Privacy Policy

This privacy notice for Arbuun, operated by Muskan Priyadarshni, an individual based in New Delhi, India (“Arbuun,” “we,” “us,” or “our”), describes how and why we may collect, store, use, and/or share (“process”) your information when you:

• Visit our website at https://arbun.space, or any website of ours that links to this privacy notice
• Join our waitlist, create an account, or use Potpourri, Watchtower, Litmus, Compass, or any other Arbuun product
• Engage with us in other related ways, including sales, support, or events

Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have questions, contact us at team@arbun.space.

SUMMARY OF KEY POINTS

What personal information do we process?

When you visit, use, or navigate our Services, we may process personal information depending on how you interact with Arbuun, the choices you make, and the products and features you use, for example, your name, email address, job title, and organization when you join our waitlist or register an account.

Do we process any sensitive personal information?

We do not intentionally collect sensitive personal information about you. Project, tender, or site data you submit through the Services relates to places and projects, not to your personal characteristics.

Do we receive any information from third parties?

Generally, no. Where you choose to sign in through a third-party provider (such as Google), we receive the limited profile information described in Section 9 below.

How do we process your information?

We process your information to provide, improve, and administer the Services, communicate with you, generate the analysis features within the Services, maintain security, and comply with law. We process your information only when we have a valid legal basis to do so.

In what situations and with which parties do we share personal information?

We may share information with the service providers that host, run, and support Arbuun (such as our authentication, database, email, analytics, and AI-processing providers), and in other specific situations described in Section 7 below.

What are your rights?

Depending on where you are located, applicable data protection law, including India's Digital Personal Data Protection Act, 2023, may give you rights over your personal information, such as access, correction, and erasure.

How do you exercise your rights?

The easiest way is to contact us at team@arbun.space. We will consider and act on any request in accordance with applicable law.

1. PERSONAL INFORMATION YOU DISCLOSE TO US

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you join our waitlist, register for an account, express interest in Arbuun or our products, submit project or tender data through the Services, or otherwise contact us.

Personal information you provide. The personal information we collect depends on the context of your interaction with us and may include:

• Name
• Email address
• Job title and occupation (e.g., architect, planner, developer, government official)
• Organization or firm name
• Username and password (where you create an account)
• Contact preferences and any information you include in messages to us
• Project, tender, or site-related data you choose to submit through Potpourri, Watchtower, or related products

All personal information you provide to us must be true, complete, and accurate, and you must notify us of any changes.

2. SENSITIVE INFORMATION

In Short: We do not process sensitive personal information.

We do not ask you to provide, and ask that you do not submit to us, sensitive personal data (such as data revealing racial or ethnic origin, health, biometric or genetic data, religious beliefs, or similar categories) through the Services. Where you register or sign in using a third-party provider, see Section 9 (“How Do We Handle Your Logins?”) below for the limited information we receive.

3. INFORMATION AUTOMATICALLY COLLECTED

In Short: Some information, such as your IP address and browser and device characteristics, is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not by itself reveal your specific identity, but may include device and usage information such as your IP address, browser and device characteristics, operating system, language preference, referring URLs, approximate location, and information about how you use the Services. We collect this primarily to maintain the security and reliability of the Services and for internal analytics.

Log and Usage Data. Service-related, diagnostic, and performance information our servers and analytics tools (including PostHog) automatically record, such as pages viewed, features used, searches run, and timestamps of activity.

Device Data. Information about the computer, phone, or tablet you use to access the Services, such as IP address, browser type, operating system, and general hardware configuration.

Location Data. Where you use map-based features of the Services, we may process approximate location information (such as a city or project site you search for) to display relevant data on the map. We do not collect precise device GPS location unless you separately provide it, for example by entering a project address.

4. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, maintain security, and comply with law.

We process your personal information for reasons including:

• To create and administer your waitlist entry or account, and to authenticate you when you sign in.
• To provide, operate, and improve the Services, including the Projects Database, Tender Tracking, Pre-Design Analysis, and Regulations Hub features as they become available.
• To respond to your inquiries and provide support.
• To send you service updates, including changes to these Legal Terms, this notice, or the availability of new features.
• To generate AI-assisted analysis (for example, through our use of Google's Gemini API) where you use features that rely on it.
• To maintain the security of the Services and prevent fraud or misuse.
• To comply with our legal obligations.

5. WHERE IS YOUR INFORMATION PROCESSED?

Arbuun is based in New Delhi, India, and our primary users are professionals working on projects in India. We use third-party infrastructure and service providers to operate the Services, including hosting (Vercel), authentication (Clerk), database and storage (Supabase, Cloudinary), email delivery (Resend), analytics (PostHog), and AI-assisted analysis (Google's Gemini API / Google AI Studio). These providers may process or store information on servers located outside India, including in the United States or the European Union.

Where your information is transferred outside India, we take reasonable steps to ensure it continues to be protected consistent with this notice and applicable law, including India's Digital Personal Data Protection Act, 2023 (“DPDPA”).

6. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In Short: We process your personal information only where we have a valid legal basis to do so under applicable Indian law.

Under the DPDPA and related Indian law, we generally rely on the following bases:

• Your consent - for example, when you join our waitlist, register an account, or opt in to communications. You may withdraw consent at any time by contacting us.
• Performance of a contract - to provide the Services you have requested, such as your account or a subscription.
• Legitimate and specified purposes - such as responding to your inquiries, maintaining security, and preventing fraud.
• Legal obligations - where we must process information to comply with applicable law or a lawful request from a public authority.

