Privacy Policy

This Privacy Policy explains how Arct Technology LLC ("Arct Cloud", "we", "us", "our") collects, uses and shares personal data. It covers arct.cloud, the console at console.arct.cloud (the "Console"), docs.arct.cloud, our API and related subdomains (together, the "Platform"). It also covers the virtual servers, related infrastructure, add-ons and support we provide (the "Services"). Your "Account" is your account in the Console. "You" means anyone whose personal data we handle under this policy: visitors, customers, referral partners, people who contact us and people who send us reports.

This policy is an information notice. It is not part of your contract with us, and we do not ask you to accept it. Your use of the Services is governed by the Terms of Service. This policy does not create contractual rights or obligations for you or any other person, and it does not limit any right you have under applicable data protection law.

1. Who we are

Arct Technology LLC, with its registered address at 30 N Gould St Ste R, Sheridan, WY 82801, United States, is the controller of the personal data described in this policy, except where section 2 says we act as a processor.

For any question or request about personal data, email legal@arct.cloud. You can also write to the address above, marked "Privacy".

2. Scope and our roles

When we are the controller

We decide how and why the following data is used:

• Account, sign-in, billing and support data
• Data collected on the Platform, including analytics and advertising measurement data
• Marketing and referral data
• Data we use for our own abuse handling, security, fraud prevention and legal compliance, including when that work involves information about servers you run on the Services

When we are a processor

"Customer Content" means the data, software and content you store or run on the Services. You decide what Customer Content contains and whose personal data it includes. We process it on your behalf and on your instructions, which are your use of the Services and your support tickets. The Data Processing Agreement (the "DPA") sets out the terms. We do not monitor Customer Content generally. We access, preserve or disclose it only as needed to act on your support request within its scope, respond to valid legal process, investigate or address abuse, fraud or security issues, including breaches of the Acceptable Use Policy, or protect the life or physical safety of any person, as the Terms of Service provide.

As the controller of Customer Content, you are responsible for its lawfulness and for the personal data it contains. You must give the people whose personal data you store or run on the Services, including your own users and customers (your "End Users"), the privacy notices the law requires, obtain any consents the law requires and respond to their requests. This policy does not describe how our customers handle personal data, and we are not responsible for the privacy or security practices of our customers. Where this policy and the DPA differ about Customer Content, the DPA prevails.

If your personal data is stored on a server that one of our customers runs, that customer is responsible for it. Please contact the customer directly. If you contact us instead, we may refer your request to the customer. We act on such a request only as the customer instructs, the DPA provides or the law requires.

Third-party services

This policy does not cover third-party websites, services, applications or software, including software you install on your servers, services you reach through links on the Platform, sign-in providers such as Google and payment pages that providers host. Their own privacy terms govern how they handle personal data, and we are not responsible for their content or their privacy or security practices. A link to a third party does not mean that we endorse it. Referral partners, affiliates and other businesses that promote us on their own websites, servers or channels handle personal data under their own terms, not this policy.

Other exclusions

This policy does not cover personal data we handle about our own staff, contractors or job applicants. It also does not cover information that has been aggregated or de-identified so that it no longer identifies a person (section 4).

3. Personal data we collect

We collect personal data from you, automatically when you use the Platform and the Services, and from the third parties named in this section.

Account and sign-in data

• Your email address and name, and the Account settings, server names and SSH public keys you add
• Sign-in data from our authentication provider, Auth0 (part of Okta): your user identifier, email verification status and sign-in events. Your password and other authentication identifiers are held by Auth0. We do not receive them.
• If you sign in with Google: your name, email address and profile picture, which Google sends us with your permission

Billing and payment data

• Orders, invoices, plans, billing periods, amounts and payment status
• For card payments: the card brand, the last four digits of the card, its expiry date, and the customer and payment references that our card processor, Stripe, returns to us
• Your billing location and, for business customers, your VAT or tax ID, where we ask for them to apply tax
• For crypto payments: invoice details, the blockchain network and the transaction references that our crypto payment processor, Cryptomus, returns to us

Support communications

• Tickets, emails to support@arct.cloud, the attachments you send us, and our replies. We handle them in Intercom, our support platform.
• Messages you send through the contact and sales forms on arct.cloud: your name, email address, subject and message, including a company name if you give one. We store them and open a support conversation in Intercom.
• Messages you send through the chat messenger in the Console, which Intercom also provides.

Technical and log data

We keep logs, such as access, security, network and billing records, to run, secure and maintain the Platform and the Services.

• IP address, browser and device type, operating system, language and the time of each request
• A Console activity log of sign-ins and actions on your Account and servers, with the IP address used
• Application and API logs
• Resource use of your servers, such as CPU, memory, disk and data transfer, which we use for billing and to apply our usage rules
• Network traffic metadata, such as traffic volumes, ports and source and destination IP addresses, which our network and DDoS protection systems process to route traffic and detect attacks
• Bot and abuse signals from Cloudflare, including Turnstile checks

Website and Console analytics

We record the pages you view, the referring page, your device and browser type, an approximate location derived from your IP address, and actions such as sign-up and purchase. We use these tools:

• Arct Cloud analytics, an analytics service we host ourselves at i.arct.cloud. It sets no cookies and stores nothing in your browser, and it runs for every visitor. When you are signed in, it links events to your Account.
• With your consent, Google Analytics 4, loaded through Google Tag Manager. When you are signed in, we send it your Account identifier as a user ID. We also send purchase events to it from our servers.
• With your consent, PostHog in the Console.
• On the documentation site at docs.arct.cloud, Mintlify, which hosts that site, records the pages you view with a random identifier stored in your browser, and receives any search or assistant questions you type there.

Advertising measurement data

With your consent, we measure which ads and links lead to sign-ups and purchases:

• When you arrive from a Google ad, the link carries a Google click identifier (gclid, gbraid or wbraid). We store it, with the campaign parameters in the link, in the arct_attr cookie for 90 days.
• When you sign up or place an order, we copy these identifiers to your Account and to the order.
• For each paid order, we send Google Ads the click identifier, the order value, the currency and the payment time as an offline conversion.
• Google Ads tags on the Platform record sign-up and purchase conversions in your browser.
• When you arrive from a Facebook link, the link can carry a Facebook click identifier (fbclid). We store it in the arct_attr cookie for 90 days and add it to our analytics records to count visits from Facebook. We do not copy it to your Account or to orders.

Referral data

• If you open a referral link on arct.cloud and accept advertising and measurement cookies, we store the referral code in the arct_aff cookie for up to 30 days and add the code to your analytics visit record.
• If you open a referral link on the Console, the Console stores the referral code for up to 30 days: in the arct_aff cookie, or in the arct_ref cookie for links from our Discord referral program.
• When you open a referral link on arct.cloud, we add one to that link's click count. We store nothing on your device for this, and the count does not identify you.
• When you sign up, we record the partner or customer who referred you, such as a Discord server or a customer's referral link, and the payments your Account makes. We use these records to calculate partner rewards and to show a customer who referred you the totals described in section 5.
• Our Discord referral program runs as a bot on Discord. For each paid invoice of an Account referred through that program, it receives the referred Account's identifier and email address, the referring server, and the amount, currency and payment method.
• If you are a referral partner, we keep the records needed to credit and pay your rewards.

Abuse, legal and verification data

• Reports and notices from third parties, rights holders, other network operators and authorities about activity linked to your Account or servers. These can include IP addresses, URLs, log extracts and the sender's contact details.
• Reports you send through the Report abuse form on arct.cloud: the details of the report and any name, email address, postal address, telephone number and signature you give. We store them and open a conversation in Intercom for the team that handles abuse reports, or for our copyright agent for copyright notices.
• Legal process and requests from courts and authorities
• Fraud and risk signals from Stripe Radar, Cloudflare Turnstile and Cryptomus screening
• Results of any sanctions screening we carry out, for example of sign-ups
• Information or documents you send when we ask you to verify your identity, payment method or business

Marketing preferences

• Your email address, whether you subscribed to or opted out of marketing email, and when

Data you must provide

To open an Account and buy Services, you must give us an email address, sign in through our authentication provider and provide payment details. An Account also needs the cookies and local storage that are strictly necessary for sign-in, your session and security (section 8). Without them we cannot provide the Services. By signing up, you agree that we process this data and share it with the service providers we need to provide the Services (section 5). Our legal basis for this is contract (Art. 6(1)(b)). Consent to analytics, advertising cookies and marketing email is optional and does not affect your use of the Services.

Other information you give us

We also collect any other information you choose to give us, for example feedback, or details you add to a ticket, a form or an email. If you give us personal data about another person, such as in a support ticket or an abuse report, you should do so only where you are allowed to share it with us.

4. How we use personal data and our legal bases

The table lists each purpose, the data we use for it, our legal basis under the GDPR and the UK GDPR, and how long we keep the data. Section 7 gives the full retention schedule.

You can withdraw consent at any time. Withdrawal does not affect processing that took place before it. We may also use personal data for another purpose that we describe to you when we collect it, or with your consent.

We may create aggregated or de-identified information from personal data, such as sign-ups per month, and use and share it for any lawful purpose. Information in that form no longer identifies you and is not personal data under this policy. We keep de-identified information in de-identified form and do not attempt to re-identify it, except where the law permits.

Your right to object. Where we rely on legitimate interests, you can object at any time on grounds relating to your situation. You can object to direct marketing at any time without giving a reason, and we then stop. Section 10 explains how.

5. Who receives personal data

We disclose personal data to the following categories of recipients:

• Service providers. Companies that process data for us under contract: hosting for the website, Console, backend, our own analytics service and our referral bot; content delivery and security (Cloudflare); DDoS mitigation for traffic to servers; authentication (Auth0); email delivery (Mailjet); support tickets and messaging (Intercom); analytics (Google and PostHog); hosting and page analytics for the documentation site at docs.arct.cloud (Mintlify); backup storage; and the data center operators in the cities where we offer servers. They may use the data only to provide their services to us. The Subprocessors page names them and states their locations.
• Payment processors. Stripe processes card payments and Cryptomus processes crypto payments. Each also uses payment data for its own fraud prevention and its legal and regulatory duties, as an independent controller under its own privacy notice.
• Google. If you sign in with Google, Google controls your Google account data. If you accept advertising cookies, Google receives the advertising measurement data described in section 3 and processes it under its own terms, partly as an independent controller. Console pages load an icon font, and the card payment form loads a text font, from Google Fonts, so Google receives your IP address and browser details when those pages open and processes them under its own terms.
• Referral bot. The Discord referral program data described in section 3 goes to our referral bot, which runs on Discord.
• Customers who referred you. If you sign up through another customer's referral link, that customer sees totals for the link in the Console: how many times it was opened, how many people signed up, how many of them have paid us, and the total they have paid. We do not show them your name, email address or servers. When few people have used a link, these totals can show whether you signed up, whether you paid and how much.
• Authorities, courts and parties to legal proceedings. We disclose data where we believe in good faith that applicable law, regulation or valid legal process requires it, such as a subpoena, court order or search warrant, including a request from a public authority to meet national security or law enforcement requirements. We may also disclose data where the law permits disclosure, such as an emergency involving a risk of death or serious physical injury. The Law Enforcement Guidelines page explains what process we require.
• Protection of rights, safety and the Platform. We may disclose data where we believe in good faith that it is reasonably necessary to enforce the Terms of Service, the Acceptable Use Policy or our other agreements, including to investigate potential breaches; to detect, prevent or address fraud, abuse, security or technical issues; to protect the rights, property or safety of Arct Cloud, our customers, other users or the public; to report suspected unlawful activity to the competent authorities; or to establish, exercise or defend legal claims. This can include exchanging information with payment providers, other network operators and organizations that work to prevent fraud, spam, malware and network attacks.
• NCMEC. Where US law requires it, we report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC), which may pass reports to law enforcement.
• People involved in a report. When we forward an abuse report to the customer concerned, we remove the sender's name and contact details, unless the sender agrees to share them or the law requires it. Copyright notices and trademark complaints are forwarded in full, including the sender's contact details. If you send a copyright counter-notice, we pass it, with your contact details, to the person who sent the original notice, as US copyright law requires. We may also send copies of copyright notices, with the sender's personal contact details removed, to clearinghouses such as the Lumen database, which may publish them. The DMCA Copyright Policy explains the process.
• Professional advisers. Lawyers, accountants and auditors who are bound by duties of confidentiality.
• Corporate affiliates. Any company that controls, is controlled by or is under common control with Arct Technology LLC, now or in the future, for the purposes in this policy. They must handle the data in line with this policy.
• Business transfers. If we are involved in, or negotiating, a merger, acquisition, financing, reorganization or sale of all or part of our business or assets, or an insolvency, bankruptcy, receivership or similar proceeding, personal data may be disclosed to the other parties and their advisers, including during due diligence, and may pass to a successor or acquirer as one of the transferred assets. The successor or acquirer must keep using it in line with this policy or tell you about any change.
• Others with your consent or at your direction.

