ArcMichael — Terms of Service

Version 1.1 — August 2026

What changed between version 1.0 and this version, in plain English, is in the legal changelog. In short: there are no usage charges and no paid extra seats. A plan includes a number of checks a month and a number of people; when either is reached, the firm moves up a plan.

These Terms are a contract between you (the regulated firm subscribing, "you", "the Firm") and ArcGabriel Ltd trading as ArcMichael ("we", "us", "the Service"), a company registered in England and Wales (company no. 17389329). By signing during onboarding you agree to them. They are written to be readable, and the Schedule at the end is the data processing agreement required by Article 28 of the UK GDPR.

1. What the Service is — and is not

ArcMichael is software for mortgage and protection intermediaries. It reads the documents on a case file, checks them against a published rule-set (the ArcMichael Rule-Set, versioned and shown on every report), proposes findings with the evidence for each, and produces a report once a named person at your firm has confirmed, overridden or resolved those findings. It also keeps a record of your clients and their products, sends the messages you configure, asks your clients for reviews where you have a lawful basis to, and gives you dashboards of the lot.

The Service proposes; your firm decides. Every finding is a proposal made by software against the documents supplied. The regulatory judgement on a file — whether advice was suitable, whether a file is complete, whether a case may proceed — is yours, made by a person your firm has authorised, and the report records who made it. ArcMichael is not a compliance consultant, does not give regulated advice, is not approved or endorsed by the Financial Conduct Authority, and does not discharge any obligation you have under FCA rules, the Consumer Duty, your network's requirements or the law. A "Pass" on a report means the documents satisfied the checks that ran, nothing more.

What it cannot see it cannot check. The Service reads what is uploaded or what is in the folders you connect. A document that is missing, unreadable, or classified wrongly by the model and not corrected by you is reported as such; it is not guessed at. The rule-set lists the checks that do not run in the current release, and every report names them.

Model output is fallible. Part of the review is performed by a large language model. It is fenced (document text is treated as data, never as an instruction), bounded (each call is logged with its cost, and each firm has a monthly ceiling), and its low-confidence findings are shown as advisories for a person rather than counted. It can still misread a figure or a date. That is why a person confirms before anything is shared.

2. Your account and your people

You get an account for your firm. The person who signs these Terms is the account holder: they can add and remove administrators and advisers, hand the account to another administrator, and are the only person who can cancel or change the plan. Administrators manage the firm and confirm findings. Advisers see their own cases and what an administrator shares with them; they cannot reach any firm-administration function, and that is enforced on every request.

How many people may be on the account is part of the plan, and is described in paragraph 3. There are no seats to buy one at a time.

Keep passwords secret. Two-factor authentication is available to everybody and an administrator can require it of everybody. Every action on the account is recorded against the name of whoever took it, and that record is yours to see.

3. Subscriptions, payment and cancellation

What a plan includes, and what it costs. Plans, allowances and prices are as shown at checkout and on our pricing page, exclusive of VAT. Every plan includes a fixed number of checks each calendar month and a fixed number of people on the account. Those two numbers, and the price, are the whole commercial arrangement:

arrears — not checks, not messages, not storage. The invoice for a period is the plan price for that period, plus VAT, and nothing else. You cannot receive a bill for a busy month that you had no chance to decline.

not sold one at a time.

At the monthly check allowance, a new check is refused with one sentence and a link to change plan; checks already queued or running finish, and nothing you already have is affected. At the number of people, adding another person is refused the same way. Nothing is charged in either case, and nothing happens silently.

remainder of the period you have already paid for. The figure is shown to you before you confirm it, and that is the figure charged. A downgrade takes effect at the end of the period you have already paid for; until then you keep everything your current plan includes.

each calendar month; a quiet month does not lend anything to a busy one.

Payment.

subscription runs to the end of the period already paid, which is your only minimum commitment, and does not renew after that.

automatically unless cancelled before renewal. We email you 30 days before.

Debit or invoice on the Network plan. Stripe's invoice is the tax invoice of record; we also store a branded copy carrying your legal name, address, VAT number, purchase-order reference and Companies House number, and email it to your billing contact when it is paid.

If a payment fails. It is usually an expired card. This is exactly what happens, in order, and nothing else:

  1. Straight away — we email you: what was declined, how much, when your

bank will be asked again, and a link to pay. Everything keeps running.

  1. After 48 hours unpaid — new reviews pause. **Nothing you already have is

touched.** Every report, finding, document under retention and record stays in your account and stays downloadable; you can still sign in, export, and pay.

  1. Paying restores everything immediately, with nothing lost.
  2. If Stripe gives up on the card, the subscription ends and the retention

period in paragraph 8 of the Schedule begins.

Prices may change with 30 days' notice by email; a change never applies inside a period you have already paid for.

4. What we need from you

for the purpose of checking and keeping the firm's own compliance record.

processed by ArcMichael on your behalf. Our Privacy Policy gives you the wording you need.

recorded a lawful basis in the Service. The Service refuses to send when no basis is recorded; recording one that does not exist is your breach, not its.

them when they leave.

