Privacy Policy

2.1 Information You Provide

• Account information — name, business email, employer, role, password (managed by our identity provider, currently Clerk; password material is not stored by GenArk in plaintext), and account preferences;
• Billing information — billing contact, billing address, tax identifiers, and payment-instrument details (processed and stored by our payment processor; GenArk does not store full payment-card numbers);
• Customer Content — prompts, files, documents, source code, configurations, embeddings, agent specifications, policy bindings, and other content you submit to the Platform;
• Communications — messages you send through our contact form, demo-request flow, email, chat, support tickets, calls, or other channels;
• Survey, event, and marketing responses — when you opt in to research, events, or marketing programs.

2.2 Information Generated Through Your Use

• Usage data — pages visited, features used, projects created, agent runs initiated, models selected, policies configured, queries issued, files uploaded, and other interactions with the Platform;
• Device and technical data — IP address, browser type and version, operating system, device identifiers, language preference, time zone, and referring URL;
• Cookies and similar technologies — see Section 7;
• Telemetry from the Platform — agent run timing, error rates, performance metrics, latency, throughput, and resource consumption, used to operate and improve the Platform;
• Governance and audit logs — records of policy decisions (preflight and postflight), redactions applied, restricted-content blocks, and human-approval actions, stored in an append-only, hash-chained audit table for tamper evidence.

2.3 Information from Third Parties

• Identity provider data — when you sign in using single sign-on or social login, we receive the profile fields you authorize the provider to share;
• Enrichment data — for business contacts, we may receive business-card-style information (name, role, employer, business email) from data-enrichment providers or from referrals;
• Connector and integration data — when Customer authorizes a connector (for example, SharePoint, Google Drive, Amazon S3, Notion, Confluence) or an External Agent, we receive the data permitted by Customer's authorization scope, processed under the access controls Customer configures.

2.4 Sensitive Categories of Information

GenArk does not seek to collect sensitive categories of personal information (such as government identifiers, financial-account numbers, biometric identifiers, health information, precise geolocation, racial or ethnic origin, religious beliefs, or sexual orientation) in connection with our own controller-relationship with users. Customers may, however, submit such information as Customer Content where their Plan and contractual configuration permit (for example, Protected Health Information may be submitted only by Customers with an executed Business Associate Agreement and an appropriately configured Workspace).

4.1 The Path of a Prompt

When an Authorized User submits a prompt to a Model or runs an Agent, the prompt and any attached context are: (a) routed through GenArk's governance plane, where preflight policy checks are applied (PII redaction, restricted-concept blocking, model/region whitelisting, residency checks); (b) transmitted to the selected Model provider (or, for BYOK, to the provider using Customer's credentials); (c) returned to GenArk, where postflight policy checks are applied (output redaction, human-approval gating); and (d) made available to the Authorized User and persisted to the Workspace as a transcript and (if approved) artifact.

4.2 What Is Persisted

We persist prompts, generated outputs, agent run metadata, transcripts, artifacts, and audit-log entries within the Customer's Workspace. The retention period, scope, and visibility are governed by Customer's configuration (including project membership, scope levels, and any redaction or human-approval policies in effect).

4.3 What Is Shared with Third-Party Model Providers

When a prompt is routed to a third-party Model provider, that provider receives whatever content remains after preflight redaction and policy enforcement. The provider processes the prompt under its own terms and privacy practices. GenArk's standard configuration uses Model providers' enterprise or zero-retention tiers where available. Customers who require additional restrictions may configure model whitelisting, region restrictions, or BYOK.

4.4 Embeddings, Knowledge Bases, and Connectors

When Customer ingests documents through Atlas connectors or direct upload, GenArk processes the content into chunks and vector embeddings. Embeddings are stored in the Customer's tenant-isolated database (currently PostgreSQL with pgvector) and used for retrieval at prompt time. Customer is responsible for configuring ACL handling, scope, and retention.

4.5 Training, Improvement, and Aggregation

GenArk uses aggregated, anonymized, or de-identified information about Platform usage to monitor service quality and develop new features. We do not use identifiable Customer Content for these purposes without consent, and we do not transmit identifiable Customer Content to third parties for training or model-improvement purposes. GenArk does not develop or train its own foundation models.

4.6 Inherent Limitations of AI Outputs

Outputs are predictions, not facts. They may contain errors, fabrications, or biases, and they may vary across runs. We do not warrant the accuracy, completeness, or fitness for purpose of any Output. You should not rely on any Output for medical, legal, financial, or other regulated professional decisions without independent human review.

