ArcSealPrivacy Policy
The short version: we hold your sign-in identity, your birth record, and the readings computed from it. We don't sell any of it, we don't advertise on it, and you can take it or delete it whenever you want.
What we hold.
(a) Sign-in identity from Apple or Google — an email address and a token, never your password. (b) Your birth record: name, birth date, birth sex, birth place, and birth time where you provide one. (c) The readings computed from it, and which of them you saved. (d) Billing records held by Stripe, not by us. (e) Ordinary technical logs: device type, approximate region, error traces.
Why birth sex is required.
Two of the twelve traditions lay out their chart differently depending on it — Zi Wei Dou Shu orders its palaces by it, and it changes how a BaZi luck cycle runs. It is used for that arithmetic and nothing else: not for advertising, not for profiling, not shown to anyone else.
What we never do.
We do not sell, rent, or trade your data. We don't run advertising against it. We don't use your birth record or your readings to train models. We don't build profiles for anyone else.
How it's kept.
Encrypted in transit and at rest. Your record is sealed to your account and readable only by you. Staff access requires a logged, justified reason and is limited to fixing a specific reported fault.
Who processes it.
A small set of service providers, each contractually barred from using your data for their own ends: hosting and database, Stripe for payment, Apple and Google for sign-in, and bot protection on our forms. That's the list.
Delivery is in-app.
Readings are never emailed. They appear in your account and stay there; there is nothing sensitive sitting in an inbox.
How long we keep it.
Your record and readings stay while your account is open. Delete the account and we remove them within 30 days, except where tax or accounting law requires us to keep a billing record.
Your rights.
Access, export, correction, and deletion, on request, honoured within 30 days — wherever you live, not only where the law compels it. Write to support@arcseal.ai.
Our lawful basis.
We hold your sign-in identity and birth record to perform the contract you entered when you asked for readings; we hold waitlist details on your consent, which you can withdraw at any time; we keep minimal security logs on legitimate interest in not being attacked. We do not rely on legitimate interest for anything marketing-related.
Where your data lives, and where it's run from.
ArcSeal is available in the United States and our servers and providers are there; the company is directed from Europe, so your data is handled under European rules wherever you live. Transfers in either direction rely on the European Commission's Standard Contractual Clauses with each provider, and the UK Addendum where it applies. Ask us and we'll tell you which providers hold what.
Cookies, and why there's no banner.
We set only strictly necessary cookies: one to keep you signed in, and one used by our bot protection to tell a person from a script. Under the ePrivacy rules those are exempt from consent, which is why you won't be asked — not because we've skipped the question. There is no analytics cookie, no advertising cookie, no pixel, no session recording, and no third party reading your behaviour on this site. If that ever changes we will ask first, with a real choice: refusing will be exactly as easy as accepting, nothing will be pre-ticked, and no feature will be withheld for saying no.
EU and UK rights in full.
Access, rectification, erasure, portability, restriction, objection, and withdrawal of consent — exercised by writing to support@arcseal.ai, answered within 30 days, free of charge. You may also complain to your national data protection authority. We do not make automated decisions that have legal effects about you; a reading is not a decision.
If you're in the United States.
Californian and other state privacy laws give you the right to know what we hold, to have it corrected or deleted, and to opt out of sale or targeted advertising. There is nothing to opt out of: we do not sell or share your personal information, for money or for anything else, and we run no targeted advertising — which is why you won't find a "Do Not Sell" link here. We won't charge you a different price or give you a worse service for exercising a privacy right. Because the company is run from Europe, we apply the European standard to every reader, so the rights in the clause above are yours too, whichever state you're in.
Children.
ArcSeal isn't for anyone under 18. If we learn we hold a child's record, we delete it.
Changes.
If we change this policy materially, we'll say so in the app before it takes effect — not quietly, and not only here.