For personal data in Customer Content, section 2 and the DPA govern access and disclosure. We may also disclose aggregated or de-identified information that does not identify you (section 4).

6. International transfers and data location

We are based in the United States. We and our service providers process account, billing, support, analytics and advertising data in the United States and in the other countries listed on the Subprocessors page. Those countries may have data protection laws that differ from, and may protect personal data less than, the laws of the country where you live.

The primary disks of each server stay in the location you choose when you deploy it. Our staff may access account data and, where this policy or the DPA allows, Customer Content.

The GDPR and the UK GDPR apply to us directly, so personal data you give us is not transferred to us under those laws. When we disclose personal data from the European Economic Area, the UK or Switzerland to a service provider in a country without an adequacy decision, we act as the exporter and rely on:

• where the recipient is certified under the EU-US Data Privacy Framework, its UK Extension or the Swiss-US Data Privacy Framework, that certification
• otherwise, the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914
• for UK data, the International Data Transfer Addendum to those clauses issued by the UK Information Commissioner
• for Swiss data, those clauses with the changes Swiss law requires

The DPA contains the transfer terms for Customer Content. You can ask for a copy of the safeguards we use by emailing legal@arct.cloud. We may remove commercial terms from the copy.

As a US company, we are subject to US law. Some US laws, such as the CLOUD Act, can require us to disclose data we control wherever it is stored. The Law Enforcement Guidelines page explains how we handle such requests.

7. How long we keep personal data

When a period ends, we delete the data or make it anonymous. We may keep personal data for longer where we need it to comply with a legal, tax or accounting obligation, to resolve a dispute, to establish, exercise or defend legal claims, to prevent fraud or abuse, to enforce our agreements, or while a legal hold applies, and then only for as long as that purpose requires. For fraud and abuse prevention, this can include the limited records we need to stop people whose Accounts we closed for abuse or fraud from opening new ones. Blockchain records of crypto payments are public and cannot be deleted.

Unpaid invoices. When any invoice is unpaid past its due date, we suspend the Account. On day 21 after the due date, we permanently delete all servers, backups, snapshots and data on the Account, as the Terms of Service describe. You are responsible for paying your invoices by their due date and for keeping your own copies of your data. To the maximum extent permitted by applicable law, we are not responsible for data lost through non-payment.

Deleting your Account. You can ask us to delete your Account and its data at any time, through a support ticket or by emailing legal@arct.cloud. We then delete the services on the Account. Fees already paid are not refunded, except where the Terms of Service or mandatory law require a refund. We keep the records listed above for the periods stated, such as invoices.

8. Cookies and similar technologies

The Platform uses cookies and similar technologies, such as local storage, session storage and tags. On arct.cloud and in the Console, optional analytics and advertising tags are blocked until you choose their categories. The categories are:

• Strictly necessary, without consent: the cookies and local storage an Account needs for sign-in, the session and security, including the sign-in session (Auth0), security and bot protection (Cloudflare __cf_bm and Turnstile) and payment fraud prevention at checkout (Stripe).
• Arct Cloud analytics, always on: it sets no cookies and stores nothing in your browser.
• Functional, only after consent: preferences that make the Platform easier to use, and the Intercom chat messenger in the Console.
• Analytics, only after consent: Google Tag Manager, Google Analytics 4, PostHog, and our own items arct_first_seen (local storage) and arct_landing (session storage), which add returning visits and the first page of a visit to Arct Cloud analytics.
• Advertising and measurement, only after consent: Google Ads conversion tags and our own items arct_attr (campaign and click identifiers, 90 days), arct_aff and arct_ref (referral codes, 30 days) and arct_signed_up (records that a sign-up was counted, 2 years).

