Privacy Policy

ARCANAI ("the Service", "we", "us") is operated by:

For any privacy-related request, including exercising your GDPR rights, you may contact us directly at contact@arcanai.co.

ARCANAI does not store your documents or chat messages. Here is exactly what happens when you submit a document or a chat message:

1. Your text is anonymized in your browser before leaving your device. Names, emails, phone numbers, IBANs, and other PII are replaced with neutral placeholders such as [NAME_1], [EMAIL_1], [PHONE_1].
2. The anonymized text is encrypted with AES-256-GCM using an ephemeral key generated in your browser. The key itself is wrapped with our RSA-OAEP public key.
3. The encrypted payload is transmitted to our server over HTTPS. The server unwraps the AES key, decrypts the text briefly in memory, forwards the anonymized plaintext to the selected AI provider, re-encrypts the AI response with the same AES key, and returns it to your browser.
4. The original content is never written to disk. Only a minimal metadata record (analysis type, timestamp, message length) is saved for quota tracking, and this record is automatically deleted after 15 minutes.
5. Your browser decrypts the AI response locally. The AI provider only ever sees anonymized text — never your identity, email, or IP address.

• Contract (Art. 6(1)(b)): Processing your account data, sessions, and usage metadata to provide the Service you signed up for.
• Legitimate interests (Art. 6(1)(f)): Security logging, abuse prevention, and aggregate (non-personal) service performance analytics.
• Legal obligation (Art. 6(1)(c)): Retaining payment records for the legally required 5-year period under French accounting law.
• Consent (Art. 6(1)(a)): Any optional communications you explicitly opt into, withdrawable at any time.

We share data only as follows, and only to the minimum extent necessary:

• Anthropic, OpenAI, Google (AI providers): We transmit anonymized text to generate AI responses. These providers receive anonymized content only — never your name, email, IP address, or any identifier. For API-access usage, these providers contractually commit not to train their models on your data. They operate under their own privacy policies.
• Stripe (payment processor): Processes payment information on our behalf. We share your email address for receipts. Stripe is PCI-DSS compliant and covered by a GDPR Data Processing Agreement.
• Resend (transactional email): Sends welcome and transactional emails on our behalf. We share your email address and first name only.
• Hosting infrastructure: Our servers are hosted on Railway (backend) and Vercel (frontend). Any data transferred to the US is covered by Standard Contractual Clauses (SCCs).

We do not sell your data. We do not share it with advertisers or data brokers.

• Document content: never persisted — destroyed in memory after the AI call completes.
• Analysis and chat metadata records: automatically deleted after 15 minutes.
• Account data (email, name, plan, matricule): retained until you request account deletion.
• Session tokens: expire after 30 minutes (access) or 7 days (refresh).
• Server logs: automatically purged after 30 days.
• Payment records: retained for 5 years to comply with French accounting law.

Upon account deletion, we erase your personal data within 30 days, except where a longer retention period is required by law.

If you are in the EU/EEA or UK, you have the following rights. To exercise any of them, email contact@arcanai.co — we respond within 30 days.

• Right of access (Art. 15):Request a copy of all personal data we hold about you.
• Right to rectification (Art. 16):Correct inaccurate or incomplete personal data.
• Right to erasure (Art. 17):Request deletion of your account and all associated data.
• Right to restriction (Art. 18):Ask us to pause processing while a dispute is resolved.
• Right to data portability (Art. 20):Receive your data in a structured, machine-readable format (JSON).
• Right to object (Art. 21):Object to processing based on our legitimate interests.
• Right to withdraw consent:Where processing is based on consent, withdraw it at any time without affecting prior processing.

You also have the right to lodge a complaint with your national data protection authority. In France: CNIL.

ARCANAI does not use third-party advertising cookies, tracking pixels, or behavioural analytics services.

We use the following strictly necessary mechanisms:

• localStorage: stores your authentication tokens (access token, refresh token) and UI preferences (language, display settings). These never leave your device except as Authorization headers on API calls.
• CSRF cookie: a short-lived, HttpOnly, SameSite=Strict session cookie used to prevent cross-site request forgery. It contains no personal data and expires when your browser session ends.

These are strictly necessary for the Service to function and do not require separate consent under the ePrivacy Directive.

• AES-256-GCM encryption for document content in transit.
• RSA-4096 OAEP key wrapping for the ephemeral AES key.
• PBKDF2 (100,000 iterations, SHA-256) for client-side API key encryption.
• bcrypt (12 rounds) for password hashing.
• HTTPS with HSTS, X-Frame-Options: DENY, CSP, Referrer-Policy, and Permissions-Policy headers.
• Rate limiting and brute-force protection (progressive delays, 15-minute lockout) on all auth endpoints.
• Log sanitization that strips API keys and sensitive tokens from server logs before writing.
• Automatic deletion of all processing records after 15 minutes.

ARCANAI is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us immediately at contact@arcanai.co.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.