Privacy Policy

Our Role

Arterial owns Arterial Data, meaning all data that Arterial’s systems collect, generate, or derive in operating the Services, including imagery, video, sensor and location data, detections, condition scores, map layers, asset inventories, and models. Arterial determines the purposes and means of processing Arterial Data and is responsible for the personal information it contains.

Customers retain ownership of Customer Data, meaning the data, files, and content that a customer or its users upload or otherwise provide to Arterial. Arterial processes Customer Data solely to provide the Services to that customer and does not retain Customer Data after the Agreement ends, use it to improve the Services, or use it for the benefit of any other customer, unless the customer authorizes such retention or use in writing. Each customer owns the copies of Outputs delivered to it, as set forth in the Agreement.

Where an Agreement makes Arterial a service provider or processor for a customer, or sets other terms for that customer’s data, we handle that data as the Agreement requires and on the customer’s instructions.

For information you give us directly, such as when you request a demo or create an account, Arterial is responsible for it as described here.

If You Appear in Our Street Imagery

ARTIE camera systems mounted on public-agency and partner vehicles record the public right-of-way to assess road conditions, signs, markings and other assets. People, vehicles and license plates that happen to be in view can be captured.

What is captured. Images and video of the road and its surroundings, GPS location, time, and vehicle motion data. We do not set out to collect information about individuals.

Why we use it. To detect road hazards and assets for our public-agency customers, to check the quality of our results, and to build and improve the models that do this work.

Why we don’t ask for consent. We cannot identify or contact the people who pass our cameras. Instead, we collect only in public spaces, for public infrastructure work, and we apply the protections below.

How it is protected.

• Faces and license plates are blurred before imagery is shown to customers or shared outside Arterial.
• Raw imagery is never served or shared outside Arterial. It is encrypted and only staff who need it for their work can access it.
• We do not use facial recognition or biometric identification, and we do not track individuals.
• We do not sell imagery, use it for advertising, or use it for driver scoring, insurance, employment or housing decisions.

How long it is kept. See Section 4.

Your choices. You can ask us to delete or blur imagery of you or your vehicle, or ask what we hold, at privacy@arterial.us. Because we do not identify people, please include the approximate location, date and time, and a description of the vehicle or plate if relevant. We will search for it and delete or blur what we find, unless an Agreement or the law requires us to keep it.

Website Privacy Controls

Essential cookies only by default. Optional analytics tags do not load until you opt in. If you allow them, advertising and cross-site data stay off, and you can withdraw consent later.

• Optional analytics stay off unless you opt in.
• Global Privacy Control is treated as an opt-out request where the browser supports it.
• Your choice can be updated at any time from the site footer or this page.
• Optional analytics providers currently include Google Analytics and Vercel Web Analytics. Error and performance monitoring by our error-monitoring provider and Vercel Speed Insights run by default to keep the site stable and fast; if you opt in to optional analytics, our error-monitoring provider may also collect masked session replays.
• When session replay is enabled by your opt-in, text, form inputs, and media are masked before any recording leaves your browser so we can reproduce interaction issues without capturing your content.
• Your privacy choice is stored in a first-party cookie that does not leave arterial.us.

Use the privacy controls below to review optional analytics and keep the site on essential cookies only if you prefer.

U.S. State Privacy Choices

Do Not Sell, Share, or Use My Personal Information for Targeted Advertising

Arterial does not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising as those terms are defined under California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other comprehensive U.S. state privacy laws. Arterial does not engage in profiling that produces legal or similarly significant effects on individuals.

If you want to manage optional analytics or submit a privacy request, use the privacy controls above or contact privacy@arterial.us. We honor Global Privacy Control (GPC) signals as an opt-out request where applicable.

1Information We Collect

1.1 Information You Give Us

Name, email, phone number and organization when you request a demo, contact us or create an account; billing information where applicable.

1.2 Data Our Hardware and Services Collect

Imagery, video and sensor data (camera, GPS, inertial sensors); metadata such as time, location and vehicle data; and outputs such as hazard detections, pavement condition scores and asset inventories.

