is used solely to provide the service described here, in accordance with Meta's Platform Terms and the Google API Services User Data Policy, including its Limited Use requirements. We do not use platform data for advertising of our own, and we do not transfer it to data brokers.

We keep your data while your account is active. Disconnecting an ad platform immediately deletes that platform's synced data — metrics, entities, insights and recommendations — and invalidates our stored token. Deleting your account removes everything; see our Data Deletion page (heyarri.com/data-deletion) for the exact steps. Deletion requests are completed within 30 days.

You can request access to the data we hold about you, correction, deletion, portability (a machine-readable export), restriction of processing, and you can withdraw consent at any time. Write to lucas@reachbob.com and we will act on the request within 30 days. You also have the right to lodge a complaint with your supervisory authority — in the EU, your national data-protection authority; in Brazil, the ANPD.

All traffic is encrypted in transit (TLS). Data is encrypted at rest. Access tokens and credentials live in a managed secret vault with least-privilege access, and error reports are automatically scrubbed of secrets before storage.

Primary processing and storage happen in the European Union (Google Cloud, Belgium). Some processors listed above operate in the United States; transfers to them rely on the EU–US Data Privacy Framework or standard contractual clauses.

Arri is a business tool and is not directed at anyone under 18. We do not knowingly collect data from minors.

If this policy changes, we will update this page and the date at the top. Material changes are announced in the product. Questions, requests, complaints: lucas@reachbob.com.