Effective Date: September 8th, 2025
Arbitra is a SaaS platform providing independent benchmarking and testing of identity verification (IDV) solutions. Although headquartered in Mexico, Arbitra serves primarily U.S.-based users and complies with U.S. laws including the CCPA, CPRA, BIPA, FIPA, TDPSA, and SHIELD Act. This Privacy Policy outlines our practices regarding data collection, use, retention, and protection.
We are also aligned with leading technical standards such as ISO/IEC 27701 and NIST 800-63-3.
We may collect the following types of data, depending on your interactions with our platform:
Computer-generated IDs and biometric simulations used for benchmarking. Some profiles may be hybrid, combining real-world attributes (such as document templates or sample demographic distributions) with artificial elements. These profiles are never linked to real persons and are designed solely for testing. (not linked to real individuals).
Only with explicit, written, timestamped consent. May include images, documents, or identifiers voluntarily provided for testing purposes.
From vendor websites, government databases, and review platforms.
Provided voluntarily (e.g., through forms).
Non-personal usage data (e.g., IP address, browser type).
Depending on your state of residence, you may have the right to:
To exercise your rights, please email privacy@arbitra.org. We respond within 45 days for CCPA requests, and 30 days for others.
All data is processed in compliance with U.S. state privacy laws. Data transfers between Mexico and the U.S. are encrypted and governed by written contracts that ensure equivalent protections.
Our services are intended for users 18 and older. Real user testing includes age attestation and contract validation to ensure compliance. We do not knowingly collect or process data from minors.
We use cookies for performance monitoring and site optimization. See our Cookie Policy at https://www.arbitra.org/sub-pages/cookies for details on cookie categories, opt-out mechanisms, and your preferences.
No automated decision-making is used in producing legal outcomes or eligibility assessments.
For residents of Illinois, we comply with the Illinois Biometric Information Privacy Act (BIPA). This includes:
Biometric information may include facial geometry, fingerprints, voiceprints, or other biometric identifiers used during IDV testing.
Written, informed consent is required before any biometric data is collected. Consent includes the purpose, length of retention, and rights under BIPA.
Biometric data is retained only for the duration of the test, not exceeding 30 days, and is permanently deleted thereafter.
We do not sell, lease, trade, or otherwise profit from biometric data.
Biometric data is not disclosed to third parties without user consent unless required by law.
Disputes will be resolved by binding arbitration in California, unless otherwise required by applicable law. Users retain their rights under applicable U.S. privacy laws.
We may update this policy periodically. Material changes will be communicated by revising the 'Effective Date' at the top. Continued use of our services indicates acceptance of any updates.
If you have questions or would like to exercise your privacy rights:
