1. Scope and Introduction

The Arbinger Institute, LLC, d/b/a The Arbinger Company (“Arbinger,” “we,” “us,” “our”) is committed to protecting your personal data and complying with applicable data protection laws. This Privacy Policy (“Policy”) describes how we collect, use, disclose, and safeguard personal data in connection with our website (www.arbinger.com), our portal and online resources, the Outward App, and all related applications and services (collectively, the “Services”).

This Policy applies to all users of our Services, including commercial clients, organizational administrators, individual end users, and free trial participants. A single, unified policy governs both the Arbinger website and the Arbinger portal.

 

2. Information We Collect

2.1 Information You Provide

• Account and profile information: name, email address, username, organization name, and communication preferences.
• Order and billing information: contact details, billing address, and transaction history. Payment card details are processed directly by our payment processors and are not stored by Arbinger.
• Support and communications: messages, feedback, and content you send to us.
• Content you submit: text or other content you provide when using the Services, including when interacting with AI-enabled features.

2.2 Information We Collect Automatically

• Usage and device information: activity logs, IP address, browser type, device and operating system details, and session information.
• Authentication information: login events and administrative actions used to secure the Services.
• Cookie and tracking information: see Section 9 (Cookies and Tracking Technologies).

2.3 Information From Identity Providers
When you choose to sign in using a supported third-party identity provider, that provider shares your first name, last name, and email address with Arbinger solely for the purpose of creating or linking your account. Additional profile information that may be available through your identity provider is not requested or stored by Arbinger. We do not receive your identity provider password. Your use of a third-party identity provider is also subject to that provider’s own terms of service and privacy policy.

 

3. How We Use Your Information

• Provide and operate the Services, including account creation, authentication, license assignment, and access management.
• Deliver AI-enabled features, including Theo.
• Process orders, payments, and fulfill contractual obligations.
• Send transactional communications, including account setup emails, license assignment notifications, renewal reminders, product update notices, and service notifications. These are a necessary part of service delivery.
• Send marketing communications to users who have opted in. You may opt out at any time (see Section 10).
• Secure and maintain the Services, including fraud prevention and compliance monitoring.
• Comply with legal obligations and enforce our agreements.
• Improve the Services using aggregated or de-identified data where possible.

 

4. Authentication and Single Sign-On

You may authenticate using an Arbinger account with email and password, or through a supported third-party identity provider. When you use a third-party identity provider, we receive only your first name, last name, and email address for account creation and authentication purposes. We deliberately limit what we request from identity providers to this minimum set.

Users who sign in using email and password are subject to two-factor authentication (2FA) for account security. Enterprise clients may configure single sign-on (SSO) integration using SAML 2.0.

 

5. AI-Enabled Features

5.1 How We Process Your Data
Arbinger’s AI-enabled coaching features, including Theo, are powered by an enterprise AI infrastructure provider under a data processing agreement. That agreement prohibits the use of your data to train AI models. Your data is encrypted in transit and at rest. AI features do not share data between users or between separate conversation sessions. Each conversation is independent and Theo does not retain memory across sessions.

5.2 Model Training
Your inputs and outputs when using AI-enabled features are not used to train generalized AI foundation models by Arbinger or its infrastructure providers.

5.3 Data Retention for AI Features
Data generated through AI-enabled features is processed and stored within our enterprise cloud infrastructure pursuant to our data processing agreements with our providers. Data deletion is managed in accordance with those agreements. Please contact us at legal@arbinger.com for information about data retention applicable to your account.

5.4 Scope of AI Features
AI-enabled features are commercial offerings only. They are not authorized for use in connection with federal government contracts or for the processing of classified, controlled unclassified, or otherwise regulated government data.

 

6. How We Share Your Information

We do not sell your personal data. We share personal data only in the following circumstances:

6.1 Service Providers
We share personal data with third-party service providers that perform services on our behalf, including cloud infrastructure and hosting, AI processing, marketing communications, email delivery, customer relationship management, payment processing, and accounting. These providers are bound by contractual obligations of confidentiality, security, and data use limitations. A current list of our service providers is available at arbinger.com/sub-processors.

6.2 Legal and Safety Disclosures
We may disclose personal data to comply with applicable law, respond to legal process, protect the rights and safety of Arbinger and others, or as part of a corporate transaction such as a merger or acquisition.

6.3 Organizational Administrators
If you access the Services through a license assigned by your organization, your organization’s designated administrator can view license assignment status and account-level usage information. Your organization has agreed to handle this data in accordance with Arbinger’s Terms of Service and applicable law.

