Privacy Policy

Information we collect

Information you provide:

• Account information: your username, email address, a salted hash of your password (never the password itself), role and settings such as measurement units, language and which in-app tips you have dismissed, and your waitlist request (name, email, optional note).
• Content: the briefs, room programs, locations, sizes, tags and answers you give us, plans you generate or edit, images or drawings you upload, flags you draw on plans, and corrections or comments you send us.
• Payment information: when you buy credits, our payment provider (Stripe) processes your card details; we receive a confirmation and the purchase amount, not your full card number.
• Communications: messages you send us, for example to support.

Information we receive automatically: usage and billing records (actions, credits, model tokens and costs per request and project), technical logs (request IDs, timings, status codes, IP address used for rate limiting and abuse prevention), and the cookies and Google Analytics measurements described below. Our logs are designed to record sizes and outcomes, not the text you type.

Information from connected services: if you connect through ChatGPT or Claude, we receive the request that app sends (for example a design brief, location or plan ID). You sign in to that connection with your Arqa username and password; we receive nothing else from the assistant, and we do not receive your other ChatGPT or Claude conversations, Gmail or Google Drive.

How we use information

We use personal information to:

• provide, operate and secure the Services: generate and save plans, run checks, keep your projects private to your account, meter credits and prevent fraud and abuse;
• remember facts you told our assistant (for example household size) so you do not have to repeat them; these expire after 180 days;
• communicate with you about your account, the waitlist, purchases and changes to the Services;
• develop and improve the Services, including training our models (see the next section);
• comply with legal obligations and enforce our Terms.

Model training and improvement

Arqa learns from how the Services are used. We may use the following to train, fine-tune and evaluate our models and planning pipeline:

• model requests and responses: the exact messages sent to our language and vision models (which can include your brief and plan data) and their outputs, with validation results;
• generated plans and the full reasoning chain behind them, together with errors you flag with the drag box;
• corrections, comments and quick rejections you give while editing, which may include the text you typed.

We do not sell this data and we do not use your payment details or password for training. Training data may be reviewed by people working with us and processed by providers that run our training jobs, under confidentiality obligations. Where possible we remove direct identifiers before training.

You can ask us to exclude your Content from future training by writing to andressantiagore@gmail.com; this does not affect data already used to train a model.

How we share information

We share personal information only as needed to run the Services, with:

• hosting and infrastructure providers (Cloudflare for the website, login and the ChatGPT and Claude connections; Microsoft Azure for our application servers and caches; our encrypted database provider);
• AI model providers that process requests on our behalf (for example through OpenRouter), including for image reading and photorealistic renders;
• location services: the place you give us is sent to mapping (OpenStreetMap data through Apify) and climate and elevation services (Open-Meteo) to design for your site;
• payment processing (Stripe), observability tools we use to debug and evaluate request traces, and providers that run model training;
• Google, which provides Google Analytics: website usage statistics as described under "Cookies and local storage", processed under Google’s data processing terms;
• authorities or others when required by law or to protect rights, safety and the integrity of the Services, and a successor in a merger or acquisition, subject to this Policy.

Apps you connect, such as ChatGPT or Claude, receive the tool results you ask for; their use of that information is governed by their own privacy policies.

Security

Account records, plans and other stored documents are encrypted before they reach our database (AES-256-GCM), and lookups use keyed hashes rather than readable identifiers. Connections use HTTPS. ChatGPT and Claude connection tokens are short-lived, stored encrypted and revocable, and work only on that connection. No system is perfectly secure; tell us if you find a vulnerability.

Retention

We keep account information while your account is active. Plans keep their version history until you or we delete them. Assistant memory expires after 180 days. Login sessions last up to 30 days and ChatGPT or Claude connections up to 30 days. Usage and billing records are kept as long as needed for accounting and legal obligations. Training datasets are kept while they are useful for improving our models; we delete or de-identify Content on request as described below, except where we must keep it by law.

Cookies and local storage

We use strictly necessary cookies for login (a session cookie and a device cookie for sign-in protection) and short-lived cookies during OAuth sign-in. Your browser’s local storage keeps preferences such as language, theme, canvas settings and an anonymous client ID used for rate limiting. We do not use advertising cookies.

On app.arqa.ing we also use Google Analytics to understand how people find and use the site. It sets first-party analytics cookies (_ga and _ga_ followed by our ID, kept up to two years) and sends Google the address of each page you open (without plan IDs and without query details other than campaign tags), the site that referred you, your browser and device type, and an approximate location derived from your IP address. It does not receive the content of your briefs, plans, chats or uploads, and Google signals and advertising features are off. In the European Economic Area, the United Kingdom and Switzerland, and whenever your browser sends a Global Privacy Control signal, Google Analytics sets no cookies and receives only cookieless measurements without an identifier. You can also opt out with Google’s browser add-on (tools.google.com/dlpage/gaoptout).

Your choices and rights

Depending on where you live, you may have rights to access, correct, delete or export your personal information, to object to or restrict certain processing (including use for training), and to withdraw consent. To exercise them, email andressantiagore@gmail.com from the address on your account. You can also disconnect ChatGPT or Claude at any time, and you may complain to your local data protection authority.

Children

The Services are not directed to children under 18 and we do not knowingly collect their personal information.

International transfers

We and our providers process information in the United States and other countries, which may have different data protection laws from yours. Where required, we use appropriate safeguards for these transfers.

Changes to this Policy

We will post updates here with a new date and give notice of material changes in the Services or by email.

Contact

Privacy questions and requests: andressantiagore@gmail.com.