ArcMichael — Privacy Policy
Version 1.1 — August 2026
Issued alongside version 1.1 of the Terms of Service. What changed is in the legal changelog.
ArcMichael is operated by ArcGabriel Ltd, a company registered in England and Wales (company no. 17389329), registered office Carlile Institute Business Centre, 54 Huddersfield Road, Meltham, Holmfirth HD9 4AE ("we"). ArcMichael is a trading name of that company, not a separate one. We comply with the UK GDPR and the Data Protection Act 2018, and we are registered with the Information Commissioner's Office as a data controller under registration number [ICO registration number]. This policy says what we collect, why, and your rights — briefly and honestly.
Two roles, and which one applies
For your firm's own account we are the controller. The names and email addresses of the people on your account, your firm's details, your billing record, your sign-ins and the activity ledger: we decide what to hold and why, and this policy explains it.
For your clients' data we are your processor. The documents on a case file — identity, income, bank statements, credit reports, advice letters — the findings and reports produced from them, the client and product records you keep, and the messages you send: that is your firm's data about your clients. You are the controller; we hold it and work on it on your instructions, and on nobody else's. The terms governing that are Schedule 1 to the Terms of Service, drafted to satisfy Article 28 of the UK GDPR, so you do not need a separate agreement from us.
The practical difference: for your own account, ask us. For your clients' data, you decide — and the Service gives you export, deletion with a preview and a recovery window, and a record of every folder permission you granted, without needing to ask anyone. The firm remains responsible for the regulatory decisions taken on a file; the Service proposes findings, and a named person at the firm decides.
If you are a client of a firm that uses ArcMichael
Your mortgage or protection adviser's firm is the controller of your file. It uses ArcMichael to check that file against a published rule-set and to keep its compliance record, which the Financial Conduct Authority's rules require it to keep. We process your documents only on the firm's instructions, in the way described in the next sections, and we do not use them for anything else. If you want your data corrected or deleted, the quickest route is the firm itself; you can also use our data deletion form, and we will identify the firm, pass your request to it and make sure it is answered within one month.
What we collect as controller, and why
| What | Why | Basis |
|---|---|---|
| Name, email, role, password hash, second-factor secret (encrypted), sign-in times and IP addresses of each person on the account | To run the account, sign people in securely, and show the firm who did what | Contract; legitimate interest in security |
| Firm details: legal and trading names, address, Companies House number, FCA reference number, VAT number, network, logo, colour | To set up the account, print reports and invoices correctly, and meet tax law | Contract; legal obligation |
| Billing: plan, subscription state, invoice copies, the billing contact and purchase-order reference, and a count of the checks and messages used against the plan's monthly allowance. Card details are held by Stripe, never by us | To charge what was agreed, to show you where you stand against your allowance, and to keep the records VAT law requires. The count is never used to bill you: there are no usage charges | Contract; legal obligation |
| The activity ledger: every action on the account with the actor, time, IP address and what it touched | To give the firm an audit trail, to investigate disputes and security events | Legitimate interest; the firm's regulatory record-keeping |
| The signed Terms, with the signer's name, IP address and time; each acknowledgement of a later version of the Terms, with the same details; and each folder permission with its wording hash | Evidence of the agreement, of each change accepted, and of each consent | Legal obligation; contract |
| Support correspondence | To answer you | Legitimate interest |
| Website enquiries forwarded from our marketing site (name, email, firm, message) | To reply to you | Legitimate interest; consent where you asked to be contacted |
We do not profile anyone, and we make no automated decision with legal or similarly significant effect about any person: the findings the software proposes are confirmed or overridden by a person at your firm before anything turns on them.
What we process on your behalf, as your processor
Documents and the fields extracted from them; the classification and confidence of each document; the findings, their evidence pointers, the decisions taken and the report; the client and product records built from confirmed extractions or entered by hand; the messages queued and sent, the consents recorded, and the review requests made; the folder permissions you grant and what was read under each.
Model inference: parts of a review are carried out by a large language model (Anthropic's Claude; or, for Network-plan firms that choose it, the same models on Amazon Web Services Bedrock in London). Document text is sent fenced as data, with the instruction not to follow anything inside it; each call is logged with its cost; nothing is retained by the provider after the call and nothing is used to train any model.