1.3 Sensitive Categories of Information

In the course of operating ARTIE in the public right-of-way, the Services may incidentally capture information that is treated as sensitive under federal or state law, including:

• Vehicle identifiers and license plates, which may be subject to the federal Driver’s Privacy Protection Act and equivalent state statutes.
• Images of faces and bodies of pedestrians and motorists. Arterial does not perform facial recognition or biometric identification and does not use these images to identify individuals.
• Precise geolocation tied to vehicle paths, which several states classify as sensitive personal information.

Arterial applies heightened controls to these categories. Faces and license plates are blurred or hashed before delivery to Customer dashboards or third parties, raw imagery is encrypted at rest and segregated from analytics outputs, and access is restricted to personnel with a documented operational need. Arterial does not contribute to driver scoring, insurance, employment, or housing decisions and is not a consumer reporting agency.

1.4 Automatically Collected Information

When you use our website or dashboard, we may automatically collect:

• Log data (IP address, browser type, pages visited, access times).
• Usage data (how you interact with the dashboard, APIs, and other tools).
• An essential first-party cookie that stores your privacy preference.
• Subject to your privacy choices, optional analytics data collected through cookies or similar technologies to understand site performance and usability.
• Where you opt in, interaction data such as page views, clicks, scroll depth, and navigation patterns. Our error-monitoring provider may additionally collect masked session replays of opted-in visits — with text, inputs, and media obscured before any recording leaves your browser — strictly to help us reproduce and fix interaction bugs.
• Technical error and performance telemetry collected through our error-monitoring provider (stack traces, page URL, browser type, timing metrics, and release identifiers). This runs by default as a legitimate-interest signal to keep the site stable and secure and does not contain user-entered content.

1.5 Customer Data

Data, files, and content that customers and their users upload or otherwise provide to Arterial in connection with the Services. Customer Data is owned by the customer and is processed only as described in “Our Role” and Section 4.

2How We Use Information

• To provide, operate and maintain the Services.
• To build, train and improve our analytics and machine learning models using Arterial Data, unless an Agreement provides otherwise. Customer Data is used for this purpose only with the customer’s written authorization (see Section 7).
• To measure website performance and usability, only when you have opted in to optional analytics.
• To produce reports and insights for customers, such as hazard maps and road-condition assessments.
• To create, license and sell data products built from aggregated, de-identified Arterial Data. These products do not include Customer Data, imagery, or personal information.
• For research, quality assurance and testing.
• For billing, account management and support.
• For marketing, where you have consented or the law permits. Every marketing email has an unsubscribe link.
• To comply with the law and enforce our agreements.

2.1 Legal Bases for Processing (GDPR)

Where applicable, we process personal data under the following legal bases:

• Consent — where you have provided explicit permission, such as for optional analytics and marketing.
• Contract — where processing is necessary to provide our Services.
• Legitimate Interests — to improve, secure, and operate our platform, provided such interests are not overridden by your rights.
• Legal Obligations — where required to comply with applicable laws.

You may withdraw consent at any time through our privacy controls.

3Who We Share Information With

• Cloud infrastructure and storage providers.
• Analytics providers, only with your consent. Our error-monitoring and performance tools receive technical telemetry by default, under legitimate interest.
• Service providers that support our operations, support and business functions.
• Professional advisors (legal, accounting, audit) under confidentiality obligations.
• Customers, who receive imagery with faces and license plates blurred, and the outputs of the Services.
• Government authorities where the law requires (see Section 14).

Third parties that handle personal information for us are bound by contract to protect it and use it only for the purposes we set. Arterial does not sell personal information. Arterial does not disclose Customer Data, or Outputs prepared specifically for a customer, to any third party except as that customer directs, as permitted by the Agreement, or as required by law.

4How Long We Keep Data

We keep data only as long as we need it for the purposes in this policy, unless an Agreement or the law requires otherwise. Where an Agreement sets a different period, the Agreement controls.

