Privacy Policy

Interpretation

Words with capitalized first letters have meanings defined under the following conditions. The definitions have the same meaning whether written in singular or plural.

Definitions

For the purposes of this Privacy Policy:

• Application or Service means the Arena web application or related services.
• Account means a unique account created for You to access our Service or parts of our Service.
• Company (referred to as "the Company", "We", "Us" or "Our") refers to Position², Inc., operating Arena.
• Cookies are small files placed on Your device by a website, containing details of Your browsing history among other uses.
• Device means any device that can access the Service such as a computer, cellphone, or digital tablet.
• Personal Data (or "Personal Information") is any information that relates to an identified or identifiable individual.
• Google Data means any data, content, or metadata obtained via Google APIs (including Google Workspace APIs).
• Zoom Data means any data, content, or metadata obtained from Zoom via OAuth, Zoom APIs, webhooks, or the Zoom Marketplace app, including meeting, recording, participant, and user profile information.
• Generalized AI/ML model means an AI or ML model intended to be broadly trained across multiple users, not specific to a single user's data or behavior.
• User-facing features means features directly visible to or used by the individual user through the app UI.
• Service Provider means any natural or legal person who processes data on behalf of the Company.
• Usage Data refers to data collected automatically, generated by use of the Service or from the Service infrastructure.
• Website refers to Arena, accessible from https://thearena.ai
• You means the individual accessing or using the Service, or the entity on behalf of which such individual is accessing the Service.

Personal Data You Provide

When you sign up, link accounts, or use features, you may provide Personal Data such as:

• Name and email address
• Phone number and mailing address
• Profile picture, settings, and preferences
• Content you upload (e.g., documents, files) within Arena
• Any data you explicitly input or connect, including via Google and Zoom integrations

Google Data via API Scopes

If you choose to integrate your Google account with the Arena platform, we will request specific permission scopes to enable automated workflows. Depending on the custom workflow integrations you activate, we may access the following categories of Google data:

• Basic Profile Information: Your name, email address, and profile settings to securely authenticate your connected accounts.
• Gmail Messages & Metadata: The ability to read, search, format, and send emails natively from your account, purely to execute user-configured trigger and response communication blocks.
• Calendar Data: The capability to list, view, create, update, and delete calendar events to handle scheduling automation.
• Google Sheets & Content: Access to read structured row data from your specified spreadsheets and write processed data or metrics back to them.
• Google Drive & Documents: The ability to list, read, create, or modify Google Docs and generic files to export generated briefs, marketing reports, or files created within your workspace environment.
• Google Contacts, Google Meet, and Google Tasks: Access to contacts, Meet spaces you create, and task lists to support the corresponding automation features you enable.

We strictly adhere to the principle of least privilege. Arena will only request the minimal, technically feasible scopes required to run the automated features you explicitly choose to activate, and we will never request access for features that are not yet implemented.

Zoom Data via API Scopes

If you choose to install or authorize the Arena Zoom app, we request only the OAuth scopes required to run the Zoom features you enable. Depending on those features, we may access:

• Zoom user profile: User identifier, name, and email, to identify the connected Zoom account
• Meetings: Create, list, read, update, and delete meetings, including topic, time, duration, timezone, agenda, join URL, and meeting settings
• Meeting invitations: Formatted invitation text so workflows can share join details
• Past participants: Names, emails (when Zoom provides them), join and leave times
• Cloud recordings: Recording metadata, file types, play and download URLs, and — if you enable a recording workflow — recording files and transcripts
• Webhook events: Meeting started/ended, participant joined/left, recording completed, and other Zoom events you subscribe a workflow to
• OAuth access and refresh tokens

We do not receive your Zoom password. Arena only requests the scopes listed in the Zoom authorization screen and in our Zoom setup guide. How we use, store, and delete Zoom Data is in Use of Zoom APIs and Data.

Usage Data

We may collect information on how the Service is accessed and used ("Usage Data"), including your IP address, browser type and version, pages visited, time and date of visit, time spent on pages, unique device identifiers, and other diagnostic data.

Tracking & Cookies Data

We use cookies and similar tracking technologies to track activity on our Service and hold certain information. You can instruct your browser to refuse cookies, though some portions of the Service may not function properly.

We use the information we collect to:

• Provide, operate, and maintain the Service
• Deliver the specific user-facing features you enable
• Authenticate you and secure your Account
• Communicate with you about the Service
• Improve, personalize, and develop the Service
• Comply with legal obligations

When Zoom is connected, we also use Zoom Data to authenticate the Zoom connection (including token refresh), create or manage meetings and invitations on your behalf, read meeting, participant, and recording data for workflows you configure, and start workflows from Zoom webhook events you enable.

