Arbitra

Privacy Policy

Effective Date: [Insert Effective Date]

CCPA Compliant
GDPR Compliant
ISO/IEC 27701

Arbitra is a SaaS platform providing independent benchmarking and testing of identity verification (IDV) solutions. We are committed to protecting your privacy and ensuring compliance with U.S. laws including CCPA, CPRA, BIPA, FIPA, TDPSA, and SHIELD Act.

What We Collect

Synthetic Data

Simulated IDs and biometrics (no real PII).

Real User Profiles

Collected only with clear, documented consent.

Public Data

Sourced from vendor websites and review platforms; additional information from vendors is gathered with consent when needed.

Contact Info

If you reach out, we store only what you give us.

Website Analytics

Non-personal data (e.g., IP address, device type).

How We Use Data

Benchmarking Reports

To generate vendor benchmarking reports

Solution Testing

To test IDV solutions against synthetic and real (consented) users

Website Improvement

To improve our website and communicate with you (if opted in)

Your Rights

Data Access & Control

Request access, correction, or deletion of your personal data

Opt-Out Rights

Opt out of data sharing or profiling (where applicable)

Consent Management

Withdraw consent at any time (for real user profiles)

Data Sharing

No Data Sales

We never sell your data.

Synthetic Data Protection

Synthetic data is never linked to real identities.

Consent-Based Sharing

Real user data is shared only with consent, for limited testing.

Partner Agreements

Vendors and partners must sign confidentiality agreements.

Security Practices
  • • End-to-end encryption
  • • Access controls and user authentication
  • • Secure storage and audit trails
  • • Annual compliance review (ISO 27701, NIST 800-63-3 alignment)
Data Retention

Synthetic Data

Synthetic data may be stored indefinitely.

Real User Data

Real user data is deleted after testing or upon request.

Consent Records

Consent records are retained for at least 3 years.

Cookies

We use cookies to improve site functionality and performance. For details, see our Cookie Policy.

Children's Privacy

Our services are not intended for children under 18. We do not knowingly collect data from minors.

Dispute Resolution

Disputes will be resolved by binding arbitration in California. You retain any rights granted under applicable privacy laws.

Updates to This Policy

We may update this policy. Changes will be posted here with an updated 'Effective Date'. Continued use of the platform constitutes acceptance.

Contact Us
Email: legal@arbitra.org