Privacy Policy

Last updated: 2 November 2026

Who this covers

Arrowly is run by Brayan Smith Pineda Duarte. We decide how your account data is used. When a guide runs inside a customer's app, we process that app's data on the customer's behalf, under the Data Processing Addendum. If you are a user of such an app, the company behind it is your first contact.

This website

This site sets no cookies and runs no tracking or analytics scripts. Cloudflare serves it and handles the technical data needed to deliver and protect it, such as IP addresses.

Customer accounts

When a company signs up, we keep:

• your email address and company name;
• the allowed websites and settings you choose;
• the help docs you import, paste or upload;
• your credit balance and a record of credit use and guides.

The dashboard at app.arrowly.dev uses a sign-in cookie to keep you signed in. Paddle handles your payment details. We receive order details from Paddle, not your card number.

When a guide runs

• Snapshots, the guide's text reading of a page, never carry input values, password content or query strings, or anything under [data-guide-ignore].
• The API logs metadata only, such as tenant, guide id, step kind, tokens, cost and latency, with request status and error codes. It never logs snapshots or goals.
• The model provider, Anthropic, receives page structure and labels and the user's goal, together with the company's product name and description, its help docs, the steps of the guide so far and the browser's language.
• Page structure means the page address without its query string, the title, visible headings, the open dialog's label, status messages, and each control's role, state, visible name, placeholder, options and context.
• Context is the text that tells a control apart from similar ones: its section heading, field group, dialog, or the first cell of its table row.
• The steps of the guide so far include each sign and question shown, the user's choices and free-text answers, which controls they used, and the page addresses, without query strings.
• A user's goal and free-text answers are sent as they were typed, so they hold whatever the user chooses to write.
• Labels, headings, status messages and context can contain personal data shown on the page, such as a customer's name on a button or in a table row. Marking those areas with data-guide-ignore keeps them out.

Cloudflare handles IP addresses to serve every request, and the user's IP address is also used to rate limit requests. It is not included in the application logs written by Arrowly. The guide keeps its progress in the browser's sessionStorage, so it can continue after a page load. That storage stays on the user's device and ends with the browser tab.

Who processes data for us

• Paddle sells your order as merchant of record and handles payment and tax.
• Cloudflare hosts this site, the API, the dashboard and stored data.
• Anthropic provides the AI model that decides each step.
• Resend sends sign-in emails.

These companies can process data in countries other than yours. We do not sell personal data or use it for advertising.

How long we keep it

• Account and billing records: while the account is open and up to 12 months after it closes, or longer where the law requires it.
• Imported help docs: until the customer replaces or deletes them, and deleted within 30 days after the account closes.
• Request metadata logs: up to 30 days.

Your rights

Depending on where you live, you can ask to see, correct, delete or move your personal data, or object to how it is used, and you can complain to your data protection authority. Write to support@arrowly.dev.

Changes

We will update the date on this page when it changes, and tell customers by email about changes that matter to them.