Importantly: Zoom Data is used only to provide user-facing features you enable. We do not use Zoom Data to train, develop, or improve generalized AI/ML models.

Position², Inc.'s application, Arena, enables users to connect their Google accounts to streamline data integration, file management, and workflow automation. Our use and transfer to any other app of information received from Google APIs will strictly adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you authorize Arena to access your Google data via restricted scopes, Position² commits to the following:

• Permitted Use: We will only use your Google data to provide and improve the prominent, user-facing features explicitly requested by you within the Arena platform (such as agentic workflow automation, communication management, file and document processing, and data integration).
• No Unauthorized Transfers: We will not transfer this data to third parties unless doing so is necessary to provide these user-facing features, comply with applicable law, or as part of a merger, acquisition, or sale of assets. Data is securely processed by Arena's internal Artificial Intelligence systems to execute tasks on your behalf; we do not transmit your Google data to external third-party AI processors.
• No Advertising: We will absolutely not use or transfer your restricted Google data for serving advertisements, including retargeted, personalized, or interest-based advertising.
• Restricted Human Access: We will not allow humans to read this data unless we have your affirmative agreement for specific data, doing so is necessary for security purposes (such as investigating abuse), to comply with applicable law, or for our internal operations (provided the data has been aggregated and completely anonymized).
• No Generalized AI/ML Training: We do not use Google Data to train, develop, or improve generalized AI/ML models. Google Workspace data is not used to train or fine-tune any AI/ML models.

If you authorize the Arena Zoom Marketplace app, this section applies in addition to the rest of this Privacy Policy. Our use of information received from Zoom APIs complies with the Zoom API License, Zoom's terms, and applicable Zoom Marketplace policies.

When you authorize Arena to access your Zoom Data, Position² commits to the following:

• Permitted Use: We will only use your Zoom Data to provide the user-facing features you request, including authenticating the Zoom connection, creating or managing meetings and invitations, reading meeting, participant, and recording data for workflows you configure, and starting workflows from Zoom webhook events you enable
• No Unauthorized Transfers: We will not transfer Zoom Data to third parties unless necessary to provide those features, comply with law, or as part of a merger, acquisition, or sale of assets
• No Advertising: We will not use or transfer Zoom Data for serving advertisements
• No Sale of Zoom Data: We do not sell Zoom Data
• No Generalized AI/ML Training: We do not use Zoom Data to train, develop, or improve generalized AI/ML models
• Restricted Human Access: We will not allow humans to read Zoom Data unless we have your affirmative agreement for specific data, doing so is necessary for security purposes (such as investigating abuse), to comply with applicable law, or for our internal operations (provided the data has been aggregated and completely anonymized)

Storage and sharing

Arena stores encrypted OAuth tokens for the Zoom connection, workflow configuration you create, and execution logs of runs. Arena does not keep a copy of your Zoom account. Meeting video and audio remain in Zoom unless a workflow you enable downloads a recording file into Arena for that run.

We call Zoom REST APIs from our servers over HTTPS to https://api.zoom.us/v2. We do not disclose Zoom data to unaffiliated third parties except as described in this Privacy Policy (service providers bound to confidentiality, legal process, or business transfer). If an Arena workflow you configure sends Zoom Data to another connected tool, that transfer happens because you enabled that workflow.

Retention and deletion

Zoom tokens and Zoom API Data are retained during feature use, then deleted or de-identified within 7 days after you disconnect Zoom in Arena, revoke Arena in Zoom, we receive Zoom's deauthorization notice, or you delete your Arena account. See Data Retention for the full schedule.

Your choices

You may revoke Arena's Zoom access at any time:

• In Arena: open Integrations, select the Zoom connection, and choose Disconnect or Remove
• In Zoom: remove the Arena app from your Zoom App Marketplace installed apps

Removing the app deletes stored OAuth tokens. Zoom API Data associated with that connection is then deleted or de-identified within 7 days. Meeting video, audio, and cloud recordings that remain in Zoom should be exported from Zoom.

We may disclose aggregated information about our users, including our registered users, without restriction. Position² does not sell, rent, license or share Personal Data with non-affiliated companies or individuals, except as described in this Privacy Policy.

