PRIVACY & COOKIES

1. Who is responsible?

Finite Arch Limited is the controller responsible for the personal information described in this notice. Arch Development is our product-development identity. We are registered in England and Wales, company number 17204312. Our registered office is 343 Roundhay Road, Leeds, LS8 4BU, United Kingdom.

Use Contact Arch Dev for privacy questions, corrections, requests or complaints. Choose a subject such as “Privacy request” and explain what you need. You can also use the email-app option on the Contact page.

2. What we collect and why

Visiting the website

Our hosting infrastructure handles connection and request information, including an IP address, requested URL, time, browser or device information, response status and security events. We use this to deliver pages, diagnose faults and protect the service. Our lawful basis is our legitimate interest in operating a reliable and secure website.

Sending an enquiry

The contact form asks for your name, email address, subject and message. It sends these details through Resend to our company Gmail inbox, so we can read your enquiry and reply. The website does not add the enquiry to the private Arch chat system or send it to the model provider.

We use your details to understand and respond to your enquiry and maintain the related correspondence. We rely on our legitimate interest in responding to people who contact us. Where your enquiry asks us to take steps towards a contract with you, we rely on that pre-contractual purpose instead. Records needed to meet a specific legal obligation are handled on that basis.

Providing the details is voluntary, but we need a reply address and enough information to respond. The form requires all four fields. It includes a hidden anti-spam field and short-lived request counters. We do not add you to an unrelated marketing list because you contacted us.

Authorised private Arch testing

Existing testers provide authentication details directly to Supabase, the sign-in provider. The application receives a session token and account identifier; the Arch server does not receive the password entered into that sign-in form.

The restricted environment processes account and workspace identifiers, conversations, responses, saved drafts, progress and technical records needed to operate and test the application. Drafts can be saved to the server before you press Send so they can be recovered across devices. Submitted messages and relevant conversation context may be sent to OpenAI when the enabled model service is used.

Our basis for the current restricted development testing is our legitimate interest in evaluating, maintaining and protecting the system with authorised testers. Any separately agreed contractual purpose or legal obligation is considered for the processing it actually requires. Testers must use invented test information and must not enter real sensitive, confidential or investigative material.

Bridge and Console do not currently have working account access. Public registration is not offered. We will review the processing and provide updated information before wider account access or a new product service begins.

3. Cookies and browser storage

The public information pages and contact form do not currently use analytics, advertising cookies, tracking pixels, third-party embeds or external fonts. We do not set optional tracking storage on those pages, so there is no optional-cookie consent banner.

Private Arch uses browser session storage to support a requested sign-in and preserve the current tab’s progress:

This storage supports the service the tester requests; it is not used for advertising or behavioural tracking. Browser settings can clear website data. Closing a tab usually ends session storage, but a browser may restore it. Signing out is not a promise that every saved draft or server record has been deleted.

If optional storage or tracking is introduced, we will explain it and obtain any required choice before it runs. Visiting a linked external website is subject to that website’s own storage and privacy arrangements.

4. Who handles the information?

Access within Finite Arch Limited is limited to people who need it to respond to enquiries, support authorised testing or operate the service. The current services involved are:

• Railway: website hosting, request handling, operational logs and the current private-test file storage and backups. The live application and mounted volume are in the Amsterdam region.
• Resend: delivery of contact-form messages to our inbox. It processes the message content, sender details and delivery records.
• Google / Gmail: storage and handling of the company inbox and replies.
• Supabase: identity verification, sign-in and account recovery for authorised Arch testers.
• OpenAI: processing of submitted private-test prompts and relevant context when its model service is used. The integration requests no stored response object; that does not mean the provider keeps no abuse-monitoring records.

We may also disclose relevant information to professional advisers or authorities where necessary for a legal obligation, dispute or protection of rights. We do not sell enquiry details or use them for third-party advertising.

International processing

Information can be processed outside the UK. Hosting in Amsterdam does not mean every support, email or model operation stays in Europe. Resend states that message content and delivery records are stored in the United States. Google, Supabase and OpenAI also operate internationally.

The providers’ published contractual safeguards include standard contractual clauses and UK transfer addenda where applicable. Resend states that its DPA applies to every account and includes the UK Addendum. Google describes its transfer mechanisms in its privacy policy. You can ask us for information about the safeguards relevant to your data.

Provider references: Railway data-processing terms, Resend storage, retention and transfer information, Google privacy policy, Supabase data-processing terms and OpenAI API data controls.

5. How long information stays

Different records have different purposes. There is no single retention period for everything:

• Enquiries and replies: correspondence remains in the company mailbox while the enquiry or resulting relationship is active, and afterwards where needed to record an agreement, resolve a dispute or meet a legal obligation. The criteria are the enquiry’s status, the continuing need for the correspondence and any applicable legal period. There is no automatic blanket deletion schedule for the mailbox.
• Delivery records: Resend publishes a 30-day email/log retention period for its standard Free, Pro and Scale plans, with configurable arrangements for Enterprise. Its published backup period is seven days. These provider periods are separate from the copy delivered to our inbox.
• Website and security records: hosting logs and short-lived rate-limit information support diagnostics and abuse prevention. Hosting retention depends on the service plan and provider settings; relevant incident records may need to be retained while an issue is investigated.
• Private-test records and backups: conversations, drafts and associated records remain while needed for continuity, recovery and evaluation of the restricted test, subject to a valid deletion request or the end of that purpose. No universal automatic age-based deletion rule is claimed for the current test environment. Removing a live record does not immediately remove every backup copy.

You may ask us to explain the retention applying to your information or request deletion. We will consider the applicable rights and any specific reason a record must be retained, rather than promise deletion that has not occurred.

6. Your choices and rights

Depending on the circumstances, you can ask to access your personal information, correct it, erase it, restrict its use or receive portable data. Where a particular activity relies on consent, you can withdraw that consent without affecting the lawfulness of earlier processing.

Use Contact Arch Dev to make a request. We may need proportionate information to confirm identity and locate the relevant records. We normally respond within one month, with any permitted extension or limitation explained.

You can complain to the Information Commissioner's Office. You do not have to exhaust our complaints process before contacting the ICO.

7. Sensitive information, children and automated decisions

Please do not put passwords, payment-card details, sensitive personal data or confidential case material in an initial enquiry. The restricted beta is not intended to process real sensitive data and is not a public service for children.

The public website does not make solely automated decisions about individuals that produce legal or similarly significant effects. The AI Node score assesses evidence about our organisation; it is not used to decide an individual’s eligibility, access or rights.

8. Changes to this notice

We will update this page when the purposes, providers, product access or storage arrangements materially change. The date at the top identifies this version. A new processing purpose may require additional notice or a choice before it starts.