Privacy Policy

Last updated: July 27, 2026

Overview

Aresto is built by Mystro Analytics, Inc. ("we", "us", "our"). Aresto is local by default, with optional cloud agent services that you can choose to connect. This policy explains how we handle data across aresto.ai, Aresto devices, Aresto applications, and those optional cloud services.

What we collect on aresto.ai

When you visit our website, we may collect:

  • Email address if you sign up for our waitlist or submit a contact form.
  • Usage analytics through Google Analytics (page views, scroll depth, button clicks). This data is anonymous and aggregated.
  • Standard web logs including IP address, browser type, and referring URL, collected automatically by our hosting provider (Google Cloud).

Local-by-default features

The Aresto device is designed for local, private AI. When you use local-only features:

  • Your prompts and conversations are processed on your device.
  • Your documents and files stay on your device.
  • We do not collect telemetry, usage data, or model inputs from your device unless you explicitly opt in.
  • AI models run entirely on your hardware. There is no cloud dependency for core functionality.

Optional cloud features

If you choose to enable cloud features, the information needed to complete your request is sent to our cloud services and service providers, including Google Cloud. This may include your instructions, relevant conversation context, agent run records, and content from services you connect. Cloud features are opt-in and can be disconnected.

Google Workspace data

If you connect a Google Account, Aresto requests access only after you approve Google's consent screen. Depending on the feature you use, Aresto may access:

  • Google Account identity: your account email address, used to show which account is connected.
  • Gmail: message and thread content, headers, labels, and related metadata needed to find, summarize, and prepare email drafts you request.
  • Google Calendar: calendars, events, attendees, and availability needed to answer scheduling questions and prepare or create events you request.

Aresto uses this data only to provide and improve the user-facing features you ask us to perform. We do not sell Google user data, use it for advertising, or allow people to read it except when necessary for security, support you request, legal compliance, or operating the service through providers acting on our behalf.

Aresto's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

How connected data is protected

  • Google OAuth credentials are encrypted with a per-user Google Cloud KMS key and stored in Google Secret Manager.
  • Agent runtimes receive short-lived, task-bound access. They do not receive your long-lived Google credential.
  • Connection metadata, agent run records, audit history, and the minimum content needed to complete or explain a request may be stored in Aresto's cloud systems.
  • External-facing drafts and calendar actions are subject to Aresto's permission and approval controls.

Retention, disconnection, and deletion

We retain a Google connection while it remains active. Disconnecting Google revokes the connection and destroys Aresto's stored OAuth credential. Run records, audit records, and content already used to complete a request are retained only as needed to provide the service, protect its security, resolve disputes, and meet legal obligations. You can also revoke access from your Google Account permissions. Contact us to request access to or deletion of personal data associated with your Aresto account.

How we use your email

If you provide your email through our waitlist or contact form, we use it to:

  • Send you updates about Aresto availability and pre-orders.
  • Respond to your inquiries.
  • Send occasional product updates (you can unsubscribe at any time).

We do not sell, share, or rent your email to third parties.

Cookies

Our website uses cookies for Google Analytics. These cookies help us understand how visitors interact with our site. You can disable cookies in your browser settings at any time.

Data retention

We retain your waitlist or contact email until you unsubscribe or request removal. Analytics data is retained according to our Google Analytics retention setting, currently 14 months. Retention for connected services is described above.

Your rights

You have the right to:

  • Request access to personal data we hold about you.
  • Request deletion of your data.
  • Unsubscribe from any communications at any time.

Contact

For privacy-related questions, contact us at essam@aresto.ai.