# Privacy Policy

Last updated: 2026-10-30

This Privacy Policy explains how Arc10 Technologies Inc. ("Arc10", "we", "us") collects, uses and protects personal information when you use Arclyx, including arclyx.ai, the application at app.arclyx.ai, our API and related services (the "Services").

## 1. Who we are

Arclyx is operated by Arc10 Technologies Inc., 200 Consumers Road, Suite 210, North York, ON M2J 4R4, Canada.

For your account information we are the controller. For the content you or your organisation put into the Services, such as documents and messages, your organisation is the controller and we process it on its behalf. If you need a data processing agreement, contact us.

## 2. Information we collect

- **Account information:** your email address, name, profile picture, time zone, the organisation you belong to and your role in it. You can sign in with an email and password, a sign-in link sent by email, or Google or GitHub; if you use Google or GitHub, we receive your basic profile from that provider. Passwords are held by our authentication provider, not by us.
- **Content you provide:** documents you upload, messages you send, agents you configure, files your agents produce, data from the services you choose to connect, messages you send to our Slack app (directly or by mentioning it in a channel) and data your own systems send to agents through webhooks or our API.
- **People in a connected Slack workspace:** when someone who hasn't linked an Arclyx account messages our Slack app, we look up the email address on their Slack profile to check whether they belong to the Arclyx organisation that connected the workspace. That decides whether we offer to link their account or tell them whom to ask for an invitation. We don't store that email address and never use it to contact them. We note that we replied, so we don't repeat ourselves.
- **Usage and technical information:** sign-in times, requests made, IP address, usage for billing (such as model tokens and compute time), records of what an agent did in a run, error reports, and device and browser information.
- **Billing information:** billing contact and subscription details. The Free plan needs a verified payment card before the first action that costs money; Stripe verifies it with a $0 check. The Free plan is never charged. You enter card details directly with Stripe, which stores the card. We never see or store your full card number. We keep the card's brand, its last four digits and the fingerprint Stripe gives us: the first two so you can see which card you added, the fingerprint to allow one Free organisation per card and so stop fake accounts.
- **Website information:** if you join the waitlist on arclyx.ai, your email address, the page that referred you and any campaign tags in the link you followed. We also collect aggregate visit statistics for the website.

## 3. How we use your information

- To provide, operate and maintain the Services, including running your agents (on demand, on a schedule or when a webhook triggers them), retrieving your documents to answer your requests, and suggesting next steps based on your own agents, documents and chats.
- To bill you and meet our tax and accounting obligations.
- To keep the Services secure, prevent abuse and fix problems.
- To send service messages such as invitations, billing notices and notifications you set up.
- To understand how the website is used and improve the Services.

We do not sell your personal information, and we do not use your content to train AI models.

## 4. Legal basis for processing

Where data protection law such as the GDPR applies, we rely on: performing our contract with you; our legitimate interests in running, securing and improving the Services; complying with legal obligations; and your consent, where we ask for it.

## 5. Services we use

We use trusted service providers to run Arclyx. Each receives only the information it needs for its job:

- **Authentication:** Supabase, plus Google and GitHub if you sign in with them.
- **AI model providers:** your prompts and the content needed to answer them are sent through OpenRouter to the AI model providers that generate responses. Where a provider offers zero data retention, we use it. Some providers, such as Anthropic and Google, keep prompts and responses for a limited period, usually around 30 days, only to detect misuse and meet legal obligations, and longer if content is flagged for a policy violation. They do not use your prompts or responses for training.
- **Payments:** Stripe, which processes payments and stores and verifies payment cards.
- **Email delivery:** Resend.
- **Bot protection:** Cloudflare Turnstile on sign-in, sign-up and waitlist forms.
- **Web search:** Brave Search, when an agent searches the web. When an agent opens a web page, that website receives the request directly. To show website icons next to sources, your browser loads them from Google's favicon service, which receives the website's domain and your IP address.
- **Integrations you connect:** none are connected by default. See "Third-party services you connect" below.
- **Self-hosted tools:** error monitoring (Sentry) and website analytics (Umami) run on infrastructure we operate, so that data is not sent to those companies.

**Third-party services you connect.** Arclyx offers built-in connectors to third-party services: Gmail, Google Drive, Google Calendar, Outlook Mail, Outlook Calendar, Slack, Notion, Canva, HubSpot, Linear, GitHub, Apollo, Clay and Cloudflare. Your organisation's administrators can also add other connectors. None are connected by default: each stays off until you or an administrator connects it and approves access through that service's own sign-in. When you do, your agents may retrieve content from that service, and may send it your inputs, outputs and instructions to act on your behalf, such as reading files, creating drafts or posting messages. This access continues until you disconnect the service.