• Raw imagery and sensor data in our cloud and model-training environment: as long as needed for processing, quality review and model training; reviewed at least once a year and deleted when no longer needed.
• Blurred imagery, detections and asset inventories: for the life of the product, unless an Agreement says otherwise.
• Aggregated, de-identified data: indefinitely.
• Customer account data (users, settings): the Agreement term, then deleted within 90 days of termination unless the Agreement says otherwise.
• Customer Data: the Agreement term and the 30-day export period that follows, then deleted, unless the customer has authorized retention in writing or the law requires it.
• Billing and business records: as long as tax and other laws require.
• Security and audit logs, including website and server logs: at least 1 year where the platform supports it.
• Backups: 7 to 60 days, then they expire automatically.
• Privacy preference cookie: 12 months, then we ask again.

When an Agreement requires deletion at the end of the relationship, we delete the data from our systems, let backups expire, and confirm deletion in writing on request.

5Your Privacy Rights

Depending on where you live, you may have the right to access, correct or delete your personal information, get a copy of it, object to or restrict certain uses, withdraw consent, and opt out of sale, targeted advertising and significant profiling. We will not discriminate against you for using these rights.

Send requests to privacy@arterial.us. Our Security Officer handles them. We acknowledge requests within 10 business days and respond within 45 days, with one extension of up to 45 more days where the law allows. We may need to verify your identity, and you can use an authorized agent where the law allows. If we deny a request, we will tell you how to appeal.

If you appear in our street imagery, see the section above for how to make a request. Where an Agreement makes Arterial a service provider for a customer, we may pass your request to that customer and help them answer it.

Arterial’s outputs describe road and infrastructure conditions, not people. We do not make automated decisions with legal or similarly significant effects on individuals.

6Children and Minors

Our Services are not directed to children, and we do not knowingly collect personal information directly from anyone under 18. We recognize that ARTIE may incidentally capture imagery of minors in the public right-of-way. Such imagery is subject to the sensitive-category controls in Section 1.3 and is not used to identify, profile, or track minors. If you believe we hold information about a minor that should be removed, please contact privacy@arterial.us.

7AI and Machine Learning

• We train and improve our models using Arterial Data, including imagery collected through customer deployments, unless an Agreement provides otherwise. We use Customer Data for training only with the customer’s written authorization.
• Training data stays in a restricted environment. Our models detect road conditions and assets, not people. We do not build or train models for facial recognition or for tracking individuals.
• When we share aggregated data outside Arterial, we remove or blur direct identifiers such as faces and license plates, and recipients may not try to re-identify anyone.
• Where third-party AI providers are used to deliver the Services, we choose providers that contractually commit to zero data retention and to not training on customer data.
• Outputs that lead to action are designed for review by trained customer staff first.
• We review model accuracy and update models when we find material problems. We use the NIST AI Risk Management Framework as a reference as our program grows.
• Customers can limit how their data is used, including for training, through their Agreement.

8Cookies and Tracking

We use cookies and similar technologies in the following categories:

• Strictly necessary. Required for the website and dashboard to function, including session management. These cannot be disabled.
• Privacy preference. A first-party cookie that stores your consent choice for twelve (12) months. This cookie does not leave arterial.us.
• Optional analytics. Disabled by default. Activated only on opt-in. Currently includes Google Analytics and Vercel Web Analytics. These tools may collect pages viewed, referrer, device and browser information, approximate geographic region, clicks, scrolling, and navigation behavior. Our error-monitoring provider may additionally collect masked session replays for opted-in visits, with text, inputs, and media obscured before any recording leaves your browser.
• Error and performance monitoring. Our error-monitoring provider collects stack traces, timing metrics, and release identifiers by default as a legitimate-interest signal to keep the site stable and secure. Vercel Speed Insights collects cookieless page-load timing measurements (Core Web Vitals) on the same basis. Neither sets a cookie for this purpose, neither assigns you a persistent identifier, and this telemetry does not include user-entered content and is not used for marketing.
• Marketing. Arterial does not currently use marketing cookies, third-party advertising tags, or cross-site trackers. If this changes, we will update this policy and require fresh consent before activation.