On arct.cloud, you can change or withdraw your choice at any time through Cookie preferences at the bottom of each page. We treat a Global Privacy Control signal from your browser as a refusal of advertising cookies in that browser. We do not respond to Do Not Track browser signals. If you block cookies in your browser, parts of the Platform may not work. The documentation site at docs.arct.cloud is hosted by Mintlify and does not show our consent banner; Mintlify stores an analytics identifier and your display choices in your browser when you visit it. The Cookie Policy lists each cookie with its provider, purpose and duration.

9. Security

We protect personal data with technical and organizational measures suited to the risk. These include:

• Data sent to and from the Platform is encrypted in transit with TLS.
• Backups and snapshots are encrypted.
• Access controls restrict who can reach the systems that hold personal data.
• Auth0 handles sign-in and Stripe handles card details, so we do not hold Account passwords or full card numbers.

You are responsible for security inside your servers, including the operating system, software, user accounts and firewall rules, and for keeping your sign-in details, SSH private keys and other access credentials confidential, as the Terms of Service describe.

No method of transmitting data over the internet, and no method of storing it, is completely secure. We cannot guarantee that personal data will never be accessed, disclosed, altered or destroyed through a breach of our safeguards. If a personal data breach occurs, we notify the affected people and the authorities as the law requires. Report a vulnerability or a suspected compromise of your Account to security@arct.cloud.

10. Your rights in the EU, UK and Switzerland

If the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies to our processing of your personal data, you have the right to:

• Access: get confirmation that we process your data and a copy of it
• Rectification: have inaccurate data corrected and incomplete data completed
• Erasure: have your data deleted where we no longer have a valid reason to keep it
• Restriction: have us limit the use of your data, for example while you contest its accuracy
• Portability: receive the data you gave us, where we process it by contract or consent, in a structured, machine-readable format, or have it sent to another provider
• Objection: object to processing based on legitimate interests. We then stop unless we have compelling legitimate grounds or need the data for legal claims. You can object to direct marketing at any time, and we will stop.
• Withdrawal of consent: withdraw consent at any time, through Cookie preferences or by email. Withdrawal does not affect processing that took place before it.
• Automated decisions: ask for a person to review an automated step, give your point of view and contest the result (section 12)
• Complaint: complain to a supervisory authority, in particular where you live or work or where an alleged infringement took place. In the UK this is the Information Commission (ICO). In Switzerland it is the Federal Data Protection and Information Commissioner.

How to make a request

Email legal@arct.cloud. You can also view and change some Account data in the Console.

We respond within one month of receiving your request. If a request is complex or you send several, we may extend this by up to two further months, and we tell you within the first month if we do. Requests are free. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse it, and we explain why.

We verify your identity before we act on a request. We may ask you to send it from the email address on your Account, or to give details that confirm who you are. We ask only for what we need. If we cannot verify your identity, we may decline the request. If someone makes a request on your behalf, we may ask for proof that they are authorized to act for you and confirm the request with you directly.

Some rights have limits. To the extent applicable law allows, we may decline or limit a request where acting on it would:

• prevent us from complying with a legal obligation;
• prejudice the establishment, exercise or defense of legal claims, or an investigation of fraud, abuse or a security incident;
• disclose personal data about another person;
• reveal trade secrets, security measures or other confidential information of ours or of others; or
• breach a legal duty not to disclose a request or order from an authority.

For example, we keep invoices for the period tax law requires even after an erasure request. If we decline a request, we tell you why, unless the law prevents us. For personal data in Customer Content, contact the customer who controls it. We help our customers answer such requests as the DPA provides.

Complaints to us

You can complain to us about how we use your personal data by emailing legal@arct.cloud. We acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome. This procedure is open to everyone and is the one we follow under UK data protection law. Complaining to us first does not affect your right to complain to a supervisory authority.

