Privacy
Policy

1. Introduction

Arca acts as an intelligent financial agent on your behalf: it reads, interprets, and surfaces insights from your connected financial accounts and creator revenue sources. All actions taken by Arca are read-only unless you explicitly authorize otherwise in the future. By accessing or using Arca, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide

• Account registration details (name, email address, password)
• Subscription and billing information (processed by third-party payment processors; we do not store full payment card data)
• Communications you send us (support requests, feedback)

2.2 Financial Data via Plaid

To power Arca's financial intelligence, the app connects to your financial institutions through Plaid Technologies, Inc. on a read-only basis. Data accessed includes:

• Account balances and account identifiers
• Transaction history and categorization
• Income and cash flow data

Your financial institution credentials are entered directly into Plaid's secure interface and are never transmitted to or stored by Arkyn. Plaid's privacy policy governs their handling of your credentials and data.

2.3 Usage and Technical Data

• Log data (IP address, browser type, app pages visited, timestamps)
• Device identifiers and operating system information
• Cookies and similar tracking technologies (see Section 8)

3. How We Use Your Information

• To power Arca's agentic AI features, including financial analysis, insight generation, and personalized recommendations within the app
• To display your consolidated financial picture across all connected sources
• To process your subscription and manage your account
• To communicate with you about app updates, security alerts, and support
• To detect and prevent fraud, abuse, and security incidents
• To comply with applicable legal obligations

We do not use your data for automated decision-making that produces legal or similarly significant effects without your explicit consent.

4. We Do Not Sell Your Data

Arkyn does not sell, rent, or trade your personal information or financial data to third parties for their marketing or commercial purposes. Our business model is subscription-based — your subscription fees, not your data, are how we sustain operations.

Data accessed through Google APIs is never sold, transferred for advertising purposes, used to serve targeted ads, or used in any way beyond delivering Arca's core service to you.

5. How We Share Your Information

Service Providers

We engage trusted third-party vendors who assist in operating the app (e.g., cloud hosting, payment processing, analytics). These parties are contractually restricted from using your data for any purpose other than providing services to Arkyn.

Third-Party API Partners

When you connect financial accounts (Plaid), YouTube, or AdSense, your data flows through those respective services, subject to their own privacy policies.

Legal Requirements

We may disclose information if required by law, court order, or government request, or to protect the rights, property, or safety of Arkyn, our users, or others.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you and obtain your explicit prior consent before your data is transferred and becomes subject to a different privacy policy.

6. Google User Data — Full Disclosure

Arca connects to Google services via OAuth 2.0 on your behalf. This section provides the full, required disclosure of how Arca accesses, uses, stores, and shares Google user data, in compliance with the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy) and the Google APIs Terms of Service (https://developers.google.com/terms).

6.1 Data Accessed

Arca connects to the following Google APIs on a read-only basis:

YouTube Data API — When you connect a YouTube channel, Arca accesses:

• Channel analytics: views, watch time, and estimated revenue
• Video and content performance metrics
• Subscriber counts and audience data

AdSense Management API — When you connect a Google AdSense account, Arca accesses:

• Ad revenue earnings and payment history
• Ad unit performance metrics (impressions, clicks, RPM)
• Account balance and scheduled payout information

Arca requests only the minimum scopes necessary to display your revenue data. We do not request write access, content management, or account administration scopes.

6.2 Data Usage

Google user data accessed by Arca is used solely for the following purpose: to display your YouTube and AdSense revenue within the Arca app as part of your unified financial picture.

Specifically, this data is used to:

• Aggregate your creator revenue alongside your other financial data within the Arca app
• Generate AI-powered insights about your income trends and cash flow patterns
• Surface personalized recommendations based on your complete financial picture

Google user data is NOT used to:

• Serve, target, or optimize any advertising (including retargeting or interest-based ads)
• Determine creditworthiness or make lending decisions
• Build profiles for sale or transfer to any third party
• Support any purpose not directly related to providing the Arca app to you

If we introduce new uses of Google user data, we will update this Privacy Policy and prompt you to consent before any new use takes effect.

6.3 Data Sharing

Arca does not share your Google user data with third parties, except in the following strictly limited circumstances:

• Infrastructure providers: We use cloud hosting and infrastructure providers (e.g., AWS or equivalent) who may process data on our behalf. These providers are contractually bound to use data only to provide services to Arkyn and may not use it for any independent purpose.
• Security: We may share data to investigate or address security incidents, bugs, or abuse — but only to the extent necessary to resolve the issue.
• Legal compliance: We may disclose data if required by applicable law, regulation, or valid legal process.
• Business transfer: In the event of a merger, acquisition, or sale of assets, data may be transferred only with your explicit prior consent.

We do not share Google user data with advertising platforms, data brokers, information resellers, or any third party for commercial purposes. We do not allow any employees, contractors, or agents to access Google user data unless it is strictly necessary for security, legal compliance, or to deliver the Arca service, and only after appropriate authorization.

6.4 Data Storage and Protection

Google user data accessed by Arca is stored and protected as follows:

• Encryption in transit: All data transmitted between your device, Arca's servers, and Google's APIs is encrypted using TLS (Transport Layer Security).
• Encryption at rest: Google user data stored on Arca's servers is encrypted at rest.
• Access controls: Access to Google user data within Arkyn's systems is restricted on a need-to-know basis. All internal access is logged and auditable.
• Security assessments: We conduct regular security reviews of our systems and infrastructure, and comply with applicable security assessment requirements for sensitive and restricted Google API scopes.
• No human access: Arkyn employees and contractors do not read your Google user data unless you have given explicit consent, or it is necessary for security purposes, legal compliance, or to investigate abuse.

6.5 Data Retention and Deletion

Retention: Arca retains Google user data for as long as your account is active and you have connected the relevant Google service. Data is refreshed periodically to keep your financial view current.

Disconnection: You may disconnect your YouTube or AdSense account at any time through your Arca app settings. Upon disconnection, we will stop collecting new data from that source and will delete previously collected Google user data from that source within 30 days.

Account deletion: Upon deletion of your Arca account, all associated Google user data will be deleted from our systems within 90 days, except where retention is required by applicable law.

Revoking OAuth access: You may also revoke Arca's access to your Google account at any time directly through Google's security settings at myaccount.google.com/permissions. Revoking access through Google will immediately prevent Arca from accessing new data; existing cached data will be deleted within 30 days.

To request deletion of your data or to ask questions about our data handling practices, contact us at privacy@getarca.co.

7. Cookies

We use cookies and similar technologies to keep you logged in, remember your preferences, and understand how you use Arca. You can control cookie settings through your browser or device settings. Disabling certain cookies may affect app functionality.

Arca does not use cookies to serve third-party advertising.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Object to or restrict certain processing activities
• Data portability (receive your data in a machine-readable format)

To exercise any of these rights, contact us at privacy@getarca.co. We will respond within 30 days.

9. Children's Privacy

Arca is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that a minor has provided us personal information, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we change how we use Google user data, we will notify you and obtain your consent before applying those changes to previously collected data. For other material changes, we will provide at least 14 days' notice via email or in-app notice.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Arkyn Inc. — June 4, 2026