5. Your records, deletion and the recovery window

Reports, findings, the decisions taken on them and the hash of every document reviewed are the firm's compliance record and are kept for six years from the review, which is the retention the FCA's record-keeping rules expect for mortgage and protection business. Source documents are kept for the period you choose (30 days after the review is shared by default; "analyse and discard" deletes them as soon as the review completes), then erased and the erasure logged.

You can delete a document, a case or a client at any time. Deletion is shown to you first — what goes and what stays — then applied with a recovery window (seven days by default) during which it can be reversed, and then completed. Where a review has been shared, the minimised compliance record (rule, severity, decision, grade, dates, document hash) is kept under the legal-obligation exemption in Article 17(3)(b) and the deletion note says so.

You can export everything we hold for you, at any time, from your account, as one file.

6. Acceptable use

Do not use the Service to process documents you have no right to; to send messages without a lawful basis; to attempt to reach another firm's data; to probe, load-test or reverse-engineer the Service; or to submit content designed to alter the model's instructions. We may suspend an account that is doing any of these, and we will tell you when we do.

7. Service availability and changes

We aim for the Service to be available at all times and we publish what happened when it was not. Planned maintenance is announced in advance. We may change, add or remove features; we will not remove a feature you rely on without 30 days' notice, and the rule-set is versioned so that a report always says which version it was produced against.

The Network plan carries a written service level agreement; the other plans do not.

8. Liability

Nothing in these Terms limits liability for death or personal injury caused by negligence, for fraud, or for anything that cannot lawfully be limited.

Subject to that: we are not liable for regulatory decisions your firm takes, for the consequences of a finding the Service did not raise or raised wrongly where the documents supplied did not support the check, for loss of profit, revenue, business or goodwill, or for indirect or consequential loss. Our total liability to you in any twelve-month period is limited to the fees you paid us in that period. You remain responsible to your clients, your network and your regulator for the advice you give and the files you keep.

9. Governing law and jurisdiction

These Terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

10. Changes to these Terms

We may update these Terms. Each version is numbered and dated, and the copy you signed is kept exactly as you signed it, with its hash, in your account's documents — a new version never alters or replaces it.

When we publish a new version, this is what happens and nothing else: the next time an administrator signs in, a notice says the Terms have changed and links to a plain-English summary of what changed, version by version. An administrator acknowledges it, and that acknowledgement — who, when, from where, which version they held and which they accepted — is recorded in your activity ledger. Nobody is locked out for not having acknowledged yet, and the Service is not withheld while a notice is outstanding; the notice simply stays until somebody deals with it.

A change that materially reduces what you get, or increases what you pay, is also emailed to the account holder 30 days before it takes effect, and does not apply inside a period you have already paid for.

11. Data protection — who is responsible for what

For the documents, findings, reports, client records and messages that the Service holds for you, you are the controller and we are your processor. You decide what goes in and what comes out; we process it on your instructions under Schedule 1. For your account itself — the people on it, billing, the activity log, and our correspondence with you — we are the controller, and our Privacy Policy explains that.

We never use your clients' data for our own purposes, never sell or share it, and never use it to train any model.

Schedule 1 — Data processing terms

These terms apply where we process personal data on your behalf. They are the terms required by Article 28(3) of the UK GDPR. Where this Schedule conflicts with the rest of these Terms on a data protection question, this Schedule wins.

1. The processing, described

Subject matterProvision of the ArcMichael compliance file review, client record and messaging service
DurationFor as long as your subscription runs, plus the retention periods in paragraph 8
Nature and purposeReceiving, storing, classifying, extracting structured fields from, checking against a rule-set, reporting on, displaying back to you, backing up and erasing documents and records you upload, connect or enter, so that your firm can check and keep its own compliance record; storing client and product details you enter or confirm from those documents; sending messages you configure to people for whom you have recorded a lawful basis
Types of personal dataNames, dates of birth, addresses and contact details; identity documents; financial information (income, bank statements, credit reports, mortgage and insurance details); employment details; the contents of advice documents; images of identifiable people where they appear in documents; the firm's staff names and actions
Categories of data subjectYour clients and their joint applicants, gift donors and dependants where they appear; your staff; anyone else who appears in a document you supply
Special category and criminal-offence dataDocuments on a mortgage or protection file can contain health information (protection applications, income protection claims) and, rarely, criminal-offence data (credit and screening reports). We process it only because it is in the documents you supply and only for the checks described; the model is instructed not to reproduce it beyond what a finding needs; you remain responsible for having a lawful condition under Article 9 / Schedule 1 DPA 2018 for holding it in the first place

2. We act only on your instructions

We process that personal data only on your documented instructions, which are: these Terms, the choices you make in the Service (including the folder permissions you grant, the retention you set and the messages you configure), and anything else you ask us in writing. That includes any transfer of the data out of the UK. If we are ever required by law to process it otherwise, we will tell you first unless the law forbids us from saying so.

If we think an instruction of yours breaks data protection law, we will tell you straight away and we may decline to carry it out until it is resolved.

