Privacy Policy

Who this notice covers

This notice explains how ArcGabriel Ltd handles personal data in two roles: as the controller of data about the people who use ArcMichael and this website, and as the processor of the client files that firms upload.

1. Visitors to this website

This site sets no cookies and loads nothing from third parties. We keep an aggregate count of pages served per day, with no identifier attached. If you submit a form we store what you typed, the page you were on and the time, and forward it to our customer-relationship system to reply to you. Lawful basis: legitimate interest in answering enquiries. We keep enquiries for two years unless you become a customer.

2. Firm users (controller)

When a firm opens an account we hold the names, work email addresses, roles, sign-in history and two-factor settings of its users, and the firm's billing details. Lawful basis: contract. We keep this for the life of the account and, for billing and audit records, six years after it ends, as tax and regulatory record-keeping requires.

3. Client files (processor)

Firms upload case files containing personal data about their clients: identity documents, bank statements, payslips, addresses, health information in protection files. The firm is the controller of this data and decides what is uploaded, how long it is retained and when it is deleted. We process it only to provide the service, under the Data Processing Agreement, and we never use it to train models or for any purpose of our own. If you are a client of a firm and want to know what it holds about you, ask the firm; you may also use our data-deletion page and we will pass the request on and act on the firm's instruction.

4. Where data goes

Document content is sent to our AI provider under a data processing agreement with zero data retention. The full list of sub-processors, what each does and where it is, is in the DPA. Data is hosted in the EEA; Network-tier firms can have inference run in the United Kingdom. International transfers rely on the UK International Data Transfer Agreement or Addendum.

5. Your rights

You have the right to access, rectify, erase, restrict and port your data and to object to processing. Write to privacy@arcmichael.com. We respond within one month. You may complain to the Information Commissioner's Office at ico.org.uk. Our ICO registration number is [ICO registration number].

6. Security

Passwords are hashed with argon2id, sessions are stored hashed, two-factor authentication is available to every user, data is encrypted in transit and backups are encrypted at rest. Access by our staff to customer data is limited to support requests and is logged.

7. Changes

We will post changes here and, for changes that matter, email firm admins. The version in force is shown at the top of this page.