Where it lives and who touches it
The application and its database run in the European Economic Area, and the off-box backups are stored there. These are every sub-processor we use and what each does:
| Who | What they do | Where | Touches your clients' data? |
|---|---|---|---|
| Railway | Hosts the application and the database | EU | Yes — it is where the Service runs |
| Cloudflare | Off-box encrypted backups (R2 object storage, EU jurisdiction); DNS and network protection | EU / global edge | Yes — backups include everything, encrypted |
| Anthropic | Model inference for document classification, extraction and reasoning | United States, zero-retention terms, IDTA in place | Yes — the text of documents under review, fenced as data |
| Amazon Web Services (Bedrock, London) | UK-resident model inference, for Network-plan firms that choose it | United Kingdom | Yes — as above, for those firms only |
| Microsoft (Microsoft Graph) | Reads the OneDrive folders you have granted permission for, and writes reports back where you allow it | Your own Microsoft tenancy | Yes — the files in the folders you chose |
| Stripe | Takes payments, issues the invoice of record, validates VAT numbers; we never see card details | EU / US | No |
| Resend | Sends the Service's emails (sign-in, invoices, notifications, and the client emails you configure) | US, IDTA in place | Only the client emails you send through the Service |
| Twilio | Delivers the WhatsApp and SMS messages you configure | US, IDTA in place | Only the messages and numbers you send to |
| ArcGabriel (our marketing product) | Receives client contacts that hold a recorded marketing basis, only where your firm has linked the two accounts, and returns campaign results in aggregate | EU | Only those contacts, only while the link is active; never a case, document, finding or grade |
That is the list. Where personal data reaches a company established outside the UK, the transfer relies on UK adequacy regulations or on the International Data Transfer Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment behind it. If the list changes we will tell you at least 30 days before it does, and this policy changes with it.
How long we keep it
Retention is by class, shown on the firm's Settings page and on every deletion preview:
- Source documents: for the period the firm sets — 30 days after the
review is shared by default, bounded by the rule-set; or analyse-and-discard, which deletes them the moment each review completes. Then erased and the erasure logged.
- **Findings, reports, decisions and document hashes — the compliance
record**: six years from the review, which is what the FCA's record-keeping rules expect of mortgage and protection business. A firm that wants them gone sooner deletes the case, and that deletion is recorded as the firm's instruction; where a report has been shared, the minimised record (rule, severity, decision, grade, dates, hash) is kept under Article 17(3)(b).
- Client and product records: while the firm keeps them; deletion is
immediate with a seven-day recovery window.
- Messages: the record of what was sent and to whom is kept with the
client; message bodies are purged after 90 days.
- Closed review-request records: twelve months after they close.
- Folder permissions: for the life of the account, with their revocation,
because they are the evidence of the consent.
- The activity ledger: sign-ins, billing, consents, reviews, sharing and
deletions indefinitely; operational noise for twelve months. When an account is deleted the people the rows referred to are gone, so what remains is an action, a time and an address.
- Invoices, the signed Terms and the acknowledgement of any later version:
for the statutory period (six years). A signed copy is never altered or replaced when a new version is published.
- The whole account: 90 days after cancellation so you can return or
export, then erased, except the records above that the law requires.
- Backups roll: 14 days on the machine, 35 days off-box. Anything erased
from the live Service disappears from the backups as that rotation completes, and is never restored back in.
Your rights
Access, rectification, erasure, restriction, portability, and objection — ask at hello@arcmichael.com and we respond within one month. Where the data is your clients' rather than yours, the request belongs to your firm as controller and the Service lets you act on it yourself immediately; if one of your clients contacts us directly, we will not answer for you — we will tell you promptly, record the request, and let you handle it.
You also have the right to complain to the Information Commissioner's Office (ico.org.uk). We will notify you and the ICO of any breach where the law requires it; where a breach affects data we hold on your behalf, we will tell you within 24 hours of becoming aware of it so that you can meet your own 72-hour duty.
Cookies
The Service uses only strictly necessary cookies (your sign-in session, the onboarding state and the second-factor enrolment state). No advertising or cross-site tracking cookies. Our public website counts page views without a cookie and without identifying anyone.