Privacy Policy

1. Overview & Scope

Architech d.o.o. ("Archy AI", "we", "our") operates the following products and services (collectively the "Services"):

• ArchyPlatform — AI-powered project orchestration workspace
• ArchyStarter — Free idea-to-context AI tool
• ArchyAgents — Autonomous AI agent orchestration layer
• ArchyMCP — Model Context Protocol server integration layer
• ArchyForge — AI-driven code and scaffold generation
• ArchyKnowledgeBase — Organisational knowledge management
• ArchySocial — Social content orchestration
• ArchyPress — AI-assisted content publishing
• meet.archy-ai.com and starter.archy-ai.com — Marketing and product web properties
• Project Blueprint Reports — Purchasable architecture documents

This Privacy Policy explains how we collect, use, disclose, and protect personal data across all Services. It applies to all visitors, users, customers, and business contacts worldwide, with additional rights for individuals in the European Economic Area (EEA), United Kingdom (UK), and Canada.

2. Data Controller

The data controller responsible for your personal data is:

If you are located in the EEA or UK, you have the right to lodge a complaint with your local supervisory authority. For EEA users this is your national Data Protection Authority (DPA); for UK users this is the Information Commissioner's Office (ICO).

3. Data We Collect

3.1 Information you provide directly

• Account information: name, email address, company name, job title, password (hashed)
• Billing & payment: billing address, payment method details (tokenised via Stripe; we never store raw card numbers)
• Contact & support requests: messages, attachments, and correspondence
• Project content: project descriptions, requirements, architecture artefacts, and AI prompts you submit
• Profile information: preferences, team memberships, and integration credentials (stored encrypted)

3.2 Information collected automatically

• Usage data: pages visited, features used, session durations, click paths, and event logs. On archy-ai.com we collect this only if you allow analytics cookies (see section 11)
• Device & technical data: IP address, browser type, OS, screen resolution, timezone, and referrer URL
• Performance data: load times, error reports, and API response metrics
• Log data: server-side access logs retained for security and debugging purposes

3.3 Information from third-party sources

• Identity and profile data from social authentication providers (Google OAuth, Microsoft Azure AD) when you choose to sign in via these services
• Integration data from connected tools such as Jira, GitHub, Azure DevOps, Slack, and LinkedIn when you authorise connections
• Payment status and subscription data from Stripe

4. Legal Basis for Processing (GDPR)

For individuals in the EEA and UK, we process personal data under the following legal bases under the General Data Protection Regulation (GDPR) and UK GDPR:

5. How We Use Your Data

• Service delivery: Operate, maintain, and personalise the Services for your account
• AI processing: Use project content you submit to generate architecture diagrams, backlogs, reports, and AI-agent outputs. Your data is processed to serve your requests and is not used to train shared AI models without explicit consent
• Communications: Send transactional emails (account, billing, security alerts) and, where permitted, product updates and marketing
• Support: Respond to support requests and improve documentation
• Analytics & improvement: Analyse usage patterns to prioritise features and fix bugs
• Security: Detect, investigate, and prevent fraud, abuse, and security incidents
• Legal obligations: Comply with applicable laws, regulations, and lawful requests
• Microsoft Marketplace compliance: Maintain records required for Microsoft Marketplace certification including terms acceptance, privacy policy acknowledgement, and offer-related audit trails

6. Third-Party Services & Data Sharing

We work with the following categories of third-party services. Each processor is bound by a Data Processing Agreement (DPA) or equivalent contractual safeguards:

6.1 Cloud Infrastructure

• Microsoft Azure (Microsoft Corporation) — Primary cloud hosting, compute, storage, and AI services. Data may be processed in Azure data centres globally. Microsoft Privacy Notice
• Supabase (Supabase Inc.) — Database and authentication backend. Supabase Privacy Policy

6.2 Analytics & Monitoring

• Google Analytics 4 and Google Ads, through the Google tag (Google LLC / Alphabet Inc.) — Website analytics and advertising measurement. On archy-ai.com these run only with your consent (see section 11). Data may be transferred to the USA under Google's Standard Contractual Clauses. Google Privacy Policy. You may opt out via Google Analytics Opt-out.
• LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company) — Measurement of conversions from LinkedIn ads, aggregated reports on the companies and job roles that visit, and retargeting. On archy-ai.com it runs only with your consent to marketing cookies (see section 11). LinkedIn may transfer data outside the EEA as described in its privacy policy. LinkedIn Privacy Policy.
• Microsoft Clarity / Application Insights (Microsoft Corporation) — UX analytics and performance monitoring.

