We use cookies to improve your experience

We use essential cookies for core functionality and optional cookies to personalize content and analyze traffic.
Legal document

Privacy Policy

Last updated September 30, 2026

1. Introduction

Arch Agent ("we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

The data controller responsible for your personal data is Yish-AI Ltd. (registered address to be added upon incorporation). You can reach our privacy team and Data Protection Officer using the details in the "Contact Us" section below.

By using Arch Agent, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Information You Provide

Account Information:

  • Name and email address
  • Username and password (encrypted)
  • Organization name (if applicable)
  • Payment information (processed through PayPal - we do not store credit card details)

User Content:

  • Context files you create, upload, or publish
  • Code samples and documentation
  • Comments and feedback
  • Profile information

Communications:

  • Support inquiries and correspondence
  • Feedback and survey responses
  • Email communications

2.2 Information Collected Automatically

Usage Data:

  • Pages visited and features used
  • Time and duration of visits
  • Click patterns and navigation paths
  • Search queries and filters

Technical Data:

  • IP address and location (city/country level)
  • Browser type and version
  • Device type and operating system
  • Referral source

Cookies and Tracking:

  • Session cookies for authentication
  • Analytics cookies for usage tracking
  • Preference cookies for user settings

2.3 Information from Third Parties

GitHub Integration:

  • GitHub username and profile information
  • Repository access (when you authorize import)
  • GitHub Personal Access Tokens (encrypted)

Bitbucket and GitLab Integration:

  • Bitbucket or GitLab username and profile information
  • Repository access (when you authorize import), using your own Bitbucket or GitLab access token

3. How We Use Your Information

GDPR Note: For each processing activity below, we identify the applicable GDPR lawful basis under Article 6 GDPR. For EU/EEA users, processing is only lawful where one of these bases applies.

3.1 To Provide the Service

Lawful Basis: Contract (Article 6(1)(b)) - processing is necessary to perform the contract with you (our Terms of Service).

  • Create and manage your account
  • Process payments and subscriptions
  • Store and display your context files
  • Enable marketplace browsing and publishing
  • Provide quality analysis and AI suggestions
  • Sync with GitHub repositories

3.2 To Improve the Service

Lawful Basis: Legitimate Interest (Article 6(1)(f)) - we have a legitimate interest in improving and developing our platform. This interest does not override your rights given the limited and aggregated nature of the data used.

  • Analyze usage patterns and trends
  • Identify bugs and performance issues
  • Develop new features and functionality
  • Conduct A/B testing and experiments

3.3 To Communicate With You

Lawful Basis (transactional): Contract (Article 6(1)(b)) - receipts, security alerts, and account notifications necessary to perform the service.

Lawful Basis (marketing): Consent (Article 6(1)(a)) - promotional emails are sent only with your consent. You may withdraw consent at any time by unsubscribing.

  • Send transactional emails (receipts, confirmations)
  • Notify you of account or service changes
  • Respond to support inquiries
  • Send product updates and announcements (with opt-out option)

3.4 For Security and Legal Compliance

Lawful Basis: Legal Obligation (Article 6(1)(c)) for statutory compliance requirements; Legitimate Interest (Article 6(1)(f)) for fraud prevention and security operations.

  • Detect and prevent fraud or abuse
  • Enforce our Terms of Service
  • Comply with legal obligations (tax, financial record-keeping)
  • Protect our rights and property

3.5 Summary of Lawful Bases

The table below summarizes the lawful basis for each category of processing (GDPR Article 13(1)(c)):

  • Account creation and management - Contract (Art. 6(1)(b))
  • Payment processing - Contract (Art. 6(1)(b))
  • Service delivery (context files, marketplace) - Contract (Art. 6(1)(b))
  • GitHub sync (when authorized) - Contract (Art. 6(1)(b))
  • Usage analytics and product improvement - Legitimate Interest (Art. 6(1)(f))
  • Security monitoring and fraud prevention - Legitimate Interest (Art. 6(1)(f))
  • Transactional email communications - Contract (Art. 6(1)(b))
  • Marketing communications - Consent (Art. 6(1)(a))
  • Audit log retention - Legal Obligation (Art. 6(1)(c))
  • Tax and financial record-keeping - Legal Obligation (Art. 6(1)(c))
  • Profile information (avatar, bio, website) - Consent (Art. 6(1)(a))

4. How We Share Your Information

4.1 Public Information

Published context files are publicly visible. Your username and profile may be displayed with published content. Download counts and ratings may be shown.

4.2 Service Providers

We share data with third-party service providers who assist in operating our Service, including payment processing, authentication (Clerk, United States), infrastructure, AI services, product analytics (PostHog Inc., United States), and email services.

Named infrastructure and AI-platform recipients:

  • AWS (United States, us-east-1) - hosts the Service and stores platform data at rest.
  • Clerk (United States) - authentication, including sign-in, multi-factor authentication, and session management.
  • Supabase (United States) - PostgreSQL storage for persistent platform data.
  • Cloudflare - CDN, DNS and web-application firewall for every request (IP address, user agent, HTTP headers).
  • Brevo (European Union) - transactional email delivery.
  • Google Gemini embeddings (or the configured platform embedding provider), under Arch's own Google account, are used for: Archat How-To help search (your whole chat message is the query), context-builder marketplace suggestions (your project description, tech stack, and specification text), and indexing platform How-To docs for search. All of your query text - chat messages and marketplace-suggestion input alike - is capped at 8,000 characters before it is sent. On a separate call, published-item text sent for marketplace indexing is the title, description, tags, and the first 2,000 characters of content, and the vector is stored for builder suggestions; that call does not use the 8,000-character query cap. Browsing or keyword-searching the marketplace does not send the search text to the embedding API. Your own Knowledge RAG documents are not sent through this path. Lawful basis: Contract (Art. 6(1)(b)) for you as the searcher or builder-suggestion user, and for the marketplace publisher whose content is indexed (both act under the platform's terms); Legitimate Interest (Art. 6(1)(f)) only for a third party incidentally named in a query or in indexed content. The transfer to the United States relies on the Standard Contractual Clauses in Google's Cloud Data Processing Addendum, where executed.
  • Cloudflare Workers AI (the typesafe/jev model), under Arch Agent's own Cloudflare account - used to automatically classify the complexity of an analysis request and to route chat messages sent to our assistant. This path processes truncated file content and chat-message text you submit.
  • Cloudflare KV, under Arch Agent's own Cloudflare account - used to hold short-lived OAuth grant material (including the minted access token, your user id, and your organization id) while an MCP OAuth authorization is completing.
  • GitHub Issues - if you submit a support ticket through the in-app support form, its content (your name, email address, organization id, user role, subject, category, browser user agent, current page, and free-text description) is filed as an issue in our operations repository.

Bring-your-own-key (BYOK) AI providers. If you connect your own API key: OpenAI, Anthropic, Google (Gemini API), xAI (Grok), Perplexity (which may route your query onward to other model vendors), Z.ai (GLM, hosted in China, where available), or Cursor (Cursor Cloud Agents) - content you submit for chat, code/context analysis, and generation is sent with your own key under your own account with that provider.

Scheduled cloud agents. Claude Managed Agents, Gemini Managed Agents and Cursor Cloud Agents each run a scheduled job using the organization's own connected provider credential, not a key of ours. When you schedule a run on Claude Managed Agents or Gemini Managed Agents, we additionally mint a short-lived, repository-scoped GitHub App "installation token" and place it in the request to that vendor so it can access the repositories your schedule names (for Gemini Managed Agents, a Basic-auth header on github.com and a Bearer header on api.github.com). Cursor Cloud Agents does not receive an installation token.

context-awesome.com. When you ask for curated development resources, we send a topic query, and separately a list id and section name the assistant is instructed to copy from an earlier result, to context-awesome.com, a public curated-list search service - each value capped at 200 characters; no account identifier is sent, and our assistant is instructed to send topic keywords only, never names, email addresses, code or secrets.

Product analytics is pseudonymous, not anonymous. The profile transmitted to PostHog is your internal account identifier, organization identifier, organization role, subscription tier and billing period, and any UTM attribution recorded for your account. It does not include your email address or display name. PostHog processes these events in its US region, and your client IP address is discarded rather than stored. Events raised by our servers additionally carry your organization identifier. Our lawful basis is Legitimate Interest (GDPR Art. 6(1)(f)). PostHog is a US processor; a data processing agreement and Standard Contractual Clauses covering this transfer are required and have not yet been executed.

Analytics collected by your browser, and analytics events raised by our servers, are both gated on the same consent: PostHog receives no events from either source unless you have granted the analytics cookie category. First-party analytics storage in our own database is unaffected either way - it powers in-product usage reporting and is never shared with PostHog on its own. See our Cookie Policy for details.

4.3 Legal Requirements

We may disclose your information if required by law or in response to court orders, government requests, or legal processes.

5. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. After account deletion, personal data is deleted within 30 days. Transaction records may be retained for legal compliance (typically 7 years).

5.1 Data Retention Schedule

We retain different categories of user data according to the following retention periods, as required by applicable legal obligations and business necessity (GDPR Article 13(2)(a)):

  • Audit Logs - 365 days (1 year)
  • User Sessions - 30 days
  • Email Verification Tokens - 7 days
  • Agent Chat Messages* - 90 days
  • Analysis Results* - 90 days
  • AI Usage Records* - 90 days
  • Context File Versions* - 180 days
  • Deleted User Accounts - 30 days
  • Quote Requests - 365 days (1 year)
  • Marketplace Downloads* - 365 days (1 year)
  • HIPAA Audit Logs - 2,190 days (6 years)
  • Transaction Records - 7 years

* Not currently activated: the retention sweeps for Agent Chat Messages, Analysis Results, AI Usage Records, Context File Versions, and Marketplace Downloads are defined but are not currently activated, so these rows are at present retained indefinitely rather than being deleted at the periods stated above.

HIPAA-covered customers: Customers who have executed a Business Associate Agreement (BAA) with Arch Agent are entitled to 6-year (2,190-day) retention of HIPAA-preserved audit logs as required by 45 CFR § 164.530(j) and 45 CFR § 164.308(a)(1)(ii)(D). Standard audit log categories continue to use the 365-day SOC 2 minimum.

How this is enforced today: the 365-day audit log archival sweep excludes the HIPAA-preserved categories. The separate 2,190-day HIPAA archival sweep is active and marks these rows as archived at the 6-year threshold. Archiving is in all cases a reversible metadata flag - audit logs are never hard-deleted.

6. Data Security

We implement industry-standard security measures including:

  • Encryption in transit (HTTPS/TLS)
  • Encryption at rest for sensitive data
  • Secure password hashing (bcrypt)
  • Access controls and authentication
  • Regular security audits and updates

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Your Rights and Choices

  • Access and Correction: You can access and update your account information through your account settings.
  • Data Export: You can export your context files and data at any time.
  • Account Deletion: You can delete your account through account settings.
  • Cookie Preferences: You can manage cookie preferences through your browser settings.
  • Marketing Communications: You can opt out of promotional emails via unsubscribe links.

7.6 GDPR Rights (EU Users)

If you are in the European Economic Area, you have rights to access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent. To exercise these rights, contact privacy@arch-agent.ai.

Right to lodge a complaint: You also have the right to lodge a complaint with your local EU/EEA data protection supervisory authority (GDPR Article 13(2)(d)). A list of EU supervisory authorities is available from the European Data Protection Board at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

7.7 CCPA Rights (California Users)

California residents have the right to know what personal information is collected, opt out of the sale of personal information, and request deletion. We do not sell your personal information.

8. Children's Privacy

Arch Agent is not intended for users under 18 years of age. We do not knowingly collect information from children under 18.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States and the European Union, and, if you select Z.ai (GLM), China; Cloudflare's network processes requests at edge locations worldwide. These countries may have different data protection laws. By using the Service, you consent to the transfer of your information to these countries.

For EU users: For transfers from the EU/EEA, we rely on Standard Contractual Clauses (EU Commission Decision 2021/914, Module 2: controller to processor) as our primary transfer mechanism, where executed - PostHog's SCCs for its US transfer are still pending execution.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be posted with 30 days' advance notice. Your continued use after changes constitutes acceptance.

11. Contact Us

Privacy Inquiries: privacy@arch-agent.ai

Data Protection Officer: dpo@arch-agent.ai

Data Controller / Mailing Address: Yish-AI Ltd. (registered address to be added upon incorporation).

EU/EEA Representative: As we offer services to EU/EEA residents, we are required under Article 27 GDPR to designate an EU representative. We are in the process of appointing one. Until appointed, please direct all EU data protection inquiries to our DPO contact above.

Supervisory Authority: EU/EEA users have the right to lodge a complaint with their local data protection supervisory authority. A list of EU supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.