Arcnorm — Privacy Policy

This Privacy Policy explains how MB Arcnorm ("Arcnorm", "we", "us") collects, uses, and discloses information when you access or use the Arcnorm Service at arcnorm.com — the regulatory-research assistant, reference features, and related services (the "Service"). Arcnorm is a professional research tool that returns machine-generated answers grounded in and cited to official regulatory text; it does not provide legal advice. By using the Service you agree to the processing described in this Policy.

The controller is MB Arcnorm, Vilnius, Perkūnkiemio g. 19 / LT-12120, 308127141, Republic of Lithuania. Where another entity provides a jurisdiction-specific version of the Service, we will identify it to you.

a. Information you provide.

• Account and identity details. Account creation, sign-in, and profile management are handled by Clerk, our identity provider. Clerk processes your name, email address, and credentials. Arcnorm's backend stores only a pseudonymous, encoded user identifier produced by Clerk and does not store your raw credentials or profile data directly. Arcnorm may store application settings and preferences (for example UI language) so they can follow you across devices. If you take out a paid subscription, your account name and email address are also passed to our payment processor, Stripe, and held there on the customer record so that invoices, receipts, and payment notices can be issued to and delivered to you. See §4 and §5.
• Inquiries and content you submit. Your questions and prompts, and any reference material you submit where offered. We process these to retrieve the relevant official text and generate an answer. If you use a team (organization) workspace, questions your organization has already researched and questions a member saves to the organization are visible to the other members of that organization; they are not shared outside it.
• Feedback you send us. When you report a wrong answer, or ask for a feature, the note you write, the reason you pick, and the technical details needed to reproduce it — the page, the query, the model and prompt versions, and the identifiers of the documents or answers involved — are forwarded to Linear, our issue-tracking processor, as a customer request. We keep no separate copy of a report on our own infrastructure. If you leave an email address for a reply, it is forwarded with the request.
• Business-contact details. Where we send business-to-business outreach, we obtain professional contact details directly from you or from public professional sources and hold the contact details and organisation information in outreach records (see section 7). Only B2B contacts are used; you may object at any time and opt-outs are honoured.

b. Information collected automatically.

• Usage and analytics. We use PostHog (EU residency) for product analytics to understand usage and improve the Service. Once you accept analytics, this includes page views, questions and answer events, ratings, share views, device/browser identifiers, and interaction patterns. Before you answer the cookie banner, a separate anonymous measurement counts page views and coarse interactions only — no cookie, nothing written to your device, no identifier stored there, and no free text or conversation identifier — and it cannot be linked to you. The request carries your IP address and user agent, which PostHog hashes for that event so that visits can be counted without being identified. Rejecting analytics stops it.
• Error and diagnostic data. We use Sentry for error and crash monitoring.
• Technical data. IP address, device and operating-system type, browser type, and session identifiers are processed for security, rate limiting, performance, and fraud prevention. Loading the third-party interface icon font from cdnjs (a Cloudflare content-delivery service) also transmits your IP address and browser user-agent to Cloudflare; it sets no cookies.

We process personal data for the following purposes and GDPR bases; each reference is to the Regulation (EU) 2016/679 (GDPR), and these purposes are informed under Art. 13(1)(c): providing the Service (retrieval, grounding, generating and showing answers, references) — performance of the contract (Art. 6(1)(b)); account creation and authentication (via Clerk) — performance of the contract (Art. 6(1)(b)); managing subscriptions and payments (via Stripe), including metered usage, and issuing invoices, receipts, and payment notices addressed to your account name and email address — performance of the contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)); enforcing allowances, rate limits, and abuse prevention — our legitimate interest in operating a secure, fair Service (Art. 6(1)(f)); product analytics and Service improvement (the optional analytics in section 6, including the cookies and browser identifiers they use) — your consent (Art. 6(1)(a)), which you may withdraw at any time (Art. 7(3)); anonymous counting before you answer the cookie banner (section 6: no cookie, no local storage, no identifier stored on your device, and no free text) — our legitimate interest in measuring and improving the Service (Art. 6(1)(f)), which you may object to (Art. 21) by rejecting analytics; error monitoring and security — our legitimate interest (Art. 6(1)(f)); business-to-business outreach to professional contacts — our legitimate interest with a clear opt-out (Art. 6(1)(f)), subject to applicable ePrivacy/marketing rules; and any other use for which you give consent — your consent (Art. 6(1)(a)), which you may withdraw at any time (Art. 7(3)).

We do not sell personal data. We do not use your questions or answers to train third-party foundation models beyond what the model providers do solely to respond to your requests under their own terms.

We share personal data only to the extent necessary for the Service to function, with the recipients listed below (the categories of recipient we disclose to, Art. 13(1)(e)), under our instructions and appropriate safeguards: Clerk (identity, authentication, and account data — the primary custodian of account credentials and profile data) (privacy policy, terms); Stripe (subscription, checkout, payment, and metered-usage processing, and the issuing and delivery of invoices, receipts, and payment notices — for a paid subscription your account name and email address are held on the Stripe customer record, and team seat counts are passed to Stripe because team accounts are billed per seat; Arcnorm does not store full payment-card numbers) (privacy policy, terms); Google (Gemini API; processing your prompts and retrieved text to generate answers; and Google Analytics 4 for the optional aggregate measurement described in section 6) (privacy policy, terms); PostHog (product analytics, EU residency) (privacy policy, terms); Sentry (error monitoring) (privacy policy, terms); Linear (issue tracking: the feedback and feature requests you send us) (privacy policy, terms); Cloudflare (hosting and edge delivery of the Service, including the cdnjs content-delivery network used for static interface assets) (privacy policy, terms); and Brevo (transactional email and business-to-business outreach, including suppression and opt-out handling) (privacy policy, terms).