6.3 Payments

• Stripe (Stripe, Inc.) — Payment processing. Stripe is a PCI-DSS Level 1 certified processor. We do not store card numbers. Stripe Privacy Policy

6.4 Social & Marketing Platforms

When you interact with our content on social platforms, or when we run advertising, the following platforms may receive data about your interaction. Each operates under its own privacy policy and may use cookies, pixels, or similar technologies:

• Google / YouTube — Advertising, video embeds. Google Privacy Policy
• Meta (Facebook, Instagram, Threads) — Social sharing, advertising pixels. Meta Privacy Policy
• LinkedIn (LinkedIn Ireland Unlimited Company) — Professional networking, B2B advertising. For the LinkedIn Insight Tag on archy-ai.com, see section 11. LinkedIn Privacy Policy
• Bluesky (Bluesky Social PBC) — Social content distribution via the AT Protocol. Bluesky Privacy Policy
• X (Twitter) — Social content distribution. X Privacy Policy

6.5 Communication & Support

• SendGrid / Azure Communication Services — Transactional email delivery
• Intercom or equivalent — In-app support chat (where enabled)

6.6 Development Integrations

When you connect third-party developer tools through the Services (e.g., Jira, GitHub, Azure DevOps, Slack), data is exchanged only as required to fulfil the integration and is governed by your authorisation and the respective platform's own policies.

6.7 Disclosure & Business Transfers

We may also share data: (a) to comply with a legal obligation or lawful government request; (b) to protect the rights, property, or safety of Archy AI, our users, or the public; (c) with professional advisers (lawyers, accountants) under confidentiality obligations; (d) in connection with a merger, acquisition, or sale of assets, with appropriate notice to users.

We do not sell personal data to third parties.

7. International Data Transfers

Archy AI is operated by Architech d.o.o., headquartered in Zagreb, Croatia (European Union). We use cloud infrastructure and service providers that may process data in the United States, the European Union, and other countries.

For transfers of EEA/UK personal data to countries without an adequacy decision, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• UK International Data Transfer Agreements (IDTAs) for UK transfers
• Service provider participation in approved frameworks (e.g., EU–US Data Privacy Framework)

8. Data Retention

We retain personal data for as long as:

• Your account is active or as needed to provide the Services
• Required for legitimate business purposes (e.g., dispute resolution, audit trails)
• Required by applicable law (e.g., financial records: 7 years)

Account data is deleted or anonymised within 90 days of account closure upon request, unless longer retention is legally required. Anonymised aggregated analytics may be retained indefinitely as they no longer constitute personal data.

9. Your Rights

Depending on your location you have the following rights regarding your personal data. To exercise any right, contact us at [email protected]. We will respond within 30 days (GDPR allows up to 1 month, extendable to 3 months for complex requests).

9.1 Rights under GDPR (EEA & UK users)

• Access (Art. 15): Obtain a copy of personal data we hold about you
• Rectification (Art. 16): Correct inaccurate or incomplete data
• Erasure / Right to be forgotten (Art. 17): Request deletion of your data
• Restriction of processing (Art. 18): Restrict how we process your data
• Data portability (Art. 20): Receive your data in a structured, machine-readable format
• Object (Art. 21): Object to processing based on legitimate interests or for direct marketing
• Withdraw consent (Art. 7(3)): Withdraw consent at any time without affecting the lawfulness of prior processing. For cookies on archy-ai.com, use Cookie settings in the website footer
• Lodge a complaint: With your national Data Protection Authority

9.2 Rights for California residents (CCPA/CPRA)

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information
• Right to opt out of sale or sharing of personal information (we do not sell personal data)
• Right to non-discrimination for exercising privacy rights
• Right to correct inaccurate personal information

9.3 Rights under Canadian PIPEDA

• Right of access to personal information
• Right to correction of inaccurate data
• Right to withdraw consent where consent-based processing applies
• Right to complain to the Office of the Privacy Commissioner of Canada

10. Security

We implement industry-standard technical and organisational security measures including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Access controls and role-based permissions (RBAC)
• Regular security assessments and penetration testing
• Intrusion detection and continuous monitoring via Azure Security Center
• Employee security training and background checks
• Incident response procedures with notification timelines compliant with GDPR (72-hour supervisory authority notification)

No transmission over the internet is 100% secure. If you discover a security vulnerability, please report it responsibly to [email protected].