8.1 Service Providers and Subprocessors

We engage third-party service providers and subprocessors to support our operations, including:

• Cloud infrastructure providers (Amazon Web Services, Microsoft Azure, Google Cloud) for hosting and platform infrastructure;
• Identity and authentication providers (currently Clerk) for sign-in, multi-factor authentication, and user management;
• Database and storage providers (PostgreSQL hosting, MongoDB Atlas) for application data and document storage;
• Model and inference providers (including Anthropic, OpenAI, Google, Microsoft, Amazon, and NVIDIA) for AI model inference, subject to the routing described in Section 4;
• Payment processors for billing and payment;
• Email, support, analytics, and observability providers;
• Connector platforms when Customer authorizes Atlas connections or External Agents.

8.2 Within Customer's Workspace

Information uploaded to a Workspace is accessible to the Authorized Users of that Workspace according to the scope, project membership, team membership, and ACL controls Customer configures. Customer administrators control these permissions and are responsible for them.

8.3 Legal Disclosures

We may disclose information if we believe in good faith that disclosure is necessary to: (a) comply with applicable law, legal process, or a lawful request from a government authority; (b) enforce our agreements; (c) detect, prevent, or address fraud, security, or technical issues; or (d) protect the rights, property, or safety of GenArk, our customers, our users, or the public.

8.4 Business Transfers

In the event of a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or substantially all of our assets, personal information may be transferred to the successor or acquiring party. We will require the successor to honor the commitments in this Privacy Policy with respect to information collected prior to the transfer.

8.5 With Consent

We may share information for other purposes with your consent or at your direction.

8.6 No Sale; No Cross-Context Behavioral Advertising of Sensitive Data

We do not sell personal information for monetary consideration. We do not share or disclose personal information for cross-context behavioral advertising involving sensitive personal information.

12.1 Rights Available in Many Jurisdictions

Depending on your jurisdiction, you may have rights including:

• Access — to know what personal information we hold about you and how it is processed;
• Correction / rectification — to correct inaccurate or incomplete information;
• Deletion / erasure — to request deletion of personal information, subject to applicable exceptions;
• Portability — to receive your personal information in a structured, machine-readable format;
• Restriction or objection — to restrict or object to certain processing, including processing for direct marketing;
• Withdrawal of consent — where we rely on consent as the lawful basis;
• Opt-out of sale, sharing, or targeted advertising — where applicable under U.S. state laws;
• Non-discrimination — for exercising your rights;
• Lodging a complaint with a supervisory authority — where applicable.

12.2 How to Exercise Your Rights

To exercise these rights, contact us at privacy@genark.ai. We will respond within the time required by applicable law (typically forty-five (45) days for U.S. state law requests; one (1) month for GDPR/UK GDPR, with up to two additional months for complex requests). We may need to verify your identity before fulfilling a request. We will not discriminate against you for exercising any right.

12.3 Marketing Communications

You can opt out of marketing communications at any time by clicking the unsubscribe link in our emails or by contacting privacy@genark.ai. We honor opt-out requests within ten (10) business days. You will continue to receive transactional and service-related communications relating to your account.

12.4 Cookie Choices

You can manage cookies through the cookie banner where presented and through your browser settings. We honor Global Privacy Control (GPC) and similar opt-out preference signals where required by law.

13.1 California Residents (CCPA/CPRA)

California residents have specific rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. These include the right to know, the right to delete, the right to correct, the right to opt out of sale or sharing, the right to limit the use of sensitive personal information, and the right to non-discrimination. We do not knowingly sell or share the personal information of consumers under 16. To exercise California rights, contact privacy@genark.ai.

13.2 Other U.S. State Privacy Laws

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Delaware, New Jersey, New Hampshire, Maryland, Minnesota, Kentucky, Rhode Island, and residents of any other state that enacts a comparable comprehensive privacy law during the term of this Policy may have rights similar to those described in Section 12. To exercise these rights, contact privacy@genark.ai.

13.3 European Economic Area, United Kingdom, and Switzerland

If you are located in the EEA, the UK, or Switzerland, you have rights under the General Data Protection Regulation ("GDPR") and the UK GDPR. Our lawful bases for processing include performance of a contract, compliance with legal obligations, our legitimate interests, and your consent (where applicable). You may lodge a complaint with your local supervisory authority. For requests, contact privacy@genark.ai.

13.4 HIPAA Notice

GenArk may act as a Business Associate to Covered Entities and Business Associates under HIPAA. When we do, our processing of Protected Health Information is governed by an executed Business Associate Agreement. Individuals whose PHI is processed should generally direct privacy and access requests to the relevant Covered Entity rather than to GenArk.