We maintain a processor-and-transfer evidence register for the providers above. A provider is treated as a processor under documented instructions (Art. 28(3)), and a transfer safeguard is described publicly, only after the applicable contract, subprocessor/location review and transfer evidence have been recorded. Where personal data is transferred outside the EEA, we use the applicable Chapter V safeguard (Art. 44), including Standard Contractual Clauses where appropriate (Art. 46(2)(c)) or an adequacy decision where relevant (Art. 45), and provide the relevant information on request; see the evidence register for the evidence required before this statement may be treated as verified.

Account and signed-in history. Account credentials and profile data are held and managed by Clerk, and signed-in chat conversations are linked only to a pseudonymous Clerk identifier and retained until you delete your account. You can manage or delete your account through the account interface. On deletion, Clerk deletes your account PII in line with its retention; deletion severs the link to the identity record, but remaining service records are pseudonymised, not anonymous, unless and until they are irreversibly anonymised. Billing and invoice records are the exception: if you hold a paid subscription, Stripe holds the customer record, including the name and email address your invoices and receipts are addressed to, and the invoice, payment and tax records for it. We cannot delete these on request while a subscription is live, and after it ends they are kept for as long as tax and accounting law requires (generally up to 10 years in the EU). That retention is a legal obligation, not a choice, and it is why a billing record can outlive the account deletion described above.

Anonymous history. Anonymous, device-owned chat conversations created before sign-in became required are deleted by a daily Worker cron job (03:17 UTC) once they are older than the retention window, which defaults to 30 days and is operator-configurable (ANON_RETENTION_DAYS).

Shared links. When you create a share, a copy of the conversation — the questions and answers, and the official sources each answer cited — is stored on our servers for up to 90 days and is readable by anyone who holds the link. A conversation too long to store in full is published without its earliest messages, and the page says so. Nothing beyond the sharer's own tier is ever included. You can revoke a share at any time from your shared links, which deletes it immediately.

Conversation and answer content. Questions and generated answers are cached to improve speed and cost (cached answers never count against your quota). Each cache entry expires 180 days after it is written — serving a cached entry does not extend that — and it is addressable only under the key that wrote it, which includes the conversation's pinned legal view, so an entry is never served to a conversation pinned to a different day. Anonymised aggregate usage may be retained for analytics.

Outreach records. Opt-outs and suppression records are honoured and retained so we do not contact you again.

Logs. Technical and security logs are retained only as long as needed for the purposes above.

Consent records. Consent decisions are recorded server-side (POST /api/consent) with the policy revision they were given under. A material change to the wording invalidates stored consent, and we ask for your choice again.

We apply appropriate technical and organisational measures to protect personal data (Art. 32(1)), and we review retention at least annually and whenever the processing changes.

The Service uses strictly necessary cookies and local storage for sign-in and session management, security and abuse prevention, quota and rate limiting, billing, and error monitoring; these are required for the Service to work and cannot be switched off. Optional analytics — product analytics (PostHog, EU region), Google Analytics 4 (Consent Mode v2), and session replay with performance tracing (Sentry) — runs only with your consent. Until you make that choice, PostHog runs in its cookieless mode and counts page views and coarse interactions only: no cookie, nothing written to your device, no identifier stored there, no free text, and no campaign or ad-click parameters; the request's IP address and user agent are hashed for that event so visits can be counted without being identified, and we rely on our legitimate interest (Art. 6(1)(f)) for that counting, which rejecting analytics stops (Art. 21). Visitors in the European Economic Area, the United Kingdom, and Switzerland are asked for consent first; visitors elsewhere may opt out. You can change or withdraw your choice at any time using the Cookie settings control or from the Cookie Policy page; withdrawing consent stops the optional analytics and clears the identifiers they set, with a single reload of the page, and does not affect your access to the Service. See the Cookie Policy for the full list of cookies and services.

Arcnorm may contact business contacts at organisations relevant to the construction and built-environment sector with information about the Service, on a legitimate-interest basis with a clear, one-click opt-out that we honour (suppression is synced across our outreach records). Outreach identifies the sender (Arcnorm) and the lawful basis, and provides an opt-out link, in accordance with GDPR and applicable EU ePrivacy/marketing rules. We do not send outreach to individuals who have objected.

The Service is intended for adults (18+) and is not directed to children. We do not knowingly collect personal data from children under 18. If you believe a child has provided us personal data, contact us and we will take steps to remove it.

Where GDPR applies, you have the right to access (Art. 15) a copy of the personal data we hold about you; to rectify (Art. 16) inaccurate or incomplete personal data; to erasure (Art. 17, right to be forgotten) under the applicable conditions; to restrict (Art. 18) processing in the circumstances set out in the GDPR; to data portability (Art. 20) of personal data you provided, in a machine-readable format; to object (Art. 21) to processing based on our legitimate interests (including outreach) on grounds relating to your particular situation; and to withdraw consent (Art. 7(3)) at any time where we rely on consent, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at legal@arcnorm.com, or manage or delete your account through the account interface. You also have the right to lodge a complaint with a supervisory authority (Art. 77) — in Lithuania, the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija).

Where data is transferred outside the European Economic Area to providers such as Clerk, Stripe, Google, Linear, Sentry, Cloudflare, or Brevo, we rely on the transfer safeguards of Chapter V (Art. 44): Standard Contractual Clauses (Art. 46(2)(c)) and, where applicable, adequacy decisions (Art. 45). Product analytics are processed in the EU (PostHog, EU residency).

We may update this Policy from time to time. We will post any changes here and update the effective date above; material changes will be notified through the Service or by other appropriate means.

Questions, requests, and complaints about this Policy or our data practices can be sent to legal@arcnorm.com.