← Back to Arkathos

Privacy Policy

Arkathos by TheApexFrameworkLLC  |  Effective Date: October 21, 2026  |  Version 1.4

1. Introduction

TheApexFrameworkLLC ("we," "us," or "our") operates Arkathos, an AI-powered business management platform available at arkathos.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By accessing or using Arkathos, you agree to this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

2. Information We Collect

2.1 Information You Provide Directly

• Account information: name, email address, phone number, business name, and password
• Business financial data: transactions, invoices, estimates, expenses, revenue records, and tax-related information
• Customer and contact records: names, email addresses, phone numbers, and business relationship data you enter into the Sentinel CRM agent
• Employee and HR data: any personnel information you enter into the Marshall HR agent
• Protected children's records (childcare, daycare, and education verticals): If your business provides childcare, daycare, tutoring, after-school, or similar services, you may enter records about the minors in your care into the Marshall agent — such as a child's name, date of birth, guardian and authorized-pickup contacts, allergy and medical notes, attendance, and parental-consent records. We process this information only as a service provider acting on your behalf and under your instructions; you are the controller of these records and are responsible for providing required notices to, and obtaining any required consent from, the children's parents or legal guardians.
• Support communications: messages you send through the Guardhouse support agent or directly to our support team
• Content you create: social media drafts, marketing materials, documents, and other content generated through our AI agents
• Payment information: billing details processed through Stripe (we never store your full credit card number)
• Verification and two-factor authentication: When you verify your account or use two-factor authentication, we use the email address and phone number already collected per "Account information" above to send one-time verification codes. We store those codes only as a one-way hash, never in readable form (see Section 7).

2.2 Information Collected Automatically

• Device information. Device type, operating system, browser type, and device identifiers. When you access the Service through a web browser — including through the in-app browser surface (SFSafariViewController on iOS, Chrome Custom Tabs on Android) used during account activation, billing, and any other payment-related action — we collect a hashed combination of canvas rendering output, WebGL parameters, and installed font signatures, along with browser-derived device characterization signals. Timing of collection: Device fingerprinting is collected EARLY in the signup or payment flow — before account creation completes or payment authorization completes — so that fraud-detection signals are available BEFORE high-risk decisions are finalized. Fingerprinting is performed once per signup attempt and once per payment event; it is NOT collected during normal authenticated session use after signup completes, and is NOT collected on routine page loads. This data is collected solely for the purpose of fraud prevention at signup and during payment events, and is retained in association with your account for fraud-pattern matching across new signup attempts. The Arkathos iOS and Android applications do not perform on-device fingerprinting and do not transmit derived device-identification signals from the application process. Device fingerprinting is performed only during web-based signup, account activation, and payment flows.
• Trusted-device recognition (account security). Separately from the device fingerprinting described in the bullet above (which is unchanged and remains limited to web signup and payment flows), we identify your device to recognize trusted devices and help secure your account. When you sign in and while you use the Service — on the web workspace and in the Arkathos mobile applications — we compute, entirely on your device, a hashed device identifier derived from your browser/device characteristics (such as user-agent, language, screen and time-zone characteristics, and a locally rendered canvas signal). Only the resulting hash is transmitted to Arkathos's own systems; the underlying signals are never transmitted, and the hash is never shared with any third party. We use it to maintain the list of devices authorized on your account, to show you those devices in your account settings so you can revoke ones you don't recognize, and to detect sign-ins from unrecognized devices. Unlike the device fingerprinting above, this device-recognition processing occurs at login and during authenticated session use (not only at signup or payment) and applies to the mobile applications as well as the web workspace. This disclosure supersedes the statements above that device identification is not collected during authenticated session use, and that the mobile applications do not transmit derived device-identification signals — to the extent of the trusted-device-recognition purpose described here only.
• Usage data: pages visited, features used, agent interactions, timestamps, and session duration
  • In-product session recording: to improve usability and diagnose defects, we record a visual replay of your session — the screens as they appear to you and the actions you take as you move through the Arkathos workspace. Values you type into form fields are masked at capture and are never recorded (passwords, payment details, and other entries are never captured), and the interactive 3D workspace is excluded from capture. Recordings are tied to your business account and are visible only to authorized internal Arkathos staff; they are never shared with other customers. Consistent with the cookie-consent choices described in our Cookie Policy, session recording is enabled by default for United States visitors — you are shown a notice and can turn it off at any time — and is not enabled for EU/UK/EEA visitors until you give prior opt-in consent; we honor the browser Global Privacy Control (GPC) signal as an opt-out wherever it is present. Declining or turning off recording does not affect your use of the Service, and you may withdraw consent at any time in the app or by emailing privacy@arkathos.com. Recordings are automatically and permanently deleted 12 months after the session (see Section 7).
• Product analytics (first-party, consent-gated). With your consent, we operate a first-party, self-hosted product-analytics suite to understand how the Service is used so we can fix bugs and improve it. Using a first-party visitor-key cookie (alog_vk) and a consent-gated analytics beacon, we collect the pages and routes you visit, the actions and clicks you take (the element and its visible label — never the values you type), UTM campaign parameters and referrer, a coarse device class (such as desktop, tablet, or mobile), and we attribute this activity to your signed-in account, your authenticated session, and your device. This data is used INTERNALLY ONLY to diagnose defects and improve the product; it is never sold. The analytics suite is fully self-hosted on Arkathos infrastructure — no third-party analytics service is used, and this data is not sent to any third party.
• IP address: used for security (rate limiting and abuse prevention) and to derive an approximate, country-level location. The country signal is read from a request header set by our edge network provider (Cloudflare) and is used to apply the correct regional privacy-consent default described in this Section; we do not use a third-party geolocation service, and our first-party product analytics never stores your raw IP address.
• AI interaction data: prompts you send to our AI agents and the responses generated, used to improve agent accuracy for your account