11. Privacy rights for US residents

Several US states give residents rights over their personal data. These laws may not apply to us because of our size. We offer the following rights to all US residents voluntarily:

• Know what personal data we hold about you and get a copy
• Correct inaccurate data
• Delete your data, subject to legal exceptions
• Opt out of the use of your data for targeted advertising and of "sharing" for cross-context behavioral advertising
• Not be treated differently for using these rights

We do not sell personal data for money. If you accept advertising cookies, Google receives click identifiers and conversion data so that we can measure our ads (section 3). Some state laws may treat this as "sharing" or targeted advertising. You can opt out by refusing or withdrawing advertising cookies in Cookie preferences. We treat a Global Privacy Control signal as an opt-out of advertising cookies for that browser. We do not respond to Do Not Track browser signals. The Cookie Policy describes how we handle both signals.

To make a request, email legal@arct.cloud. We verify requests as section 10 describes and respond within 45 days, which we may extend once by 45 days when needed. You may use an authorized agent, who must show your signed permission. We may decline a request that we cannot verify, that is manifestly unfounded, excessive or repetitive, or that falls under an exception in the law that applies to it. If we decline your request, you can ask us to reconsider it by replying to our decision. If we refuse your appeal, you may contact the attorney general of your state.

In the categories that US state privacy laws use, we collect: identifiers, such as your name, email address, IP address, Account identifier, click identifiers and referral codes; customer records and commercial information, such as orders, invoices, payment status, partial card details and billing location; internet or other electronic network activity, such as log, analytics and Console activity data and network traffic metadata; approximate location derived from your IP address; professional information, such as a company name or tax ID; and the verification documents you send us when we ask for them. Section 3 lists the sources, section 4 the purposes, section 5 the categories of recipients and section 7 how long we keep each category. We use sensitive personal information, such as verification documents, only to verify you, secure the Platform, prevent fraud and comply with the law, and not to infer characteristics about you.

Nevada residents: we do not sell covered information as Nevada law defines that term.

12. Automated decisions

Some steps happen automatically, without a person deciding each case. Each one applies our terms, protects the Platform or follows the law:

• When an invoice is unpaid past its due date, our billing system suspends the Account. On day 21 after the due date, it permanently deletes all servers, backups, snapshots and data on the Account, as the Terms of Service provide. The only input is the payment status.
• Stripe may decline a card payment based on its own fraud checks.
• We may block access from territories subject to comprehensive sanctions. The input is the location of your IP address.
• When a DDoS attack on an IP address exceeds our mitigation capacity, our network may null-route that address until the attack falls below capacity. We email the account owner when this happens.

Our fraud and abuse tools also produce automated signals, such as bot checks, sanctions list matches and network attack alerts. A signal can hold an order or start a temporary protective measure. Staff review the case before we suspend or close an Account on the basis of these signals.

You can ask for a person to review any automated step by emailing legal@arct.cloud. You can give your point of view and contest the result. To dispute a restriction of your Account or servers, you can also open a support ticket, as the Terms of Service describe.

13. Children

The Platform and the Services are not directed to anyone under 18, and you must be 18 or older to open an Account. We do not knowingly collect personal data from children. If we learn that we have, we delete it and may close any Account linked to it. Contact legal@arct.cloud if you believe a child has given us personal data.

14. Marketing email

If you are a customer, we may email you about Arct Cloud services similar to those you bought, where the law allows this without prior consent. You can opt out when you sign up and in every marketing email. We send marketing email to anyone else only with consent.

Every marketing email has an unsubscribe link. After you unsubscribe, we keep your email address on a suppression list so that we do not email you again.

Service messages, such as order confirmations, renewal and payment notices, security alerts and notices of changes to our terms, are not marketing. We send them while you have an Account, and unsubscribing from marketing email does not stop them.

15. Data we do not collect

• Full card numbers or card security codes. You enter them directly with Stripe.
• Your Account password. Auth0 holds it.
• Data from an identity-verification service. We do not use one.
• Special categories of personal data, such as health data, on purpose. Please do not include them in tickets.
• Precise location. We derive only an approximate location from your IP address.
• The contents of your servers, except as section 2 and the DPA describe.

16. Changes to this policy

We may update this policy from time to time, for example when our practices, the Services or the law change. The date at the top shows when it last changed. Unless we state a later date, an updated policy takes effect when we post it. If a change materially affects how we use personal data we already hold, we tell you by email, with a notice in the Console or on the Platform, or by other reasonable means before the change takes effect. If a change needs your consent, we ask for it. Please review this policy from time to time. Earlier versions are available on request at legal@arct.cloud.