Privacy Policy

This policy explains what personal information ARKHOS handles, why, and the choices you have. ARKHOS is operated by [COMPANY LEGAL NAME], [MAILING ADDRESS] (“ARKHOS”, “we”, “us”).

1. What we collect

On this website (arkhos.dev)

• Sign-up details you type into the sign-up form: business name, your name, email, password and the type of business. They are sent directly to our application server to create your account.
• Your theme preference (light or dark), stored only in your own browser. See the Cookie Notice.
• Technical data that any web server receives, such as IP address, browser type and the page requested. Our hosting providers may log this for security and reliability.
• Emails you send us.

This website does not load advertising, analytics or other third-party tracking scripts, and our pages do not set cookies.

In the ARKHOS apps (account data)

• Account and team member details: name, email, phone, role and permissions.
• Sign-in data: a hashed password (we never store your password in readable form), two-factor authentication settings, one-time sign-in codes, and session records. If you choose “Sign in with Google”, we receive your email address and basic profile from Google.
• Subscription and billing records for your ARKHOS plan.
• Records of important actions in your account (for example sign-ins, settings changes, account deletion and AI actions), kept for security and audit.
• Product analytics, described in section 2.

Customer Data (processed for the businesses that use ARKHOS)

Depending on which features a business uses, Customer Data can include:

• Its customers’ names, phone numbers, email and service addresses, booking history, quotes, invoices, notes and property access instructions.
• Messages: SMS, email and call logs exchanged with its customers and crew, and call recordings if the business turns recording on.
• Payment records. Card numbers are entered into Square’s secure payment form and are handled by Square; they do not pass through ARKHOS servers.
• Crew and job applicant data: contact details, schedules, pay records, training progress, signed documents (with a signature audit trail) and, if the business uses it, background-check status from Checkr.
• Reviews, marketing lists and the content of AI conversations.

2. Product analytics and session recording

The ARKHOS apps (the business dashboard and the customer and crew portals) use PostHog to understand how the product is used and to fix problems. PostHog records page views and, through session recording, a replay of what happens on screen. Password fields are masked. Other form fields, including one-time sign-in codes, are currently not masked and can appear in recordings. PostHog stores an identifier in your browser to do this. This website (arkhos.dev) does not use PostHog.

3. How we use information

• To create and run your account and provide the features you use.
• To send messages and process actions you or your team request.
• To secure the service: authentication, fraud and abuse prevention, debugging and audit logs.
• To provide support and tell you about changes to the service.
• To improve ARKHOS using usage information.
• To comply with the law and enforce our Terms.

We process Customer Data only to provide the service to the business that owns it and as that business instructs. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use Customer Data to train AI models (see the AI Policy).

4. Legal bases (EEA, UK and similar laws)

Where these laws apply, we rely on: contract (to provide the service you signed up for); legitimate interests (to secure and improve the service, in ways that don’t override your rights); consent (where we ask for it, which you can withdraw at any time); and legal obligation. For Customer Data, the business that uses ARKHOS is responsible for having a legal basis.

5. Who we share information with

• Service providers that host, store, send or process data for us. They are listed on our Subprocessors page.
• Services a business connects, such as its own Square, Twilio, Quo, Gmail or QuickBooks account. Data sent to those accounts is handled under that provider’s terms.
• Legal and safety: when required by law, or to protect people, our users or ARKHOS.
• Business transfers: if ARKHOS is involved in a merger, acquisition or sale of assets, subject to this policy.

6. SMS, calls and email (TCPA and CAN-SPAM)

Businesses use ARKHOS to send texts, emails and calls to their own customers and crew from accounts they connect. Each business is responsible for getting the consent the law requires before messaging people, including prior express written consent for marketing texts under the TCPA, and for honoring opt-outs. Recipients can reply STOP to a text to stop receiving texts from that business number; ARKHOS records the opt-out. Message and data rates may apply. If a business records calls, it is responsible for giving notice and getting consent where required (some states, such as Florida and California, require consent from everyone on the call). We do not use the phone numbers or emails of a business’s customers for our own marketing.

7. How long we keep data

• Account and Customer Data: while the account is active, and for a limited period after it closes so you can export it (see the Terms), unless the law requires us to keep it longer.
• One-time sign-in codes: deleted automatically about an hour after they expire.
• Error logs and webhook delivery logs: about 30 days. Integration event logs: about 90 days. Platform event logs: about 13 months. Records of AI agent actions: about 180 days.
• Copies in backups may remain for a limited period until they are overwritten.

When you delete your ARKHOS user account, it is deactivated immediately and all of its sessions are signed out. To have the account’s data erased, email [email protected].

8. Your rights

Depending on where you live, you may have the right to:

• know what personal information we hold and get a copy of it, including in a portable format;
• correct it;
• delete it;
• object to or restrict some uses, and withdraw consent;
• opt out of the sale or sharing of personal information (we do neither);
• appeal our decision on your request; and
• not be treated differently for using these rights.

California residents (CCPA/CPRA): in the last 12 months we collected the categories described in section 1 (identifiers, contact details, commercial information such as bookings and payments records, internet activity such as product usage and session recordings, audio from call recordings where enabled, and professional information about crew and applicants) for the purposes in section 3. We disclosed them to the service providers on our Subprocessors page for business purposes. We do not sell or share personal information and we do not use sensitive personal information to infer characteristics about you.

EEA and UK residents (GDPR): you can also complain to your local data protection authority.

To make a request, email [email protected]. We will verify your identity before acting, and you may use an authorized agent. If your request is about Customer Data held by a business that uses ARKHOS, we will refer it to that business and help it respond.

9. International transfers

ARKHOS is operated from the United States, and our service providers may process data in the United States and other countries. Where the law requires it, we use appropriate safeguards for transfers, such as standard contractual clauses.

10. Security

We use technical and organizational measures to protect data, described on our Security page. No system is perfectly secure, and we cannot guarantee that data will never be accessed without authorization.

11. Children

ARKHOS is a tool for businesses and is not directed to children. We do not knowingly collect personal information from children under 16. If you think a child has given us personal information, contact us and we will delete it.

12. Changes

We will post changes here and update the date at the top. If a change is material, we will also notify account owners by email or in the app before it takes effect.

13. Contact

[COMPANY LEGAL NAME]
[MAILING ADDRESS]
Email: [email protected]