Privacy policy
Draft, pending legal review · Version 1 · Effective [effective date]
1. Who we are
This policy explains how [Legal name] ("Arvace", "we"), registered in [country of incorporation] under number [RC number], at [registered address], collects and uses personal data when you visit arvace.com, contact us, use our tools or work with us. We decide how and why this data is used, so we are its controller. For questions or requests, write to [privacy contact].
2. What we collect, why, and for how long
| When you… | We collect | Why | Legal basis | How long we keep it |
|---|---|---|---|---|
| Visit the website | Pages viewed and actions such as opening a demo, without your name; the page and campaign you came from, in a first-party cookie | To see which pages help visitors and improve them | Legitimate interest | 13 months; the campaign cookie lasts 90 days |
| Send an enquiry, book a call or ask for a quote | Name, email, company, phone if you give it, your message, budget range, how you heard about us | To reply to you and prepare a proposal | Steps before a contract, and legitimate interest | 24 months after our last contact, then anonymised |
| Chat with our website assistant | Your messages and the assistant's replies, and your name and email if you give them | To answer your questions and pass you to a person when needed | Legitimate interest | 12 months, then deleted |
| Use a free Lab tool | Nothing, unless you ask us to email, save or share a result: then your name, email and the result | To send you the result | Your request (contract) | As for enquiries; shared result links expire after 30 days |
| Join a waitlist or subscribe to our newsletter | Name, email, your preferences | To tell you when a product opens, or send the newsletter | Consent | Until you unsubscribe |
| Upload files to us through a secure link | The files and their names | To deliver the work you asked for | Contract | 90 days for files sent before a project; for project files, the contract plus 2 years |
| Become a client | Contact and billing details, quotes, signatures, invoices, payments, project messages and files | To deliver the work, invoice and meet legal obligations | Contract and legal obligation | Financial records, signatures and audit records: 6 years; support tickets: 3 years |
| Apply to work with us as a partner | Name, email, skills, rates, CV and portfolio | To assess your application | Steps before a contract | 24 months after our last contact; if we work together, the partner agreement's terms apply |
We never ask for more than we need. Only your name and email are ever required; a phone number never is.
3. What we don't do
- We do not sell your data or share it for advertising.
- We do not use advertising trackers.
- The AI provider behind our assistant does not use your conversations to train its models under its business terms, and we don't use client data to train any model without written permission.
- Free Lab tools calculate in your browser; your inputs are not stored unless you choose to email, save or share a result.
4. Who we share data with
We use trusted service providers that process data only on our instructions and under data processing terms:
| Provider | What they do for us | Where |
|---|---|---|
| Supabase | Database and sign-in | EU (Ireland) |
| Amazon Web Services | Server for documents, automations and encrypted backups | EU (Paris) |
| Cloudflare | Website hosting, file storage, security and cookie-free analytics | Global network |
| Microsoft 365 | Our business email | [Region of your Microsoft 365 tenant] |
| Resend | Sending emails from the platform | US / EU |
| Anthropic or Google (Gemini API) | AI model behind the website assistant (we use one of them at a time, on paid business terms that do not use your messages to train their models) | US |
| Sentry | Error monitoring, with personal data removed | US / EU |
| Cal.com | Booking calls | [Region] |
| YouTube or Vimeo | Playing demo videos, only when you press play | Global |
| Microsoft Power BI | Showing demo dashboards, only when you load one | Global |
| Paystack (when online payment is available) | Processing payments | Nigeria |
We may also share data with our professional advisers, or with authorities when the law requires it.
5. International transfers
Some providers above process data outside Nigeria, in the EU and the US. We choose providers with strong security, use their data processing terms, and transfer only what each service needs, as Nigeria's Data Protection Act 2023 and the GDPR require.
6. How we protect your data
Encryption in transit and at rest, private file storage with time-limited links, two-factor sign-in for our team, access limited to the people who need it, and daily encrypted backups. If a breach puts your data at risk, we will notify the Nigeria Data Protection Commission within 72 hours and tell you without delay when the risk to you is high.
7. Your rights
You can ask us to: see the data we hold about you and get a copy; correct it; delete it; restrict or object to how we use it; move it to another provider; and withdraw consent at any time (this doesn't affect what we did before). Write to [privacy contact] (a request form at arvace.com/privacy/request will also be available). We confirm your identity with a link sent to your email address, then answer within 30 days. We keep invoices and payment records for 6 years even after a deletion request, because the law requires it.
8. Marketing
We send newsletters and marketing emails only if you agreed. Every email has a one-click unsubscribe. Emails about a quote, invoice or project you are part of are not marketing and don't need consent.
9. Client projects
When we build something that processes your customers' or employees' data, we do so on your behalf as your processor, under a data processing agreement, and only as you instruct.
10. Children
Our services are for businesses. We don't knowingly collect data from anyone under 18.
11. Changes
When we change this policy we update the version and date at the top and keep previous versions available at arvace.com/privacy/v[n].
12. Complaints
If you're unhappy with how we handled your data, contact [privacy contact] first. You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng) or, if you are in the EU, to your local data protection authority.