You may manage your preferences at any time through our privacy controls or browser settings.

9Where Data Is Stored

The Services run in the United States, and customer data is stored and processed in U.S. cloud regions. Some providers, such as our content delivery network, operate globally to serve the website quickly. If you reach the Services from outside the United States, your information is transferred to and processed in the United States. Where the law requires, we use appropriate safeguards for international transfers, such as Standard Contractual Clauses.

10Third-Party Links

Our Services may include links to third-party services. We are not responsible for their privacy practices or policies. We recommend that you review the privacy policies of any linked websites.

Terms for People Who Use Our Services

Sections 11 through 16 apply to anyone who uses our website, dashboard, apps or APIs. By accessing or using the Services, you agree to the collection and use of information as described in this policy. People who appear in our street imagery but do not use our Services are not bound by these terms; the sections above are a notice to them. Where you have a signed Agreement with Arterial, the Agreement controls.

11Sub-processors

We use service providers (sub-processors) to host, store and process data, including cloud hosting, database and storage, email and support tools, error monitoring and analytics. Customers can request the current list at privacy@arterial.us. We give customers notice of new sub-processors as their Agreement requires.

12Security

We use administrative, technical and physical safeguards designed to protect data from unauthorized access, disclosure, change or destruction, including:

• Encryption in transit with TLS 1.2 or higher, and at rest with AES-256 or equivalent.
• Single sign-on with multi-factor authentication for production access by Arterial staff.
• Role-based, least-privilege access, quarterly review of production access, removal of access within 24 hours of a personnel departure, and audit logging.
• Secrets kept in a managed vault, rotated on a schedule where appropriate and whenever someone with access leaves or compromise is suspected.
• Vulnerability management, dependency and infrastructure scanning, and code review before production deployment.
• Security training at hire and every year after.
• Encrypted backups stored in U.S. regions, restore tests at least once a year, and a disaster recovery plan with recovery time and recovery point objectives of 24 hours.
• Remediation of identified vulnerabilities within 1 day for critical, 3 days for high, 7 days for medium and 30 days for low severity findings.
• Confidentiality agreements for all personnel, and background checks for personnel with production access.
• Security logs retained for at least 1 year and reviewed at least weekly.
• Customer Data and Outputs stored in the United States, with critical sub-processors’ security attestations reviewed before onboarding and annually.

Arterial is pursuing SOC 2 attestation. Customers can request our latest security documentation under a non-disclosure agreement. No system is completely secure, and we cannot guarantee absolute protection.

13Security Incident Notification

We keep a documented incident response plan covering detection, containment, recovery and review. If we determine that an incident has exposed, or is reasonably likely to have exposed, customer data or personal information, we will:

• notify affected customers by email without undue delay, and within 72 hours of that determination, or sooner if their Agreement requires;
• describe what happened, the kinds and approximate amount of data involved, what we are doing about it, and who to contact;
• post an incident report on our status page within 30 days of a critical incident; and
• help customers meet their own notification duties to the public and regulators.

We notify individuals and regulators where state breach laws require it.

14Legal Requests

If we receive a subpoena, court order, or other legal request for data, we will, where legally permitted, provide notice to the affected customer and cooperate as appropriate. Arterial will not voluntarily disclose Customer Data to third parties absent legal compulsion. For public-agency customers, Arterial will reasonably assist with responses to lawful open-records or freedom-of-information requests, consistent with our Terms of Service.

15Changes to This Policy

When we make material changes, we will notify you through the dashboard, by email or on our website, update the version number and effective date, and keep earlier versions available on request. If you use our Services, your continued use after we post changes means you accept the revised policy.

16Contact Us

Questions or requests: privacy@arterial.us. For the license terms that govern access to and use of the Services, see the Arterial End User License Agreement.