We will not use your clients' personal data for our own purposes, will not sell or share it, and will not use it to train artificial-intelligence models — ours or anyone else's. Our model providers are contractually bound to the same.

3. Confidentiality

Everyone we allow near that data is bound to keep it confidential, whether by their employment contract or by a written undertaking. Access is limited to those who need it to run the Service for you, and every time a member of our staff reads your firm's record from our console it is logged and shown in your own activity ledger.

4. Security

We keep the technical and organisational measures required by Article 32. As at this version those include: encryption in transit throughout (HTTPS only, with HSTS); stored credentials — second factors, OneDrive tokens, integration keys — encrypted at rest with a key held outside the database and outside every backup; passwords stored using a modern memory-hard hash; two-factor authentication mandatory for our own administrative accounts and available to every person on yours; strict separation of one firm's data from another's, enforced in the data layer; document text fenced as untrusted data in every model prompt, with model output never executed; a monthly model-spend ceiling per firm and a global switch; an append-only activity log; daily encrypted off-site backups with a documented and rehearsed restore; and least-privilege access, with administrative access held by the company's director alone.

Security measures change as threats do. We may vary them, provided the protection does not fall below the level described above.

5. Sub-processors

You give us general authorisation to use the sub-processors listed in the Privacy Policy, which names each one, what it does and where it is. At this version they are: Anthropic (model inference, United States, zero-retention terms) and, for Network-plan firms that choose UK-resident inference, Amazon Web Services Bedrock in the London region; Microsoft (Microsoft Graph, for the OneDrive folders you connect — your own Microsoft tenancy); Stripe (payment and invoicing); Resend (email delivery); Twilio (WhatsApp and SMS delivery); Cloudflare (R2 object storage, for encrypted backups, EU jurisdiction); and Railway (application hosting, EU region). ArcGabriel Ltd's marketing product, ArcGabriel, is a recipient only where you have linked the two accounts, for the contact data the link is configured to carry, and only while the link is active.

We impose data protection terms on each of them no less protective than these, and we remain fully liable to you for what they do. If we intend to add or replace one, we will tell you at least 30 days before it starts. If you object on reasonable data protection grounds within that period we will try to accommodate you; if we cannot, you may cancel your subscription for the affected part of the Service and we will refund the unused paid period.

6. Helping you meet your obligations

Taking into account the nature of the processing, we will help you:

restriction, portability or objection. The Service is built so you can do most of this yourself, immediately, without asking us: export, deletion with a preview and a recovery window, and the public data-deletion form that routes a request to you;

impact assessment or prior consultation if you need one. Our own DPIA for the Service is available on request.

If a person contacts us directly about data you control, we will not answer them on your behalf. We will tell you promptly, record the request, and let you deal with it.

7. Personal data breaches

If there is a breach affecting personal data we process for you, we will tell you without undue delay and in any event within 24 hours of becoming aware of it, with what we know: what happened, who and what is affected, what the likely consequences are and what we are doing about it. We will keep you updated as we learn more. The duty to notify the ICO or the individuals is yours as controller; we will give you what you need to discharge it.

8. Return, retention and deletion

You can export your data at any time from your account: one file with every record and every document we hold for you, built on demand and downloaded straight away.

Retention follows the classes shown on your Settings page and on every deletion preview: source documents for the period you choose (default 30 days after the review is shared; or analyse-and-discard); findings, reports, decisions and document hashes — the compliance record — for six years; signed agreements and invoices for the statutory period; the activity ledger's dispute-relevant records (sign-ins, billing, consents, reviews, deletions) indefinitely and operational noise for twelve months; closed review-request records for twelve months.

Erasure of the whole account is asked for from the Data page, by the account holder, and we carry it out without delay — the request is recorded, we confirm it by email when it is done, and nothing is deleted while you can still change your mind. When your subscription ends, we keep your data for 90 days so you can return or export it, and then erase it, except where the law requires us to keep something (invoices, and the signed copy of these Terms).

Backups follow their own cycle and are overwritten in rotation; anything erased from the live Service disappears from backups as that rotation completes, and is not restored.

9. Audit

We will make available the information you reasonably need to show that we are meeting these obligations, and will allow and contribute to audits — including inspections — by you, your network or an auditor you appoint, on reasonable notice, no more than once a year unless a breach or a regulator gives cause. In practice we expect a written questionnaire to be the sensible way to do this and we will answer one properly.

10. International transfers

Your clients' personal data is stored in the United Kingdom or the European Economic Area. Model inference takes place in the United States under zero-retention terms unless your plan uses UK-resident inference; that transfer is covered by the International Data Transfer Addendum to the EU Standard Contractual Clauses together with a transfer risk assessment. Where any other sub-processor is outside the UK, the transfer is covered by UK adequacy regulations or the same Addendum. We will not move the processing outside the UK or the EEA beyond what this paragraph describes without telling you first.

ArcGabriel Ltd, trading as ArcMichael, registered in England and Wales, company no. 17389329. Registered office: Carlile Institute Business Centre, 54 Huddersfield Road, Meltham, Holmfirth HD9 4AE.

Questions: hello@arcmichael.com.