Privacy Policy

1Who This Policy Covers

This policy covers:

• Members: people who create an ARCA account
• Delegates: people a member invites to access their account
• Other people connected to a member's business: such as a member's contractors and the brands or companies that owe a member money
• Website visitors

2Information We Collect

2.1 Information you give us

• Account information: name, email address, and sign-in details, handled by our authentication provider, Clerk
• Business profile: business name, entity type, and Employer Identification Number (EIN)
• Membership billing: if you subscribe on iPhone through Apple In-App Purchase, Apple processes the payment and we receive subscription status and related billing metadata from Apple. If you use website or private invite billing, your payment card is collected and stored by Stripe on a secure Stripe web page that the app may open in your browser. For Stripe we receive the card brand, last four digits, expiration date, and billing history, not the full card number.
• Messages and files: messages you send to Ask Arca, and files you upload, such as a Twitch Creator Dashboard CSV or a tax return stored in your Vault
• Invitations: a Delegate's name and email address, and which productions they can access
• Communications: support requests, feedback, and messages you send us
• Your choices: such as whether you allow us to send your data to our AI providers

2.2 Information from accounts you connect

All of our connections are read-only. We access only the data needed for the Service.

Your bank credentials are entered directly into Plaid and are never received or stored by Arkyn. For YouTube, AdSense, Twitch, PayPal, Meta, and Patreon, you sign in with that platform, and we store the access tokens it issues so we can keep reading your data. We never receive your passwords.

2.3 Information about other people that members provide

• Contractors: name, email, mailing address, and taxpayer identification number from W-9 forms. When a member requests a W-9 through ARCA, we email the contractor and collect the form through DocuSign. We store the completed form with the tax identification number encrypted. DocuSign deletes its copy about 44 days after signing (Section 8.2).
• Payors and brands: company name, contact name and email, and invoice amounts and dates for money owed to a member

2.4 Information collected automatically

• Device and log data: device type, operating system, app version, IP address, and timestamps
• Usage data: how you interact with the app, such as screens viewed and features used
• Crash and performance data: collected through Sentry and linked to your account identifier so we can diagnose problems
• Notifications: if you turn on push notifications, we store a notification token for your device, your device platform, and your time zone. Notifications can include amounts or names, so they may be visible on your lock screen. You can turn them off in the app.
• Website analytics: getarca.co uses Google Analytics to understand how visitors use the site. Google Analytics uses cookies. You can opt out with Google's browser add-on at https://tools.google.com/dlpage/gaoptout.
• Website cookies: our website also uses cookies to keep you signed in and remember preferences. We do not use cookies for advertising.

We do not track you across other companies' apps or websites.

3How We Use Information

We use information to:

• provide the Service, including your consolidated financial view, categorization, reports, daily briefing, tax set-aside estimates, CPA packet, receivable tracking, and W-9 requests
• provide AI features, with your permission (Section 4)
• send notifications you have turned on
• calculate and bill your membership fee
• give Delegates the access you grant
• provide support and send service, security, and billing messages
• detect and prevent fraud, abuse, and security incidents
• maintain and improve the Service
• comply with legal obligations

We do not use your information for advertising, and we do not make automated decisions that produce legal or similarly significant effects about you.

4AI Processing

ARCA uses models provided by Anthropic, PBC and Reducto for three features. Each sends that company only what that feature needs.

What we do not send. Bank logins, full account or card numbers, your EIN, or your contractors' taxpayer identification numbers.

Your permission. We ask in the app before we send your data to Anthropic or Reducto for the first time. You can withdraw permission at any time under You › How ARCA uses your data. After you withdraw, we stop sending your data and these features become unavailable. Weekly insights and Ask Arca conversations created before you withdrew stay in your account. Documents you already stored in your Vault stay there; we stop sending new uploads to Reducto.

Anthropic's handling. Under Anthropic's commercial terms, Anthropic uses this data only to provide these features to us and does not use it to train its models. Anthropic deletes it within 30 days, unless it must keep it longer to enforce its usage policies or comply with the law.

Reducto's handling. Under Reducto's terms for Growth and Enterprise customers, Reducto uses documents only to provide document reading to us and does not use them to train its models. Reducto deletes them within 24 hours.

Where AI data is stored.

• Ask Arca conversations stay in your account until you delete your account.
• Vault documents. Uploaded originals are kept in Google Cloud Storage until you remove them or delete your account.
• Langfuse. We use Langfuse to monitor the quality of AI features. It keeps AI requests and responses for 30 days, does not store YouTube or AdSense data, and access is limited to authorized Arkyn personnel.

5How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We share information only as follows.

5.1 Service providers

These providers process information on our behalf and are contractually restricted from using it for any other purpose.

5.2 Platforms you connect

Google (YouTube and AdSense), Twitch, PayPal, Meta, and Patreon provide data to us at your direction. Their own privacy policies govern their handling of your data.

5.3 People you choose

Delegates you invite see the productions you give them access to.

People you choose can open a Vault document through a share link you create. Share links expire and can be revoked.

5.4 Legal and safety

We may disclose information if required by law or legal process, or to protect the rights, property, or safety of Arkyn, our users, or others.

5.5 Business transfers

If Arkyn is involved in a merger, acquisition, or sale of assets, information may be transferred to the successor, which will be bound by this policy for that information. We will notify you before any transfer. Google user data will not be transferred without your explicit prior consent. If a successor wants to use your information in a materially different way, we will tell you first and give you the chance to delete your account.

6Google User Data

This section describes how ARCA accesses, uses, stores, shares, and deletes data received from Google APIs, including YouTube API Services and the AdSense Management API. ARCA uses YouTube API Services, and your data is also subject to the Google Privacy Policy at https://policies.google.com/privacy.

6.1 Data accessed

We access the YouTube and AdSense data listed in Section 2.2 using three read-only scopes:

• youtube.readonly
• yt-analytics-monetary.readonly
• adsense.readonly

We do not request write, content management, or account administration access.

6.2 How we use it

We use Google user data only to provide user-facing features of ARCA:

• Showing your YouTube and AdSense data in ARCA, labeled as coming from YouTube or AdSense
• Writing your weekly insights and answering your Ask Arca questions, through our AI provider, with your permission

Your membership fee is calculated from payments that reach your connected bank and PayPal accounts, not from Google user data.

Google user data is not used to serve or target advertising, determine creditworthiness, make lending decisions, or build profiles for sale. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6.3 How we share it

We share Google user data only:

• with the service providers in Section 5.1 that need it to provide the Service, including Anthropic with your permission
• with Delegates you authorize
• as required by law
• to investigate security incidents or abuse

We do not share Google user data with advertising platforms, data brokers, or information resellers. Arkyn personnel do not access it, including AI requests and responses that contain it, except with your consent, or where necessary for security, legal compliance, or to investigate abuse.

6.4 How we protect it

• Google user data is encrypted in transit using TLS and encrypted at rest.
• Internal access is limited to people who need it and is logged.

6.5 Retention and deletion of Google user data

You can also revoke ARCA's access at any time through your Google account at https://myaccount.google.com/permissions.

7How We Protect Information

We use encryption in transit and at rest, access controls, and logging.

Bank credentials are handled only by Plaid. Payment cards for website billing are handled only by Stripe. App Store membership payments are handled by Apple.

No system is perfectly secure, but we work to protect your information and will notify you of a security incident as required by law.

8How Long We Keep Information

8.1 While your account is active

We keep your information while your account is active.

When you disconnect an account, you can choose to keep or delete its past transactions. YouTube and AdSense data is always deleted when you disconnect (Section 6.5).

8.2 When you delete your account

When you delete your account, your login and your ARCA data are deleted from our live systems immediately. That includes:

• connected-account data
• Ask Arca conversations
• W-9 forms
• CPA packets
• membership billing records
• records of your acceptance of these policies

Export anything you need first.

Some copies remain for a limited time:

Records our providers keep. Apple and Stripe keep their own records of your payments under their privacy policies. Deleting your ARCA account does not delete them.

DocuSign. DocuSign deletes the documents in a completed W-9 envelope about 44 days after signing: a 30-day retention period we set, plus DocuSign's 14-day purge queue. After that, a record that the envelope existed remains in DocuSign, without the form or the tax identification number.

Legal holds. We may keep information longer where the law requires it, or where it is needed to resolve a dispute or enforce our agreements.

De-identified data. We may create de-identified, aggregated information, such as benchmarks across groups of creators, from data that is not Google user data. We may keep it after you delete your account. When we do:

• we only use aggregates built from enough creators that no individual can reasonably be identified
• we take reasonable measures to keep the information de-identified
• we do not attempt to re-identify it
• we require anyone we share it with to make the same commitments

8.3 If you try ARCA without becoming a member

If you connect accounts for a free cleanup and do not join:

• We stop reading your accounts within 30 days of delivering your cleanup.
• We delete YouTube and AdSense data within 7 days of disconnection.
• We keep the cleanup itself (your sorted books and brief) for 12 months, so you do not have to start over if you come back. It does not contain YouTube or AdSense API data.
• If you ask us to delete it, we will do so within 7 days.

9Your Rights and Choices

You can:

• Access and export your data at any time in the app under You › Export my data
• Correct your information in the app, or by contacting us
• Delete your account in the app under You › Delete my account
• Disconnect any connected account in the app
• Withdraw permission for AI processing under You › How ARCA uses your data
• Opt out of non-essential emails using the link in any email

We honor requests to know, access, correct, and delete personal information from every member, wherever they live, and we will not treat you differently for making one. To make a request, contact support@getarca.co. We will verify your identity and aim to respond within 45 days.

Do Not Track. ARCA does not track you across third-party websites or apps, so our website does not change its behavior in response to browser Do Not Track signals.

Delegates, contractors, and payors can contact us at support@getarca.co about information a member has provided about them.

10Children

ARCA is not directed to anyone under 18, and we do not knowingly collect information from minors. If we learn that we have, we will delete it.

11Changes to This Policy

We may update this policy. If we change how we use Google user data, we will ask for your consent before applying the change to data already collected. For other material changes, we will give at least 14 days' notice by email or in-app notice.

12Contact