Privacy Policy

1. Who we are

Arcalix is operated by Arcalix Limited (United Kingdom company number 16423894), registered office First Floor Office, 3 Hornton Place, London, United Kingdom, W8 4LZ. For any privacy question, contact support@arcalix.uk. We process personal data in accordance with the UK GDPR and the Data Protection Act 2018.

2. What we collect

We collect the following categories of personal data:

• Account data — your name, email address, a securely hashed password, account status, and (for security) failed sign-in counts and lockout timestamps.
• Billing data — billing address, and for businesses your company name and VAT/tax identifier. Payment-card details are handled by our payment provider and are not stored by us.
• Social sign-in data — if you sign in with Google or GitHub, we receive your email, name and avatar URL, and a provider account identifier.
• Technical & usage data — session information including IP address and browser user-agent, and basic logs needed to operate and secure the Service.
• Content metadata — information about the files you upload (such as object name, size and checksum) needed to store and distribute them.

3. How & why we use it

We use personal data to provide and operate the Service, and rely on the following lawful bases:

• Performance of a contract — to create and manage your account, provide your Plan, process payments and renewals, and deliver support.
• Legitimate interests — to secure the Service, prevent abuse and fraud, maintain logs, and improve our product (balanced against your rights).
• Legal obligation — to keep tax/accounting records and respond to lawful requests.
• Consent — where you choose to sign in with a third-party provider, or where we otherwise ask for it. You can withdraw consent at any time.

We do not sell your personal data, and we do not use it for advertising or third-party tracking.

4. Who we share it with

We share personal data with the service providers ("sub-processors") that we rely on to run Arcalix. Each is bound to protect the data and use it only on our instructions:

We may also disclose personal data where required by law, to enforce our terms, or in connection with a corporate transaction (such as a merger or acquisition), subject to appropriate safeguards.

5. International transfers

Some of our sub-processors are based outside the UK (for example in the United States). Where personal data is transferred outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement / Addendum, the UK extension to the EU Standard Contractual Clauses, or an adequacy decision, so that your data remains protected.

6. How long we keep it

We keep personal data only for as long as necessary for the purposes above. In general: account data is kept while your account is active and for a reasonable period afterwards; billing, order and invoice records are kept for the period required by tax and accounting law; and security and session logs are kept for a shorter period. Specific retention periods: [to be completed].

7. Your rights

Subject to applicable law, you have the right to: access the personal data we hold about you; have inaccurate data corrected; have data erased; restrict or object to certain processing; receive your data in a portable format; and withdraw consent where processing is based on consent. Exercising these rights will not disadvantage you.

8. Exercising your rights

To make a request, email support@arcalix.uk. We may need to verify your identity, and we will respond within the time required by law (normally one month). At present, account deletion and data-export requests are handled manually through this address.

9. Cookies

We use only a small number of strictly-necessary, first-party cookies needed to sign you in and keep the Service secure. We do not use analytics or advertising cookies. See our Cookie Policy for details.

10. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, hashing of passwords, access controls and account-lockout protections. No system is completely secure; if a personal-data breach affects you, we will notify you and the relevant authority where required by law.

11. Children

The Service is intended for businesses and adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.

12. Changes

We may update this Privacy Policy from time to time. The "last updated" date above shows when it last changed. Where changes are material, we will take reasonable steps to notify you.

13. Contact & complaints

For any privacy matter, contact support@arcalix.uk. If you are in the UK and are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk — though we would appreciate the chance to resolve your concern first.