Privacy Policy

This Privacy Policy explains how Arcwoven collects, uses, discloses, and retains information when you visit Arcwoven websites or use Arcwoven workspaces, APIs, generated models, exports, documentation, and related services (collectively, the "Service").

§ 01Summary

Arcwoven helps users analyze software repositories and generate source-backed system models. With a free account, users submit a public repository URL and Arcwoven creates a workspace and Generated Outputs tied to that account.

Do not submit private repositories, credentials, secrets, confidential information, regulated data, or personal information that you are not authorized to provide.

§ 02Information we collect

Information you provide

We may collect information you provide directly, including:

• repository URLs and import requests;
• prompts, instructions, settings, labels, comments, feedback, review notes, and support messages;
• account information if you create an account or request private access, such as name, email, organization, role, authentication information, and billing or business-contact details;
• files, exports, or other materials you choose to upload or submit; and
• communications with Arcwoven.

Public repository information

When you submit a public repository URL, Arcwoven may fetch and process repository content and metadata, such as source code, configuration files, package manifests, documentation, dependency information, commit metadata, file paths, code comments, issues or pull-request information if supported, and other public repository materials.

Public repositories may contain personal information, such as names, email addresses, usernames, commit messages, comments, or documentation. You are responsible for submitting only repositories and content you are authorized to process through Arcwoven.

Generated and derived information

Arcwoven may create Generated Outputs and derived information, including architecture models, capability models, diagrams, evidence links, validation scores, import logs, embeddings or indexes, system summaries, workspace state, usage metrics, and diagnostic information.

Technical and usage information

We may collect technical information automatically, including IP address, browser type, device information, operating system, referring pages, pages viewed, timestamps, session identifiers, request logs, error logs, performance data, security events, approximate location derived from IP address, and product usage events.

Cookies and similar technologies

Arcwoven may use cookies, local storage, and similar technologies to operate the website and Service, remember preferences, maintain sessions, prevent abuse, measure performance, and understand usage. Arcwoven does not currently use advertising cookies, advertising pixels, retargeting, or session replay on the public website. If Arcwoven later uses non-essential analytics, advertising, or tracking cookies, Arcwoven will provide consent or opt-out controls where required by applicable law.

§ 03How we use information

Arcwoven may use information to:

• provide, operate, and improve the Service;
• fetch and analyze submitted repositories;
• generate source-backed models, evidence, diagrams, summaries, validation information, and exports;
• create, maintain, and operate workspaces;
• authenticate users and administer accounts, private access, and customer relationships;
• provide support, respond to inquiries, and communicate about the Service;
• monitor performance, debug issues, improve import quality, and develop new features;
• protect the Service, users, repositories, and third parties from abuse, security threats, excessive use, and unlawful activity;
• comply with legal obligations and enforce Arcwoven terms and policies; and
• send service-related notices and, where permitted, product updates or marketing communications.

§ 04AI, model, and product-improvement use

Arcwoven uses automated analysis and model-based systems to generate outputs from repository evidence.

Arcwoven does not use submitted repository content to train third-party foundation models. Arcwoven may use aggregated, de-identified, or non-content diagnostic information to improve the Service.

§ 05Legal bases for processing

Where European or similar privacy laws require a legal basis, Arcwoven relies on one or more of the following:

• Contract: to provide the Service you request and perform Arcwoven's agreements;
• Legitimate interests: to operate, secure, debug, improve, and protect the Service, and to communicate about relevant product matters;
• Consent: where required for certain cookies, marketing, or optional features; and
• Legal obligations: to comply with law, respond to lawful requests, and enforce rights.

§ 06How we disclose information

Arcwoven may disclose information to:

• service providers and subprocessors that host, operate, secure, support, analyze, or improve the Service;
• provider categories such as cloud hosting, database or storage, AI/model processing, logging, security, email delivery, support, analytics, and payment processing when those services are enabled;
• enterprise customers or workspace administrators, where your use is associated with an organization;
• third parties involved in a business transaction, such as a merger, acquisition, financing, reorganization, or sale of assets;
• law enforcement, regulators, courts, or others when required by law or to protect rights, safety, and security; and
• others with your direction or consent.

§ 07Sale or sharing of personal information

Arcwoven does not sell personal information for money. Arcwoven also does not knowingly share personal information for cross-context behavioral advertising unless the Privacy Policy, cookie controls, and any required opt-out mechanisms clearly say so.

Arcwoven does not currently use advertising pixels or retargeting on the public website.

§ 08Retention

Arcwoven retains information only as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required by law or an applicable agreement.

Arcwoven's retention practices include:

• Workspace content and Generated Outputs: retained while your account is active, until you delete the workspace or your account, after which Arcwoven deletes or de-identifies them within a reasonable period.
• Operational logs: retained for up to 90 days for security, debugging, abuse prevention, and service reliability.
• Account, billing, private-access, and customer records: retained while the account or relationship is active and for a reasonable period afterward as needed for legal, tax, audit, security, and business purposes.
• Support communications: retained as needed to respond to requests, maintain records, and improve support.
• Aggregated or de-identified information: may be retained without a time limit if it no longer identifies a person or organization.

§ 09Security

Arcwoven uses administrative, technical, and organizational measures designed to protect information. No system is perfectly secure, and Arcwoven cannot guarantee that information will be secure from unauthorized access, loss, misuse, or alteration.

Do not submit secrets, credentials, private keys, passwords, regulated data, or confidential information to Arcwoven workspaces.

§ 10International transfers

Arcwoven may process information in the United States and other countries where Arcwoven or its service providers operate. If applicable law requires transfer safeguards, Arcwoven will use appropriate safeguards such as standard contractual clauses, adequacy decisions, or other lawful transfer mechanisms.

§ 11Your choices and rights

Depending on your location, you may have rights to access, delete, correct, restrict, export, or object to certain processing of your personal information. You may also have the right to withdraw consent where processing is based on consent.

To exercise privacy rights, contact [email protected]. Arcwoven may need to verify your request and may deny requests where allowed by law, such as when Arcwoven cannot verify your identity or must retain information for security, legal, or operational reasons.

California residents may have rights to know, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, and not be discriminated against for exercising privacy rights, where the California Consumer Privacy Act applies.

§ 12Children's privacy

The Service is not directed to children under 13. Arcwoven does not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to Arcwoven, contact [email protected].

§ 13Third-party services and public repositories

The Service may interact with third-party platforms and public repositories. Arcwoven is not responsible for the privacy, security, or content practices of third-party services. Your use of third-party services remains governed by their own terms and privacy policies.

Arcwoven is not affiliated with, sponsored by, or endorsed by GitHub. GitHub is a trademark of GitHub, Inc. Any reference to GitHub is for compatibility and source-location purposes only.

§ 14Changes to this Privacy Policy

Arcwoven may update this Privacy Policy from time to time. If Arcwoven makes material changes, it will provide notice by posting the updated policy, updating the effective date, or using another reasonable method.

Arcwoven will not rely on a quiet retroactive change to expand rights over previously submitted private content in a materially different way without appropriate notice or consent where required.

§ 15Contact

Privacy questions and requests may be sent to:

Arcwoven Systems
[email protected]