11. Cookies and analytics

This section explains the cookies and browser storage used on archy-ai.com. Other Archy AI websites and apps explain the cookies they use where you use them.

11.1 Your choice

On your first visit, a banner asks whether we may use analytics and marketing cookies. Accepting and rejecting are equally easy. Until you choose, and whenever you reject, no analytics or advertising code from Google or LinkedIn is loaded on archy-ai.com.

You can change your choice at any time with Cookie settings in the website footer. Withdrawing consent does not affect processing that took place before you withdrew it.

We use Google Consent Mode, which passes your choice to Google's tags. The LinkedIn Insight Tag is loaded only if you allow marketing.

11.2 Necessary storage (always on)

Two small items are stored in your browser without consent because the site needs them:

• Your cookie choice, kept in your browser's local storage so we do not ask again on every page.
• How you reached the site, kept in your browser's session storage for the current tab only: the first page you opened, the referring website, and any campaign details in the link (such as utm_source or an ad click identifier). It is sent to us only if you submit the contact form, so we know which page or campaign your enquiry came from. It is deleted when you close the tab.

Neither item is shared with Google or LinkedIn, or used for advertising.

11.3 Analytics (with your consent)

If you allow analytics, we use Google Analytics 4 to understand how the site is used: pages viewed, links and buttons clicked, how far you scroll, and whether the contact form was started, sent or returned an error. We do not send your name, email address, company or message to Google Analytics.

Google Analytics sets first-party cookies to recognise a returning browser. Google Analytics keeps event data for 2 months, which is Google's default setting.

11.4 Marketing (with your consent)

If you allow marketing, the Google tag also runs Google Ads conversion measurement, and we load the LinkedIn Insight Tag. Both tell us whether our ads lead to visits and enquiries. LinkedIn also gives us aggregated reports on the kinds of companies and job roles that visit the site; these reports do not tell us who you are. Google and LinkedIn may use this to show our ads to you on other websites and on LinkedIn (retargeting). Each may set its own cookies, including on its own domains, under its own privacy policy.

11.5 What we store

11.6 Where the data goes

Analytics and advertising data is processed by Google and, for marketing, by LinkedIn. Data may be transferred to the USA under Google's Standard Contractual Clauses (see sections 6.2 and 7). LinkedIn may transfer data outside the EEA as described in its privacy policy. Read the Google Privacy Policy, how Google uses information from sites that use its services, the LinkedIn Privacy Policy and the LinkedIn Cookie Policy.

For data collected through the LinkedIn Insight Tag, Architech d.o.o. and LinkedIn Ireland Unlimited Company may act as joint controllers for the collection and transmission of that data. LinkedIn is responsible for any processing after that, and the LinkedIn Privacy Policy applies to it. You can exercise your rights with either of us.

11.7 Other ways to control cookies

Most browsers let you block or delete cookies in their settings. You can also install the Google Analytics Opt-out browser add-on. If you have a LinkedIn account, you can also control how LinkedIn uses data for ads in your LinkedIn settings.

12. Children's Privacy

The Services are intended for business and professional use and are not directed to children under the age of 16 (or 13 in jurisdictions where that is the applicable threshold). We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at [email protected] and we will promptly delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law. When we make material changes, we will:

• Update the effective date at the top of this page
• Notify registered users by email or in-app notification at least 30 days before the change takes effect (for material changes)
• Obtain fresh consent where required by applicable law

Continued use of the Services after the effective date constitutes acceptance of the updated policy.

14. Contact & Data Protection Officer

For any privacy-related questions, requests to exercise your rights, or concerns about how we handle your personal data, please contact:

If you are in the EEA or UK and we have not satisfactorily addressed your concern, you have the right to lodge a complaint with your local Data Protection Authority.