Privacy policy
This policy explains what ARCA Vault stores, why, how it is protected and for how long. The Customer that uploads documents is the controller of the personal data they contain; ARCA Compliance processes those data on its behalf to provide the Service.
This text is a draft prepared for legal review. It is not final, it may change before ARCA Vault is offered commercially, and the passages marked as pending have yet to be completed by ARCA Compliance.
1. What we store
Documents: the files the Customer uploads, every version of them, and the names, descriptions, tags, dates, categories, folders and links the Customer gives them. The Service does not read their contents beyond what is needed to store them, scan them for malware, generate previews and index their names and metadata for search. When the Customer turns on search inside documents, the Service also extracts the text of each document (with OCR for images and scanned PDFs) and keeps an index of its words in its database, apart from the encrypted files; turning it off deletes that index.
Shares: who shared what with whom, the permission granted, the message and the expiry date, the e-mail address of a recipient outside the organization when the Customer gives one, and the protections set on the link (a hash of its password, never the password itself; its download limit; its watermark).
Activity: every upload, download, preview, share, move, rename, deletion and restore, and every change to the settings, the retention rules, the legal holds and the file requests, with the person who did it, when and from which address.
Account and usage data: the people who sign in through the ARCA Compliance platform, their roles, the storage the organization uses and technical logs.
File requests: what the Customer asks for and where the files go, and, for each file received, the name and e-mail address the sender typed (the address encrypted at rest), their note, and when and from where they sent it.
2. Why
To keep the Customer's documents and give them back intact, to let it organize and share them, to recover what it deleted during the retention period, to keep the activity its auditors may ask for, to measure usage against the plan, to operate and secure the Service and to meet legal obligations. We do not use these data for advertising, we do not sell them and we never use one Customer's documents for another.
3. Protection
Every document is encrypted with a key of its own before it is stored, and the storage encrypts it again at rest. Each organization's data are kept apart at the database level and reached only by its own members, according to their roles; a private document is reached only by its owner. Downloads use signed links that expire. Connections use TLS and people are authenticated by the ARCA Compliance platform.
4. Retention
Documents are kept for as long as the Customer keeps them. A deleted document stays in the trash for the period the Customer sets in Settings (30 days unless it chooses another, from a week to ten years) and is then purged, with every version, unless a retention rule the Customer set or a legal hold still keeps it. Shares expire on the date set or when revoked; the record of a share is kept with the activity. Activity is kept for at least 5 years. Technical logs are kept for [PENDING: log retention period].
5. Sub-processors
The Service runs on cloud infrastructure, stores the encrypted documents with a cloud storage provider and uses email delivery and error-monitoring providers. The list of sub-processors is [PENDING: list of sub-processors] and is updated before a new one handles Customer data. Data are hosted in [PENDING: hosting region].
6. People outside the organization
A person who receives an external share link gives no account and no data beyond the address the Customer entered; the Service records when the link is opened and from where, to show the Customer the use of its shares. The link stops working when it expires, is revoked or reaches its download limit. A person who sends files through a file request gives the name and the address they type, which the Customer sees with the files, and the Service records when and from where they sent them.
7. Your rights and contact
A person whose data appear in a Customer's documents should address requests to access, correct or delete them to that Customer, as controller; if they reach us, we forward them. Requests from the Customer or about account data go to [PENDING: contact email]. We answer within 30 days.
8. Cookies
The Service sets only a language cookie and keeps the sign-in session in the browser's storage. It uses no advertising or third-party tracking cookies.
9. Changes
Changes to this policy are announced in the Service or by email before they take effect, with the date of the last update shown at the top.