Privacy Policy

Arc uses information to provide, support and secure the service, respond to enquiries and meet legal obligations. Customer programme information is processed under documented customer instructions, including the AI processing described below. Accepting our terms is not blanket consent to processing personal information.

• Business contact, account, billing, onboarding and support information, such as name, work email, company and role.
• Account and example requests, including a request identifier and any separate marketing choice.
• Customer programme information: requirements, systems, interfaces, risks, tests, verification records, evidence, files, images, data, comments and engineering history. These records may contain personal information.
• AI prompts, conversation context, engineering records, document text, uploaded files, audio, generated outputs and processing metadata used by enabled AI features.
• Information exchanged through customer-authorised integrations, and technical information such as IP addresses, device/browser details, logs, website activity and campaign attribution.

• To provision accounts, send invitations, operate engineering workflows, manage subscriptions and provide support.
• To provide AI assistance, embeddings and retrieval indexing, audio transcription and automated assessments. Relevant records may be sent to AI providers during indexing or configured background tasks, even without a new chat message.
• To operate authorised integrations, protect the service, investigate problems and retain engineering and conversation history.
• To respond to enquiries, measure website use and manage our business relationship. Optional marketing communications require a separate choice that can be withdrawn.
• To comply with law and enforce our agreements.

Arc generally acts as a processor for personal information in Customer Content. The customer determines the purposes and lawful basis, controls access and instructs processing under an applicable data processing agreement, which must be in place before personal data is uploaded. Do not upload sensitive personal information without expressly agreed arrangements.

Arc acts as a controller for its website enquiries, business contacts, account administration and billing. We rely on legitimate interests in responding to enquiries, managing business relationships and securing the service; contract where necessary to provide a service to an individual; legal obligations for required records; and consent for optional marketing. Separate consent is required for non-essential tracking where applicable.

The customer’s contractual authorisation of service providers is distinct from an individual’s data-protection consent. Subprocessor authorisation, notice of changes and the opportunity to object are governed by the data processing agreement and applicable law.

The standard service is hosted on AWS in London, UK, with logical isolation between organisations. External AI, integration and website providers may process information in other countries; UK database hosting does not mean all processing stays in the UK. On-premises, air-gapped and customer-owned database arrangements are not standard subscription features and require separately agreed terms and confirmation of technical support.

The following providers are used for the stated purposes, where the relevant service or feature is used. Contact us for supplier legal entities, processing locations and the contractual subprocessor details applicable to your service.

• Amazon Web Services (AWS): application hosting, database and file storage, backups, Cognito authentication and SES service email. Data includes account information, Customer Content, stored files and operational records.
• Microsoft Azure OpenAI and OpenAI: AI assistance, embeddings and retrieval indexing, transcription and automated assessments. Relevant prompts, context, engineering records, document text, files and audio may be processed. Both Azure-hosted and direct OpenAI API routes are used by Arc-managed features.
• Crisp, where support chat is enabled: support messages, contact details, attachments and connection information supplied through chat.
• Stripe: subscription payment and billing information. Payment processing is also subject to Stripe’s Privacy Policy.
• Cal.com: scheduling information supplied when booking a call.
• Formspark: fields and request metadata submitted through website account, example or contact forms. See Formspark’s Privacy Policy.
• Google Analytics and Apollo: website measurement and visitor/business identification, as described below. These website tools are separate from processing customer engineering records in Arc.

GitHub and Atlassian Jira connections exchange authorised repository or issue information, identifiers, relevant content and links for the requested integration. Customer-connected AI accounts process information under that provider’s terms and the customer’s settings. These are services the customer connects, distinct from suppliers engaged by Arc to operate the hosted service. Connecting a service requires authority to share the relevant information.

Arc does not use Customer Content to train AI models. Arc-managed OpenAI and Azure OpenAI API services do not use it to train their models under their applicable business terms. Provider retention depends on the endpoint, account settings and applicable data-processing arrangements; security records and temporary files may have separate retention periods. OpenAI’s standard API abuse-monitoring retention can be up to 30 days, subject to legal or security exceptions. Zero retention is not a blanket property of every AI feature. See OpenAI’s API data controls.

Where personal information is transferred outside the UK or EEA, the transfer requires an applicable lawful mechanism, such as an adequacy decision or approved contractual clauses, with supplementary measures where needed. The data processing agreement sets out the safeguards for Customer Content; contact us for the arrangements relevant to your service.

The website currently loads Google Analytics for usage measurement and an Apollo tracker for visitor and business identification. These providers may process IP addresses, device/browser information, page visits and identifiers and may use cookies or similar technologies. See Google’s Privacy Policy and Apollo’s Privacy Policy.

Campaign parameters (UTM source, medium, campaign and content) may be stored in browser session storage to attribute enquiries. Scheduling and payment services may also use their own cookies when you use them. Browser settings can restrict cookies and storage; blocking them may affect connected services. Contact us with tracking or privacy questions.

• Programme records, files, conversations and engineering history remain in Arc until deleted under the applicable agreement or customer instructions. Archiving a record or removing a user does not itself erase organisation content.
• Under our standard subscription terms, customers have 90 days after subscription termination to retrieve Customer Content before live-system deletion, unless another period is agreed or retention is legally required. The data processing agreement and mandatory switching or erasure rights take priority.
• Routine database backups provide seven days of point-in-time recovery and weekly snapshots retained for 183 days (approximately six months). Deleted live data can remain in backups until expiry. Backups are restricted to recovery and security purposes; separately retained manual recovery snapshots must also be addressed when handling deletion instructions. Legally required erasure takes priority over routine expiry.
• Production operational logs currently have a 30-day retention period. Provider-held records and temporary AI files follow their own applicable retention settings and terms.
• Enquiries, account requests, support and billing records are kept as needed to handle the request or relationship and meet legal obligations. Legally retained records are restricted to those purposes. Optional marketing consent can be withdrawn at any time.

Arc uses encryption at rest and in transit, logical tenant isolation and role-based access controls. Customers manage authorised users and connected services. See our security page for the current scope; no internet service guarantees absolute security.

Depending on applicable law, you may request access, correction, erasure or portability, restrict or object to processing, or withdraw consent without affecting earlier lawful processing. Programme-data requests should normally go to your organisation, as controller; Arc assists under the data processing agreement. For website or general privacy matters, contact luc@archelps.com. You may also complain to the UK Information Commissioner’s Office or your relevant data-protection authority.

Arc’s controller is ARC ARTIFICIAL INTELLIGENCE LTD, company number 17102842, registered at Flat 10 57 Greatorex Street, London, England, E1 5NP. Material changes to customer processing follow the applicable agreement and notice requirements.