Privacy Policy
Version 2.1.0
Version 2.1.0
Effective date: 29 September 2026.
The English text governs. The Dutch text, and any other language, is a translation. If they differ, the English text applies.
This policy informs you under General Data Protection Regulation (GDPR) Art. 13 and GDPR Art. 14. The contract is the Terms of Service. This policy incorporates the Processor and recipient register by reference. The register is not a separate contract. This policy is not a data processing agreement.
Read it with the Terms of Service, the Cookie Policy, the in-app artificial intelligence disclosure, and the register. Public paths: /privacy-policy, /terms-of-service, /cookie-policy, /ai-disclosure, and /processors.
1. Controller
Arkintel B.V., Molengraaffsingel 12, 2629 JD Delft, the Netherlands. Chamber of Commerce 99939940. RSIN 869196911. VAT NL869196911B01. Established in the Netherlands.
Rights requests and authority contact: legal@arkintel.com. Account help: support@arkoffice.com. A rights request sent to support is forwarded to the legal address. Post goes to the Delft address.
We have not appointed a data protection officer. See §24 of this policy. The lead supervisory authority is the Autoriteit Persoonsgegevens. See §22 of this policy.
We do not publish a bank account number here.
2. Scope
This policy covers personal data we process when you use ArkOffice on the website, in the apps we offer, and on related domains we operate.
It does not replace the Cookie Policy or the register. Third-party sites have their own policies (§27 of this policy).
3. Roles
For a personal ArkOffice account, Arkintel B.V. is the controller of the account, billing, security, our logs, safety scoring, and, if you are a Consumer, User Content we store to provide the Services.
If you are a Consumer and you upload personal data about someone else, you must have a right to do so. We remain the controller of that processing on our systems.
If you are a Business User and you upload personal data about someone else, you must have a lawful basis to do so. You are the controller of that data. We are the processor. We process it on your instructions to provide the feature you asked for, including storage, transcription, a model send, and a background agent or automated task that needs that content. The GDPR Art. 28 terms for that processing are in §18 of the Terms of Service. This policy is not that contract. You inform the other person where the GDPR requires the controller to do so.
We remain the controller of the account, billing, security, logs, and safety scoring of that content, including when you are the controller of the content.
Using a personal account for an organisation does not make us that organisation's processor. We are that organisation's processor only under a separate signed GDPR Art. 28 agreement. That agreement, not this policy, governs that work.
4. Whose data
We process data about:
- account holders
- people whose data appears in files, notes, chat, audio, or shared links because a user provided it
- people linked by a referral code an account holder enters or shares (the other account's data is not shown through that link)
- people who send an illegal-content notice (name and email in the notice)
We do not seek children's data (§19 of this policy).
5. Categories
Account. Email address. Display name if you provide one. Identifiers and tokens from a sign-in provider, as needed for the session. Account identifier. Language or locale if we store it.
User Content. Chat messages, replies, and material the assistant looks up or brings in when we keep it with that conversation. Notes. Drive files, metadata, sharing permissions, and share links. Audio you submit for transcription, and the transcript. Document-editor content when you use that feature.
Safety. The material scored for a chat send. We do not publish which inputs the check skips. If a send is flagged, we keep the prompt, the score, the time, and a usage reference on that chat, and you can no longer delete that chat or add to it. Restriction state needed to apply the Terms of Service. Artefacts from a malware or illegal-content check, if we scan a file.
Billing. Plan, usage, charges, credits, and rewards, including a code you enter or share and the accounts that code links. Customer type, country of residence, and contract start, for tax and notices. Payment-processor identifiers. We do not store full card numbers. Invoices. Logs of price-change and material-term notices (when, which notice, language, destination). Billing address you save, and a VAT number when the address is a business address. Address search: the text you type and the place you choose go to the lookup provider. We do not keep those search strings as a product log. The address you save is the billing address.
Technical. IP address, user agent, device and operating-system type, timestamps, error and security logs, and request metadata. The disclosure acknowledgement: version and time.
We do not seek. A citizen service number (BSN). Copies of identity documents as a registration requirement. Full card numbers. Special-category data as a product purpose (§20 of this policy).
6. Sources
From you. From your use of the Services, including logs, cookies as the Cookie Policy describes, and usage metering. From the identity provider you choose. From the payment processor (status and tax location as returned). From the address-lookup provider when you search. From people who share files with you or who send a notice of illegal content.
7. Purposes and legal bases
| Purpose | Basis |
|---|---|
| Account, authentication, and providing the Services, including User Content in §5 of this policy | Contract, GDPR Art. 6(1)(b) |
| Sending a request to the model host you select | Contract, GDPR Art. 6(1)(b). The disclosure is transparency, not a second basis |
| Safety scoring of chat sends, locking a chat, and read-only mode | Contract, GDPR Art. 6(1)(b), and legitimate interest in the integrity of the service, GDPR Art. 6(1)(f). Legal duty, GDPR Art. 6(1)(c), where one applies |
| Billing, invoices, VAT, the credit ledger, and pay-as-you-go | Contract, GDPR Art. 6(1)(b), and legal duty, GDPR Art. 6(1)(c) |
| Price-change and material-term notices | Contract, GDPR Art. 6(1)(b), and legal duty, GDPR Art. 6(1)(c) |
| Residence and contract-start fields used for lawful price rules | Contract and legal duty. Not profiling for a personal price |
| Security, fraud, abuse, and malware | Legitimate interest, GDPR Art. 6(1)(f), and legal duty where required |
| Error diagnostics and reliability | Legitimate interest, GDPR Art. 6(1)(f) |
| Product statistics while they are still personal; anonymised data is not personal data | Legitimate interest, GDPR Art. 6(1)(f) |
| Illegal-content notices | Legal duty, GDPR Art. 6(1)(c) |
| Legal claims, sanctions, and lawful requests | Legal duty and, where applicable, legitimate interest |
| Non-essential cookies | Consent, through the Cookie Policy. Strictly necessary cookies: the Cookie Policy |
| Enforcing a ban and blocking immediate re-registration | Legitimate interest, GDPR Art. 6(1)(f), and legal duty where one applies |
We do not send marketing email unless we later ask for consent under GDPR Art. 6(1)(a). You can withdraw that consent at any time.
We do not use User Content to train our model weights or, under the suppliers' terms as represented to us, their model weights. That is a limit on purpose, not a second legal basis.
Where we rely on legitimate interest, we have balanced that interest against your rights. The interest we rely on is running a secure work aid. The data we use is the data that feature needs. You can object (GDPR Art. 21).
We do not seek special-category data. GDPR Art. 6(1)(b) does not lift the GDPR Art. 9 prohibition. Do not upload it unless the law allows you to. If it appears in User Content, it is still processed as that content.
8. Recipients
Categories are listed here. Names, locations, and transfer tools are on the Processor and recipient register, which this policy incorporates. Arkintel is the controller of the purposes in this policy except where §3 of this policy says the Business User is the controller. In that case the parties who receive that content are sub-processors, and the register says so.
Categories:
- hosting, storage, and the security edge
- email for support, product notices, and public forms
- payment and accounting
- identity providers you choose
- the host of the model you select for that send
- the safety-check host for a chat send
- transcription and speaker separation
- address lookup
- cookieless analytics
- people you choose, such as someone who receives a share link
- authorities, only when the law requires it
- our staff and authorised reviewers of flagged material (internal; not a separate company on the register)
A like-for-like swap inside a category updates the register within a reasonable time after we receive notice. It is not, by itself, a new version of this policy. A new purpose, a new flow outside the European Economic Area, or a new inference family is a material change under §26 of this policy.
9. Sends that leave our systems
Nothing is sent to a model host in the background. Data leaves for a cloud model only when you submit that request.
What may be sent is the User Content that request needs, including material the assistant looks up when the request does that, and audio you submit for transcription.
Only the host of the model you select receives that inference request. Before the reply, the scored window may also go to the safety-check host. Audio for transcription goes to the transcription host. Speaker separation, if you use it, goes to that host. Names are on the register and in the disclosure.
We use the send to generate the reply and to run the safety check. Suppliers, as they represent to us, do not train on your prompts or files. They keep inference traffic for the period their terms declare. You can delete a chat and add to it. If a safety check flags a send, we keep that prompt in that chat, and you can no longer delete that chat or add to it.
You must accept the current disclosure before a cloud send. If you decline or withdraw, you are signed out. A changed disclosure is shown again before the next cloud send.
A safety score can be wrong. The scored text is still personal data. If a required check cannot be completed, we may refuse the send and we do not record a strike for that failure.
10. Files, notes, sharing, transcription, and editing
We store these to provide the feature you asked for (GDPR Art. 6(1)(b)).
A share gives access to the people you select. If a link leaks, that risk stays with you.
Transcription and the document editor use the hosts named on the register.
The product may replace a file with a newer version. Our backups are for operations, not a promise to you. Deletion after the contract ends is described in §14 of this policy.
11. Billing
The payment processor collects and stores the payment method. We store identifiers and status, not the full card number.
Invoices go through the payment processor and by email.
A bank account number is used only where an invoice or a bank transfer requires it. We do not print it here.
Customer type, country, and contract start are for notices, VAT, and the first-period price rule. They are not used to set a personal price, and they are not automated individual pricing.
12. Identity providers
You choose email or a provider named on the register. That provider is an independent controller of your account with them. We receive the identifiers needed to create or link your ArkOffice account.
13. Cookies and logs
The cookie table and any consent are in the Cookie Policy. Strictly necessary cookies do not need consent. Non-essential cookies do.
Analytics on ArkOffice are cookieless, as the Cookie Policy states. Security and error logs are §5, §7, and §14 of this policy.
14. Retention
| Category | Period |
|---|---|
| Account and User Content | Life of the account |
| Audio recordings | No automatic deletion, unless you set an expiration in settings or on that recording |
| After the contract ends | A short export window, then deletion, aligned with §17 and §27 of the Terms of Service. Not an instant wipe |
| Flagged prompt we keep | Life of the account. The safety host's own copy: the period its terms declare |
| Invoices and notice logs | The statutory bookkeeping period |
| Security logs and backups | Life of the account |
| Anonymised statistics | May be kept. They are not personal data |
| Ban-evasion identifiers | As long as we operate, for that purpose only (§18 of this policy) |
| Legal claims | Until the claim no longer requires the data |
Export what you need during the window. The right to a portable copy under GDPR Art. 20 is set out in §21 of this policy.
15. Transfers
Our own servers for account, chats, notes, and files are in Rotterdam, the Netherlands.
A provider may process data outside the European Economic Area only with a GDPR Chapter V tool: an adequacy decision, including the EU-US Data Privacy Framework where that recipient is certified, and/or Standard Contractual Clauses, with supplementary measures where we use them. The register states the tool for each named recipient, as contracted.
Inference and safety-check hosts may process a request briefly outside the European Economic Area even when retention is short. Adding a new family that processes outside the European Economic Area is a material change under §26 of this policy.
Address lookup, the security edge, identity providers, and the payment network may use a global edge for metadata, as the register states.
16. Security
Connections use HTTPS. File storage uses the storage provider's default server-side encryption. Encryption at rest is applied on every store where it can be applied without making the feature you asked for impossible. While a background agent or an automated task is doing work you asked for, the content that work needs is available in cleartext on our systems, because that feature cannot run on ciphertext alone.
Production access is limited to authorised staff, with strong authentication. The edge provides denial-of-service protection and a web application firewall, as deployed. We monitor and alert.
Report vulnerabilities to support@arkoffice.com. How we handle incidents is set out in §23 of this policy.
We do not publish a certificate we do not hold.
17. Automated means
Prices we set follow a published schedule. They are not a personal price and not automated individual pricing.
Chat sends can be scored automatically. A hit can refuse that turn and lock that chat. Repeated hits can put the account in read-only mode. A person reviews a read-only outcome. You can contest it (§30 of the Terms of Service). The score can be wrong. Contact support@arkoffice.com.
We use automated means. They can err. You can ask a person to review. We do not claim that the Services make no automated decision if the product can restrict the account from that score.
Do not use the Services to make a GDPR Art. 22 decision about another person.
We meter credits to perform the contract. That metering is not profiling under GDPR Art. 22.
18. Bans
If we ban an account, we may keep the email, the identity-provider subject, the payment-customer identifier, and technical identifiers we actually use, so the ban can be enforced and the person cannot register again at once and repeat the infringement.
The basis is GDPR Art. 6(1)(f), and GDPR Art. 6(1)(c) where a legal duty applies. Retention lasts as long as we operate, for that purpose. Access is limited to restricted staff.
19. Children
The Services are not for anyone under 18. That is above the Dutch digital-consent age of 16. We do not knowingly collect children's data. If we learn that we have, we delete it. Write to legal@arkintel.com.
20. Special-category data and secrets
Do not upload special-category data, children's data, or classified material unless you are legally allowed to and you accept the residual risk. If such data is in User Content, GDPR Art. 7 and GDPR Art. 9 still apply, and we may still apply safety and hosting rules.
21. Your rights
You may ask for access (GDPR Art. 15), correction (GDPR Art. 16), erasure (GDPR Art. 17), restriction (GDPR Art. 18), and a portable copy (GDPR Art. 20) in a structured, commonly used, machine-readable form, such as JSON or the export the product offers. Portability is in addition to Data Act switching in the Terms of Service.
You may object to processing based on legitimate interest (GDPR Art. 21), including analytics where that basis applies. Automated decisions under GDPR Art. 22 are described in §17 of this policy.
Where a process is based on consent, you may withdraw consent. The disclosure is a condition of cloud sends. Withdrawing it signs you out. It is not, by itself, GDPR Art. 6(1)(a) consent for the whole account.
Email legal@arkintel.com. We may verify your identity. We reply within one month. If the request is complex, we may extend by two further months and we will tell you why within the first month.
We may refuse or charge a reasonable fee for a request that is manifestly unfounded or excessive (GDPR Art. 12(5)). The first copy under GDPR Art. 15 is free. Further copies may be charged as GDPR Art. 15(3) allows.
Erasure does not apply where the law requires us to keep invoices, where §18 of this policy requires ban-evasion identifiers, or where we need the data for a legal claim.
If fulfilling a request means we cannot provide the Services, we will say so and we may end the account.
22. Complaints and courts
You may complain to the Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, https://autoriteitpersoonsgegevens.nl.
You may also go to court under GDPR Art. 79, including, where GDPR Art. 79 allows, the courts of your habitual residence.
Please contact us first. You do not have to.
23. Breaches
If a breach is likely to risk your rights, we notify the Autoriteit Persoonsgegevens without undue delay and, where feasible, within 72 hours of becoming aware of it (GDPR Art. 33).
If the risk is high, we notify you without undue delay (GDPR Art. 34), unless an exception in GDPR Art. 34 applies, such as encryption that makes the data unintelligible, later measures that remove the high risk, or disproportionate effort, in which case we use a public communication.
The internal response steps stay internal.
24. Officer, impact assessment, and records
We have not appointed a data protection officer. We will revisit that if GDPR Art. 37 requires it.
We assess high-risk processing as GDPR Art. 35 requires, including inference, files, and safety scoring where that assessment is due. We do not publish the assessment.
We keep the GDPR Art. 30 record internally. This policy is the information GDPR Art. 13 requires. It is not that record.
25. Data Act
Export and switching under the Data Act are in the Terms of Service. GDPR Art. 20 portability stays in §21 of this policy. Retention in §14 of this policy does not block a switching right the Data Act grants.
26. Changes
A clarification or a legal rename, or a register update that only swaps a like-for-like vendor, may be posted as a new version.
A material change to processing (a new purpose, a new flow outside the European Economic Area, a new inference family, or a change that adversely affects your rights) is sent as a notice at least 30 days before it applies. You may reject it by ending the contract before that date, at no extra fee. Continued use is not the only way that change becomes effective.
The version number changes. Earlier text stays available through the versioned legal pages.
27. Other controllers
Links leave this policy behind. Identity providers, the payment processor, and model hosts are independent controllers for their own processing. What we send them is still processing for which we are controller, using them as processors or recipients, when we are the controller of that data. When §3 of this policy says the Business User is the controller, we send that content as processor and the recipient is a sub-processor for that send. The disclosure names the inference recipients consistently with the register.
28. Law
Processing is governed by the General Data Protection Regulation and the Dutch GDPR Implementation Act (Uitvoeringswet AVG). Contract disputes follow the Terms of Service. Nothing here limits GDPR Art. 77 or GDPR Art. 79.