Privacy policy

1. Who processes your data

The controller of personal data in Arcosy (the app at https://app.arcosy.net and the website arcosy.net) is Arcosy.

For anything about your personal data, write to [email protected].

2. What we collect

• Account data: first name, last name, email address and password (we store only its hashed form).
• Sign-in with Google: we receive only your name and email address from Google (the "email" and "profile" scopes). We have no access to your mail, contacts, files or any other data of your Google account.
• Content you and the members of your projects add: projects, rooms, files and visualizations, comments, survey answers, inspirations and product lists.
• Technical data: IP address and time of requests in server logs, needed for security and fixing errors.

3. Why, and on what legal basis

• Running your account and providing the service – Art. 6(1)(b) GDPR (contract).
• Keeping the service secure and preventing abuse – Art. 6(1)(f) GDPR (legitimate interest).
• Sending project invitations to the address given by the person inviting – Art. 6(1)(f) GDPR.

4. Who we share data with

We do not sell data and do not use it for advertising. Project content is visible only to people with access to that project; purchase prices and internal notes are visible to the project team only.

We use service providers that process data on our behalf: Cloudflare (delivering traffic and protecting the service), Google (sign-in, if you choose "Sign in with Google") and – if invitations are sent by email – an email delivery provider. Some of them may process data outside the European Economic Area under the European Commission's standard contractual clauses.

5. Data from Google

Arcosy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from Google is used only to sign you in and create your account; we do not share it with others and do not use it for advertising or to train models.

6. Cookies and browser storage

The app uses one strictly necessary session cookie (JSESSIONID), without which you cannot stay signed in. With "Remember me" ticked it lasts 30 days. In your browser's storage we keep your language, that setting and – if you tick it – your sign-in email address.

We use no analytics or advertising cookies. The arcosy.net website sets no cookies, and fonts are served from our own server.

7. How long we keep data

We keep account data and content for as long as you have an account. When you delete your account we delete your personal data; comments and files you added to other people's projects may be kept without anything that identifies you, if the other participants need them. Server logs are kept only as long as they are needed for security and fixing errors.

8. Your rights

You have the right to access, correct and delete your data, to restrict its processing, to data portability and to object. To use them – including deleting your account – write to [email protected]. You may also lodge a complaint with a data protection authority; in Poland that is the President of the Personal Data Protection Office (uodo.gov.pl).

9. Changes

We will announce important changes to this policy in the app. The current version is always on this page.