Privacy
Last updated: .
Questions about this policy? hello@arcanoris.in or contact account support.
What we store
Account, brand, scan, and billing metadata required to deliver the product. Raw AI answers and citations are stored to power your audit results and history.
How data is protected
Every query is scoped to the owning account on the server. Secrets never ship to the browser. Private audit results reveal nothing on public surfaces, including preview images.
Audit visibility
Audit details and complete results are scoped to the owning account. Public pages expose only the information explicitly intended for public viewing.
How long we keep things
Audit data (answers, scores, citations, actions) is kept while your account exists. Operational data ages out automatically: live progress events after 30 days, hashed-IP abuse records after 90 days, billing webhook payload bodies after 90 days (the processed-event record itself is kept for billing integrity), and raw crawl artifacts on audit machines after 14 days. When you delete your account, billing usage records are kept in anonymized form only, as required for financial accuracy.
Your controls
You can export all of your data as JSON or permanently delete your account and owned data from Settings at any time. Deletion cancels running audits and your subscription, and signs out every session.
Who receives data, and why
An audit sends data to service providers; it is not processed entirely in your browser. Access settings do not prevent the processing below. Do not put confidential or personal information in buyer questions unless you are authorized to send it for analysis.
- AI providers
Data shared: Buyer questions, selected region/language, and the context needed to generate and analyze answers. Analysis and recommendation steps may also send public website extracts and audit evidence.
Generate answers, compare brands, and write evidence-based recommendations. The supported providers are OpenAI, Anthropic, Google, Perplexity, Mistral, xAI, Amazon Bedrock, DeepSeek, Moonshot AI, Groq, MiniMax, Sarvam and Alibaba Cloud. Which providers receive a request depends on the audit selection and the configured analysis steps.
- Web retrieval and search
Data shared: Website URLs, search queries about companies, and public page content.
Read your website and verify cited evidence. The engine can use Firecrawl, AWS AgentCore web search and DuckDuckGo, as configured, as well as requesting public pages directly.
- Dodo Payments
Data shared: Account email, selected plan and interval, and identifiers linking checkout to your account. You provide payment details directly in hosted checkout.
Process subscriptions and refunds. Arcanoris receives payment and subscription status; the app does not collect your full card number.
- Resend and Zoho Mail (SMTP)
Data shared: Recipient email addresses and message content. Support requests include the contact details and issue description you submit.
Deliver account and monitoring emails through Resend, and route contact inquiries through the configured SMTP service (Zoho by default).
- Google sign-in (optional)
Data shared: The Google account information you authorize, such as your name and email, plus sign-in identifiers.
Sign you in when you choose Google. Email/password signup is also available; your Google password is not sent to Arcanoris.
- Hosting, database and abuse prevention
Data shared: Account records, saved audits, operational logs and request metadata. Rate-limit keys can contain an IP address or email address.
Run the website and worker, store your results and limit abuse. Rate limits use Upstash Redis when configured, otherwise the application's PostgreSQL database.
Provider retention, processing locations and data-use terms vary by service and configuration. Access settings do not change those providers' terms. Public pages can also be accessed by visitors and search engines.