Privacy policy
This policy explains what ARCA TAG stores, why, how it is protected and for how long. The Customer whose people write in the Service is the controller of the personal data their messages and files contain; ARCA Compliance processes those data on its behalf to provide the Service.
This text is a draft prepared for legal review. It is not final, it may change before ARCA TAG is offered commercially, and the passages marked as pending have yet to be completed by ARCA Compliance.
1. What we store
Channels and messages: the channels the Customer creates, their members and guests, every message and thread reply with its author and time, its edits and deletions, its mentions and reactions, and the links a channel keeps to the Customer's records.
Tasks and files: the tasks of each channel with their assignee, due date and closing, and the files attached to messages and tasks with their names and sizes. The Service reads a file only to store it, generate its preview and index its name.
Activity: every message posted, edited or deleted, every task created or closed, every file attached, every invitation and removal of a guest, with the person who did it and when; and which messages each person has read, for the unread counts.
Account and usage data: the people who sign in through the ARCA Compliance platform, members and guests, their roles, the usage of the organization against its plan and technical logs.
2. Why
To carry the Customer's conversation and keep it intact, to deliver each message to the right people as it is posted, to notify a person of a mention or a reply in the app and, when they are away, by e-mail, to keep the tasks and files beside the conversation, to let the Customer search what was said, to measure usage against the plan, to operate and secure the Service and to meet legal obligations. We do not use these data for advertising, we do not sell them and we never use one Customer's conversation for another.
3. Protection
Each organization's data are kept apart at the database level and reached only by its own members, according to their roles; a private channel is reached only by its members, and a guest only reaches the channels they were invited to. Attached files and the images inside notes are encrypted at rest and downloaded through signed links that expire. Connections use TLS and people are authenticated by the ARCA Compliance platform.
4. Retention
Messages, tasks and files are kept for as long as their channel exists. An archived channel is kept, read-only, for the retention period the Customer sets in Settings (5 years at least by default) and is then purged with everything in it. A deleted message is removed from the conversation at once; its record in the activity is kept. Activity is kept for at least 5 years. Technical logs are kept for [PENDING: log retention period].
5. Sub-processors
The Service runs on cloud infrastructure, stores the attached files with a cloud storage provider and uses email delivery and error-monitoring providers. The list of sub-processors is [PENDING: list of sub-processors] and is updated before a new one handles Customer data. Data are hosted in [PENDING: hosting region].
6. External guests
A guest signs in with their own ARCA Compliance account; the Service keeps their name, e-mail and the channels they were invited to, and records what they post there like any other member. A guest sees only the channels they were invited to. Their access ends when the Customer removes them.
7. Your rights and contact
A person whose data appear in a Customer's channels should address requests to access, correct or delete them to that Customer, as controller; if they reach us, we forward them. Requests from the Customer or about account data go to [PENDING: contact email]. We answer within 30 days.
8. Cookies
The Service sets only a language cookie and keeps the sign-in session in the browser's storage. It uses no advertising or third-party tracking cookies.
9. Changes
Changes to this policy are announced in the Service or by email before they take effect, with the date of the last update shown at the top.