 

7. International Data Transfers

Arbinger is based in the United States. If you are located outside the United States, your personal data may be transferred to and processed in the United States. Where data is transferred internationally, we implement appropriate safeguards as required by applicable law, including standard contractual clauses or other lawful transfer mechanisms, together with technical and organizational measures including encryption and access controls.

 

8. Security

We apply physical, technical, and organizational security measures appropriate to the risk, including encryption of data in transit and at rest, multi-factor authentication, role-based access control, and audit logging. Arbinger maintains SOC 2 compliance. Detailed security documentation is available upon request.

In the event of a data breach affecting your personal data, Arbinger will notify you as promptly as practicable and in accordance with applicable legal requirements.

 

9. Data Retention

9.1 General Retention
We retain personal data for as long as necessary to provide the Services, fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Active account data is retained for the duration of your subscription and for a period of three (3) years following account expiration or termination, after which it is archived.

9.2 Trial User Data
If you access the Services through a free trial, your in-app data will be deleted by the end of the calendar month following the expiration of your trial. Contact information you provided when registering for the trial may be retained for sales and marketing communications in accordance with this Policy. You may request deletion of your contact information at any time using the unsubscribe link in any Arbinger email or by contacting us directly.

9.3 AI Feature Data
Data generated through AI-enabled features is retained in accordance with Arbinger’s agreements with its infrastructure providers. Please contact legal@arbinger.com for information specific to your account.

 

10. Cookies and Tracking Technologies

10.1 Cookie Consent
A cookie consent banner is presented at the start of each session on arbinger.com. Non-essential cookies are not activated until you accept them. You may decline non-essential cookies, in which case only strictly necessary cookies will be used.

10.2 Categories of Cookies

• Necessary: Required for the website to function. Always active.
• Analytics: Used to understand how visitors interact with the website. Activated only upon consent.
• Marketing: Used to track engagement with Arbinger content and support marketing activities. Activated only upon consent.
  
  

11. Marketing Communications and Your Choices

11.1 Marketing Consent
By submitting a form on arbinger.com, including trial registration and contact forms, you consent to receive marketing and sales communications from Arbinger. This consent applies until you opt out.

11.2 Opting Out
You may opt out of marketing communications at any time by using the unsubscribe link in any Arbinger marketing email, or by contacting us at info@arbinger.com or (801) 447-9244.

11.3 Transactional Communications
Arbinger sends transactional emails as a necessary part of operating the Services, including account setup, license assignment, renewal reminders, and billing confirmations. You cannot opt out of transactional communications while your account is active.

 

12. Your Privacy Rights

Depending on your location, you may have rights with respect to your personal data, including the right to access, correct, delete, or obtain a portable copy of your data, the right to restrict or object to certain processing, and the right to withdraw consent where processing is based on consent. To exercise any of these rights, please contact us at legal@arbinger.com. We will respond within the timeframe required by applicable law.

 

13. GDPR, CCPA, and Other Jurisdictions

13.1 Role of Arbinger
For our website, portal, and direct commercial client relationships, Arbinger acts as a data controller. Where Arbinger provides enterprise services to an organization and processes personal data on that organization’s behalf, Arbinger acts as a data processor and will enter into a Data Processing Agreement with that organization upon request.

13.2 California Residents
California residents have additional rights under applicable California privacy law, including the right to know what personal information we collect, the right to delete personal information, the right to correct inaccurate information, and the right to opt out of the sale or sharing of personal information. Arbinger does not sell your personal information. To exercise your California privacy rights, contact us at legal@arbinger.com.

13.3 Other Jurisdictions
Residents of other jurisdictions, including EEA, UK, and Canadian provinces, may have additional rights under applicable local law. Please contact us at legal@arbinger.com for jurisdiction-specific information.

 

14. Children’s Privacy

The Services are not directed to children under 16. We do not knowingly collect personal data from children under 16 without appropriate parental or guardian consent. If you believe we have collected personal data from a child under 16 without appropriate consent, please contact us at legal@arbinger.com.

 

15. Links to Third-Party Sites

The Services may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties and encourage you to review their privacy policies.

 

16. Changes to This Policy

We may update this Policy from time to time. When we do, we will post the updated Policy at arbinger.com/privacy-policy and update the “Last Updated” date above. Where required by law or where changes materially affect your rights, we will provide additional notice.

 

17. Contact Us

The Arbinger Institute, LLC
686 N Arbinger Way, Suite 200
Farmington, UT 84025, United States

legal@arbinger.com | (801) 447-9244
www.arbinger.com