If you are located outside India and a different data protection law applies to you (for example, the GDPR in the EEA/UK), we will also rely on an appropriate legal basis under that law, such as consent, contract, or legitimate interest, and you may have additional rights under that law.

7. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information with the service providers who help us run Arbuun, and in the specific situations described below.

We may share your information in the following situations:

• Service providers. We share information with the vendors that host and operate the Services on our behalf, including Vercel (hosting), Clerk (authentication), Supabase (database), Cloudinary (media storage), Resend (transactional email), and PostHog (product analytics). These providers are only permitted to use your information to provide services to us.
• AI-assisted features. Where you use a feature that relies on AI-assisted analysis, relevant inputs (such as project or site parameters) may be shared with Google's Gemini API to generate the output. We do not knowingly send sensitive personal information to this or any AI provider.
• Business transfers. We may share or transfer your information in connection with a merger, financing, acquisition, or sale of all or part of our business.
• Legal compliance. We may disclose your information where required to comply with applicable law, regulation, legal process, or a lawful request from a government or regulatory authority.
• With your direction. We may share information with other parties where you have directed us to do so, for example if you choose to make certain project data visible to other users of the Projects Database.

8. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and similar technologies to operate the Services and understand how they are used.

We use cookies and similar technologies (such as those used by our authentication provider, Clerk, and our analytics provider, PostHog) to keep you signed in, remember your preferences, and understand how the Services are used so we can improve them. You can control cookies through your browser settings; disabling certain cookies may affect your ability to use parts of the Services, such as staying signed in.

9. HOW DO WE HANDLE YOUR LOGINS?

In Short: If you choose to register or sign in using a third-party provider, we receive limited profile information about you.

Where we offer the option to register or sign in using a third-party provider (such as Google) through our authentication provider, Clerk, we receive certain profile information from that provider, typically your name, email address, and profile picture. We use this information only for the purposes described in this notice. We do not control, and are not responsible for, how the third-party provider itself handles your information; please review that provider's own privacy notice.

10. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information only as long as necessary for the purposes set out in this notice, unless a longer period is required by law.

We retain your personal information for as long as your account or waitlist entry is active, or as needed to provide you the Services. When we no longer have an ongoing legitimate need to process your information, we will delete or anonymize it, or, where that is not immediately possible (for example, because it is held in backups), we will securely isolate it from further processing until deletion is possible.

11. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from, or market the Services to, individuals under 18 years of age.

The Services are intended for working professionals and are not directed at children. We do not knowingly collect personal information from anyone under 18. By using the Services, you represent that you are at least 18 years old. If we learn that we have collected personal information from someone under 18, we will take reasonable steps to delete that information. If you believe we may have collected information from a minor, please contact us at team@arbun.space.

12. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on where you are located, you have rights to access, correct, and request erasure of your personal information.

As a data principal under India's Digital Personal Data Protection Act, 2023, you have the right to: (a) obtain a summary of the personal information we hold about you and the processing activities carried out; (b) request correction, completion, or updating of your personal information; (c) request erasure of your personal information that is no longer necessary for the purpose it was collected, subject to our legal retention obligations; and (d) withdraw consent at any time where we rely on your consent, and to have grievances addressed through our Grievance Officer (see Section 18).

If you are located in the EEA, UK, or another jurisdiction with its own data protection law, you may have additional or different rights under that law (such as data portability or the right to lodge a complaint with your local supervisory authority); we will honor those rights to the extent that law applies to our processing of your information.

Account information. You can review or update your account details directly within the Services, or by contacting us. Upon your request to close your account, we will deactivate or delete it from our active systems, though we may retain limited information where necessary to comply with law, resolve disputes, or enforce our agreements.

Marketing communications. You can opt out of marketing emails at any time using the unsubscribe link in the email or by contacting team@arbun.space. We may still send you service-related messages necessary to administer your account.

13. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers include a Do-Not-Track (“DNT”) feature you can activate to signal that you do not want your online activities tracked. Because no uniform standard for recognizing DNT signals currently exists, we do not currently respond to DNT signals. If a standard is adopted that we must follow, we will describe our practice in a revised version of this notice.

14. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with applicable law.

We may update this privacy notice from time to time. The updated version will be indicated by a revised “Last Updated” date, and the updated version becomes effective as soon as it is posted. If we make a material change, we will take reasonable steps to notify you, such as posting a notice on the Site or emailing you. We encourage you to review this notice periodically.

15. GRIEVANCE OFFICER

In accordance with applicable Indian law, including the Information Technology Act, 2000 and rules made thereunder, the following person serves as our Grievance Officer for privacy-related complaints:
Muskan Priyadarshni
Arbuun, New Delhi, India
Email: team@arbun.space

We will acknowledge and address grievances submitted to the Grievance Officer in accordance with applicable law and within the timelines it prescribes.

16. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may contact us at:
Arbuun
Operated by Muskan Priyadarshni
New Delhi, India
Email: team@arbun.space

17. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

You have the right to request access to the personal information we hold about you, request that we correct it, or request that we delete it. To make such a request, please email team@arbun.space with the details of your request. We will respond in accordance with applicable law.