Privacy Policy

1. Who We Are

ArkyTools LTD ("ArkyTools", "we", "us", "our") operates the ArkyTools web platform — a productivity suite built for architecture practices. Our registered address is 24 Malam Gardens, London, E14 0TR, United Kingdom.

We are the data controller for personal data collected through our website and platform. We are registered with the Information Commissioner's Office (ICO) under registration number [PLACEHOLDER — register at ico.org.uk before going live].

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights in relation to it. It applies to all users of the ArkyTools platform, including visitors to our website, registered users, and subscribers.

2. What Personal Data We Collect

2.1 Account Information

When you create an account, we collect your name, email address, and, where applicable, the name of your practice or organisation. If you are part of a team account, the account owner may also provide your email to invite you as a user.

2.2 Billing Information

If you subscribe to a paid plan, billing is handled by our payment processor, Stripe. We do not collect or store your card number, expiry date, or CVV. We receive from Stripe only the billing metadata necessary to manage your subscription: your billing name, postcode, country, and payment status.

2.3 Content You Upload

When you use ArkyTools, you may upload or create content including project files, task data, images, bookmarks, and other materials ("Customer Data"). This content may incidentally contain personal data (for example, a colleague's name in a task, or images of people on a project site). You are responsible for ensuring you have the right to upload such data and that it is handled in accordance with applicable law.

2.4 Usage Data

We collect certain technical data automatically when you use the platform: your IP address, browser type, operating system, pages visited, and the date and time of your requests. This is used to maintain security, diagnose technical issues, and ensure the platform functions correctly. We do not use this data for advertising or behavioural profiling.

2.5 Communications

If you contact us by email or through a contact form, we retain the content of that communication and your contact details in order to respond to you.

3. How We Use Your Personal Data

We use your personal data for the following purposes:

• To provide the Service — creating and managing your account, processing your subscription, and operating the platform features you use.
• To communicate with you — sending transactional emails such as account confirmations, billing receipts, subscription renewal reminders, and important service notices.
• To maintain security — detecting and preventing fraud, abuse, and unauthorised access.
• To improve the platform — understanding how the platform is used in aggregate so we can fix bugs and develop new features. We never use your individual Customer Data for this purpose.
• To comply with legal obligations — retaining records as required by law and responding to lawful requests from authorities.
• Marketing communications — if you have opted in, we may send you product updates, tips, or relevant offers. You can opt out at any time via the unsubscribe link in any such email.

4. Legal Bases for Processing (UK GDPR)

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following bases:

• Contract performance (Article 6(1)(b)) — processing necessary to provide the Service you have subscribed to, including account management and billing.
• Legitimate interests (Article 6(1)(f)) — processing for platform security, fraud prevention, technical diagnostics, and aggregate product analytics, where these do not override your interests or rights.
• Legal obligation (Article 6(1)(c)) — where we are required by law to retain or disclose data.
• Consent (Article 6(1)(a)) — for marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

5. How We Share Your Data

5.1 We Do Not Sell Your Data

We will never sell, rent, or trade your personal data or Customer Data to any third party for any commercial purpose. Your data is not shared with advertisers, data brokers, or any third party acting for their own commercial interests.

5.2 Service Providers (Subprocessors)

We use a small number of carefully selected third-party service providers who process data strictly on our behalf and under our instructions. Our current subprocessors are:

Each subprocessor is bound by a Data Processing Agreement and may not use your data for their own purposes. We review subprocessors regularly and will update this list when our subprocessors change.

If you are a business subscriber and require a Data Processing Agreement between your organisation and ArkyTools, our DPA is available to review and accept at arkytools.com/legal/dpa.

5.3 Anthropic and AI Features

Some platform features use Anthropic's Claude AI (for example, generating image alt text or scanning a link). When you use these features, the specific content you have chosen to process — such as an image you upload or a URL you submit — is sent to Anthropic's API to generate the result. No other data from your account is transmitted.

Anthropic does not use data submitted via its API to train its AI models. Anthropic provides a GDPR-compliant Data Processing Agreement. Data sent to Anthropic is processed in the United States; appropriate safeguards are in place in the form of Standard Contractual Clauses.

AI features are always user-initiated. No Customer Data is ever sent to Anthropic in the background or without your direct action.

5.4 Legal Requests

We may be required to disclose personal data in response to a lawful court order, warrant, or binding request from a government authority or law enforcement agency. When this occurs:

• we will comply only to the extent strictly required by law;
• where legally permitted, we will notify you before complying so you have the opportunity to seek legal protection;
• we will not disclose more than is legally required; and
• we will challenge requests we believe to be unlawful or disproportionate.

5.5 Business Transfers

If ArkyTools is acquired, merges with another company, or sells all or part of its assets, your personal data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

6. Cookies and Similar Technologies

We use only essential cookies — small text files stored on your device that are strictly necessary for the platform to function. These include:

• Authentication cookies — to keep you logged in during your session.
• Preference cookies — to remember settings such as your chosen theme (light or dark mode).
• Security cookies — to protect against cross-site request forgery and similar attacks.

We do not use advertising cookies, tracking cookies, or any third-party cookies for analytics purposes. We will not introduce non-essential cookies without updating this policy and obtaining your consent first.

You can control cookies through your browser settings, but disabling essential cookies may prevent the platform from working correctly.

7. Data Retention

We retain personal data for as long as necessary for the purposes described in this policy:

• Account data — retained for the duration of your account and deleted within 90 days of account closure.
• Customer Data — retained while your subscription is active. After termination, you have a 30-day export window, after which Customer Data is permanently deleted within a further 90 days, including from backups.
• Billing records — retained for 7 years to comply with UK financial record-keeping obligations.
• Security and access logs — retained for up to 12 months for security and fraud prevention purposes.
• Support communications — retained for up to 3 years after the last interaction.

8. International Data Transfers

Your data is primarily hosted on infrastructure within the United Kingdom and/or the European Economic Area.

When you use AI-powered features, the specific content you submit for processing is transferred to Anthropic in the United States. This transfer is carried out under Standard Contractual Clauses approved for use under UK GDPR, providing appropriate safeguards for your data.

Stripe, our payment processor, may process billing data in the United States and other jurisdictions. Stripe maintains appropriate transfer safeguards and is certified under applicable frameworks.

9. Your Rights Under UK GDPR

Under UK data protection law, you have the following rights in relation to your personal data:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete data.
• Right to erasure — you can ask us to delete your personal data where there is no longer a lawful basis for holding it.
• Right to restriction — you can ask us to restrict processing of your data in certain circumstances.
• Right to data portability — you can request your data in a structured, machine-readable format to transfer elsewhere.
• Right to object — you can object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — where processing is based on consent (e.g. marketing emails), you can withdraw at any time.

To exercise any of these rights, contact us at hello@arkytools.com. We will respond within one month. We may need to verify your identity before fulfilling a request.

We do not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive.

10. Children's Privacy

The Service is not directed at anyone under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.

11. Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, or disclosure. These include encrypted data transmission (TLS), access controls, and regular security reviews.

No method of transmission over the internet is completely secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected users without undue delay, as required by UK GDPR.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by a prominent notice on the platform at least 14 days before the changes take effect. The updated policy will always be available at this URL with a revised "last updated" date.

13. How to Complain

If you have a concern about how we handle your personal data, please contact us first at hello@arkytools.com and we will do our best to resolve it.

If you remain unhappy with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

14. Contact Us

For any questions about this Privacy Policy or how we handle your personal data: