Arc ("we", "us", "our") is a documentary story development tool operated by Arc (storyarc.co). We act as the data controller for personal data processed through our service. For questions about this policy, contact us at privacy@arccompanion.com.
When you create an account, we collect your email address, a securely hashed password, and optionally your name. If you sign in with Google, we receive your Google account ID, name, email, and profile picture.
We store the content you create within Arc: documentary project details, chat conversations with the AI story coach, uploaded video files and their transcripts, photos, documents, and notes. This content is yours. We process it to deliver the service and never use it to train AI models.
We collect technical information needed to operate the service: your last login time and IP address (for security), error logs, and with your consent, analytics about how you use Arc's features.
When you accept the Beta Program Agreement, we record your acceptance including the agreement version, timestamp, and IP address. We keep this record for 7 years to comply with our legal obligations.
Arc uses third-party AI services to power the story coaching experience:
Your creative content is not used to train any AI model. Embeddings (numerical representations used for search) are stored in Pinecone and deleted when you delete your projects or account.
We share data with the following third-party companies ("sub-processors") solely to deliver the Arc service:
| Service | Purpose | Country |
|---|---|---|
| Anthropic | AI story coaching (Claude) | USA |
| AI story coaching (Gemini) + OAuth sign-in | USA | |
| AssemblyAI | Video transcription | USA |
| Pinecone | Vector search for story context | USA |
| Amazon Web Services | File and video storage | USA |
| PostHog | Product analytics (consent required) | USA |
| Sentry | Error monitoring | USA |
| Mem0 | Long-term coaching memory | USA |
| Render | Cloud hosting | USA |
All transfers to US-based processors are covered by Standard Contractual Clauses (SCCs) under GDPR Chapter V. For the full list, see our sub-processor list.
We process your data under the following legal bases (GDPR Article 6):
We keep your data for as long as your account is active. When you delete your account, we delete all your projects, chat history, videos, assets, and profile information within 30 days. The only exception is your Beta Agreement acceptance record, which we retain for 7 years as required by law.
Analytics data in PostHog is retained for 1 year. Error traces in Sentry are retained for 90 days. Application logs are retained for 30 days.
If you are located in the European Economic Area, UK, or California, you have the following rights:
To exercise rights not available in the product, email privacy@arccompanion.com. We respond within 30 days.
We use HTTPS for all data in transit. Passwords are hashed with bcrypt. TOTP secrets and Google OAuth tokens are encrypted with AES-256 at the application layer before storage. JWT access tokens expire after 24 hours.
Arc uses the following cookies:
Arc is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.
We may update this policy from time to time. When we make material changes, we will notify you by email or by displaying a notice in the app. The effective date at the top of this page reflects when the policy was last updated.
For privacy questions or to exercise your rights:
Arc PrivacyIf you are in the EEA and believe we have not adequately addressed your privacy concern, you have the right to lodge a complaint with your local data protection authority.