ARMR← getarmr.ai

ARMR Privacy Policy

Effective date: June 5, 2026

This Privacy Policy describes how Dark Horse Political, LLC ("Dark Horse Political," "we," "us," or "our") collects, uses, discloses, and protects information in connection with ARMR — Adversarial Response & Media Readiness (the "Service"), available at getarmr.ai. ARMR is an invite-only adversarial media-training platform for political candidates, campaigns, and consultants/firms.

Dark Horse Political, LLC is a Wyoming limited liability company headquartered in Sheridan, Wyoming. We are the controller of the personal information described in this Policy.

Because ARMR handles unusually sensitive material — including self-disclosed vulnerabilities, opposition research, strategic information, and voice and video recordings — confidentiality and data protection are central to how we operate. This Policy explains the safeguards we apply.

1. Who This Policy Covers

This Policy applies to:

The Service is intended solely for adults (18 and older) acting in a professional political capacity. It is not directed to children. See Section 11.

2. Information We Collect

2.1 Information you provide directly

2.2 Voice and video information

Depending on your jurisdiction, voice and facial/behavioral data may be treated as biometric or otherwise sensitive information. We collect and process this data only with your consent and only to provide the training Service. See Sections 4, 6, and 8.

2.3 Information collected automatically

3. How We Use Information

We use the information we collect to:

Purpose limitation. We use CIP, Operator Profile, voice, and video data only to deliver and improve the training Service for you. We do not sell this information, and we do not use it for advertising or share it with third parties except the limited sub-processors described in Section 5 or as required by law.

4. Legal Bases for Processing

Where the GDPR or similar laws apply, we rely on the following legal bases:

5. How We Share Information; Sub-Processors

We do not sell personal information. We share information only as follows:

Sub-processor Function Notes
Stripe Payment processing We do not store full card numbers.
Resend Transactional and lifecycle email delivery
Supabase Database and file/storage hosting Stores account data, profiles, transcripts, and recordings.
Speech-to-text provider Transcription of voice recordings for training
AI / LLM provider(s) Generating training scenarios and evaluations Processes profile and session content to produce feedback.

(The specific identities of sub-processors may change. A current list is available on request to the contact in Section 13.)

We do not disclose your CIP, Operator Profile, voice, or video data to other clients, campaigns, candidates, or unrelated third parties.

6. Confidentiality of Sensitive Campaign Information

Given the nature of our clientele, we treat your strategic and sensitive information — including the CIP, Operator Profile, opposition research, and recordings — as strictly confidential. We apply internal access controls so that this material is accessible only to personnel and sub-processors with a need to access it to deliver the Service. We do not use one client's information for the benefit of another, and we do not disclose the existence or content of your engagement except as permitted in this Policy or required by law.

7. Data Retention and Deletion

We retain information for as long as needed to provide the Service and for legitimate business and legal purposes, after which we delete or de-identify it.

To request deletion, contact us using Section 13.

8. Security

We implement administrative, technical, and physical safeguards designed to protect information, including encryption in transit, access controls, authentication, and reliance on reputable infrastructure providers. We require our sub-processors to maintain appropriate security. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; you use the Service at your own risk and are responsible for safeguarding your account credentials.

9. Email and Communications (CAN-SPAM)

We send two categories of email:

10. Your Privacy Rights

Because our users may be located anywhere, we extend the following rights as a baseline, subject to verification and applicable law.

10.1 Rights for all users (GDPR baseline)

Subject to applicable law, you may have the right to: access your personal information; correct inaccurate information; request deletion; restrict or object to certain processing; request portability; and withdraw consent (including for voice/video and marketing). Where the GDPR applies, you also have the right to lodge a complaint with your supervisory authority.

10.2 California rights (CCPA/CPRA)

If you are a California resident, you may have the right to: know the categories and specific pieces of personal information we collect, use, and disclose; correct inaccurate information; delete personal information; and limit the use and disclosure of sensitive personal information. We do not sell or share personal information for cross-context behavioral advertising. We will not discriminate against you for exercising your rights. You may use an authorized agent to submit requests.

10.3 How to exercise your rights

Submit requests to the privacy contact in Section 13. We will verify your identity before fulfilling a request and respond within the timeframes required by applicable law. If you are an authorized user under a campaign or firm account, certain requests may be directed through that account's administrator.

11. Children's Privacy

The Service is intended only for adults 18 and older acting in a professional political capacity. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected such information, we will delete it.

12. International Users and Data Transfers

We operate from the United States, and our sub-processors may process information in the United States and other countries. If you access the Service from outside the United States, you understand that your information may be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your jurisdiction. Where required, we implement appropriate safeguards for international transfers.

13. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new effective date and, where appropriate or required, provide additional notice. Your continued use of the Service after an update constitutes acceptance of the revised Policy.

14. Contact Us