A connected service receives that data directly and handles it under its own privacy policy. We do not control, and are not responsible for, its data practices, and supporting a service does not mean we endorse it. Before you connect one, make sure you have the authority to grant access, and review that service's privacy policy.

## 6. Google user data

This section covers the data we receive from Google when you sign in with Google or connect Gmail, Google Calendar or Google Drive.

- **What we access:** if you sign in with Google, your name, email address and profile picture. If you connect a Google service, the access you approve on Google's consent screen: for Gmail, reading and searching your email and creating drafts; for Google Calendar, reading your calendars and creating or changing events; for Google Drive, searching and reading your files and creating files.
- **How we use it:** only to provide the features you use. Your agents read, search and create in these services when you or your agents' instructions ask them to, and show you the results. We use your Google profile to create your account and sign you in.
- **How we store it:** we store the access Google grants us as encrypted credentials. Content an agent reads or creates can be kept in your conversations and agent run history, for as long as "How long we keep information" below describes. We do not keep a separate copy of your mailbox, calendar or Drive.
- **How we share it:** the Google data an agent works with is sent to the AI model that runs your agent, as "AI model providers" above describes, only to complete your request, and it is held by the providers that host Arclyx for us. We do not sell it or use it for advertising. We do not transfer it to anyone else, except where the law requires it or, with your consent first, as part of a merger, acquisition or sale of assets.
- **AI training:** we do not use Google user data to develop, improve or train AI or machine learning models.
- **People:** no one at Arc10 reads your Google user data unless you ask us to (for example, for support), it is needed for security, such as investigating abuse, or the law requires it.
- **Your control:** you can disconnect a Google service at any time on the Connections page in Arclyx, or remove Arclyx's access in your [Google Account](https://myaccount.google.com/permissions).

Arclyx's use and transfer to any other app of information received from Google APIs will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

## 7. How we share information

We share personal information only:

- with the service providers above, to operate the Services;
- within your organisation, as your organisation's settings and access controls allow. Your organisation's administrators can see members' usage and agent run activity, such as each member's spend and each run's status and tools used, but not the content of your conversations;
- when required by law, such as a valid court order;
- as part of a merger, acquisition or sale of assets, in which case we will tell you first;
- with your consent.

## 8. Cookies, local storage and analytics

- **Essential cookies:** we use cookies to keep you signed in and to complete sign-in flows. The Services do not work without them.
- **Local storage:** the app stores preferences in your browser, such as theme, layout and your last sign-in method.
- **Error monitoring:** when something goes wrong, the app sends an error report to our self-hosted Sentry. It can include a short replay of the screen with text and form inputs masked.
- **Website analytics:** arclyx.ai uses self-hosted Umami, a privacy-friendly analytics tool that counts visits, referring sites and approximate country. It does not use advertising cookies. The application itself has no analytics.
- **Embedded content:** some website pages include content from other providers, such as a map, which may set their own cookies.

We do not use advertising or cross-site tracking cookies.

## 9. How long we keep information

We keep personal information while your account is active and as long as needed to provide the Services. Conversations and documents are kept until you or your organisation delete them. When you delete a document, it is removed from search, but an archived copy of the original file may be kept. Agent run history, files produced by scheduled or webhook runs, and messages our Slack app receives are kept for security, audit and billing. If your organisation is deleted, we keep its data for 30 days to meet our legal obligations, then delete it. Billing records are kept as long as tax and accounting law requires. To have your account and its data deleted, email privacy@arclyx.ai.

## 10. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to withdraw consent. You can delete conversations and documents in the app. For other requests, including account deletion and data export, email privacy@arclyx.ai and we will respond within the time the law requires.

- **EU, UK and Switzerland:** you may also complain to your local data protection authority.
- **California and other US states:** you have the right to know, delete and correct your information and not to be discriminated against for using these rights. We do not sell or share personal information for cross-context behavioural advertising.
- **Canada:** you have rights of access and correction under PIPEDA, and may complain to the Office of the Privacy Commissioner of Canada.

## 11. International transfers

Arc10 is a Canadian company. Arclyx is hosted in North America. Your information may also be processed in other countries where our service providers operate. Where the law requires it, we use recognised safeguards such as standard contractual clauses.

## 12. Security

We use reasonable technical and organisational measures to protect your information, including encryption in transit, connector credentials and API keys stored encrypted or hashed, organisation-level data isolation and an isolated sandbox for code that agents run. No system is completely secure. If a breach affects your personal information, we will notify you and regulators as the law requires.

## 13. Children

The Services are not intended for anyone under 18, and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.

## 14. Changes to this policy

We may update this policy as the Services change. We will revise the date at the top and, for material changes, notify you by email or in the app before they take effect.

## 15. Contact us

Questions or requests about privacy: privacy@arclyx.ai.

Arc10 Technologies Inc., 200 Consumers Road, Suite 210, North York, ON M2J 4R4, Canada.