Personnel and Service Providers

We may employ third-party companies and individuals to facilitate our Service, to provide the Service on our behalf, to perform Service-related tasks (e.g., maintenance, database management, web analytics, and improvement of features), or to assist us in analyzing how the Service is used. To deliver advanced data analytics, automation, and our Data Science Labs capabilities, Arena utilizes Artificial Intelligence and agentic frameworks that are deployed entirely within our own secure infrastructure. When you engage with our AI-driven features, your data is processed within our system. We do not transmit your system data, queries, or Google API data to external third-party AI processors. If an internal AI agent requires access to data obtained via Google APIs, this data is processed exclusively within our secure environment to fulfill your immediate request and remains fully protected under the Google API Limited Use requirements detailed above. Our personnel and the third parties who have access to your Personal Data only have such access to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose, subject to confidentiality agreements as protective of your rights as this Privacy Policy.

Compliance with Laws and Law Enforcement

Position² may cooperate with government and law enforcement officials and private parties to enforce our agreements with you and comply with the law or legal process. We may disclose information about you to government or law enforcement officials or private parties as we, in our sole discretion, believe necessary or appropriate to respond to claims and legal process (including subpoenas), to protect the property and rights of Position² or any third party, to protect the safety of the public or any person, or to prevent or stop activity we may consider to be, or to pose a risk of being, illegal, unethical, or legally actionable.

Business Transfers

Position² may sell, transfer, or otherwise share some or all of its assets, including your Personal Data, in connection with a merger, acquisition, reorganization, or sale of assets or in the event of bankruptcy. We may also disclose Personal Data for any other purpose disclosed by us when you provide the information, or with your consent.

We do not sell your Personal Data.

We retain Personal Data, Google Data, and Zoom Data only as long as necessary to provide the Service and for legitimate business or legal purposes. You may request deletion at any time (see Your Rights).

Unless a longer period is required by law:

• Account Data: Retained during an active account + 30 days after a deletion request
• Google API Data and Zoom API Data: Retained during feature use + 7 days after revocation or account deletion
• OAuth tokens, Server-to-Server secrets, and webhook Secret Tokens: Retained while the Zoom connection is active; deleted or invalidated within 7 days of disconnect, Zoom deauthorization, or account deletion
• Downloaded recording files: Kept only as needed to complete the workflow run and any user-visible history; deleted within 7 days of disconnect unless you stored them in another destination you configured
• Usage Logs: 90 days for analytics; up to 1 year for security investigations
• Transaction Records: Up to 7 years for legal and tax compliance

Arena does not replace Zoom's own retention settings. Meetings, cloud recordings, and Zoom account data remain subject to your Zoom plan. Deleting data in Arena does not delete the corresponding meeting or recording in Zoom, except when a workflow you enable calls Zoom's delete APIs.

Upon account deletion or revocation of Google or Zoom access, we delete or de-identify associated connected-account data within those timeframes, subject to legal retention requirements. Backups expire on the same schedule, subject to backup rotation.

We implement administrative, technical, and physical safeguards designed to protect your information, including encryption in transit and at rest, access controls, and least-privilege practices. No method of transmission or storage is 100% secure.

Depending on your jurisdiction, you may have the right to access, correct, delete, or port your data, restrict or object to processing, and withdraw consent. You can revoke Arena's access to your Google account at any time via your Google Account permissions page.

You can revoke Arena's access to Zoom at any time:

• In Arena: open Integrations, select the Zoom connection, and choose Disconnect or Remove
• In Zoom: remove the Arena app from your Zoom App Marketplace installed apps

Removing the app deletes stored OAuth tokens. Zoom API Data associated with that connection is then deleted or de-identified within 7 days. Meeting video, audio, and cloud recordings that remain in Zoom should be exported from Zoom. To exercise these rights, contact us using the details below.

You can access and change certain PII by logging into your account. You can also request that Position² delete your PII by emailing or clicking delete@position2.com, which will open a form to submit your request. However, if you, or your company, are using any Position² products and services, such requests will not be honored during the term of any such use. We may also refuse to accommodate a request to change or delete information if we believe the change or deletion would violate any law or legal requirement or cause the information to be incorrect.

Your information may be processed in countries other than your own. Where required, we use appropriate safeguards for such transfers.

The Service is not directed to individuals under 16, and we do not knowingly collect Personal Data from children.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date.

If you have questions about this Privacy Policy or our data practices, contact us at:

• Position², Inc.
• Email: noreply@thearena.ai
• Data modification or deletion: delete@position2.com
• Website: https://thearena.ai
• Zoom app documentation: https://thearena.ai/documentation/zoom