2.3 Information from Third Parties

• Stripe: payment confirmation, subscription status, and billing history
• Business services you connect: if you connect a third-party business service to Arkathos (see Section 5.5) — for example an email mailbox, a calendar, a workspace-messaging tool, a point-of-sale or payment service, a sales-tax engine, or an e-commerce store — we receive the data that service returns for the integration you configured. Where you connect a mailbox or calendar, this can include messages, events, and attendee or correspondent details belonging to people other than you; you are the controller of that data and are responsible for the notices and consents it requires.
• Business details you ask us to suggest. Instead of typing your business details, you can ask the Service to suggest them from your business's own website, during setup or later in your business details settings. You give the address of the website and confirm that it is your business's own website; the Service does not check that it is, so give only the address of your own business's website. At your request, the Service reads that one public page and no other page of the site. An address on a social media platform is not read as your website, and an address that begins with http rather than https is read with the same safeguards, and you are told that the site's address is not encrypted. The Service takes the business details the page publishes in machine-readable form for search engines and, only where you have given the AI consent described in Section 7(c) of our Terms at its current version, also sends text from the page to an AI provider to find your business details in it (see Section 4). After reading the page, the Service also reads that website's robots.txt file once and checks the page for a setting that asks search engines not to list it, only so that it can tell you if your website asks search engines to stay away; this never stops the suggestions. You review each suggested detail and decide whether to use it, change it or not use it, or use all the suggested details at once; a detail the page does not state is left empty rather than guessed. Opening hours found on the page are shown to you but are not saved from a suggestion; you set your hours yourself. Only the details you approve are saved, into the same business details you can otherwise enter yourself: during setup, when you continue through the setup screens, and in your business details settings, when that screen saves your change. Nothing from a suggestion is stored before you approve it. Afterwards, of what was suggested, only the details you approved are kept, together with a note beside your business details of where each approved detail came from (the details the page publishes for search engines, or the AI reading of the page), whether you changed it before approving it, and when it was saved; the note for a detail is removed when you later change that detail, and replaced when you approve a new suggestion for it. The page, its text and an AI provider's reply are not kept. If the page cannot be read, you are told why and what to check, and the Service's operating log records the website's host name (not the full address), the kind of failure and the website's reply code, to help with problems reading websites; when a page is read, the log records only the outcome, not the address. During setup, your time zone can be suggested from the U.S. state in your business address, using a table of states and time zones built into the Service and never your browser's or device's time zone; where the state has two time zones, or no state has been chosen, you choose one from a short list, and it is saved only when you confirm it and only if your account has no time zone saved yet.

3. How We Use Your Information

We use the information we collect to:

• Provide and maintain the Arkathos platform and its AI-powered agents
• Process your financial data through the Treasury agent for bookkeeping, invoicing, and financial reporting
• Generate AI-powered insights, recommendations, and content through our agent system
• Process payments and manage your subscription
• Send you verification codes (SMS two-factor authentication), account-related and transactional service notifications, and business-communication messages that you or your business direct us to send, via SMS or WhatsApp, as described in Section 5.4
• Provide customer support through the Guardhouse agent and our support team
• Detect and prevent fraud, unauthorized access, and security threats
• Improve and personalize your experience based on your usage patterns and agent training preferences
• Create de-identified, aggregated datasets to improve Arkathos for all customers — a vendor/supplier reference directory, marketing/creator suggestions, AI response-quality improvement, and security/abuse-pattern detection — as described in Section 4.1 (cross-customer features are opt-in)
• Monitor how the platforms that carry your messages report on them — a WhatsApp quality rating or restriction, an email bounce, complaint or suppression, a carrier error code, and a sending domain's spam-report rate and reputation — so that we can advise you before a large send, apply sending limits, and stop sending on a channel a platform has flagged for your account (see Section 4.2)
• Comply with legal obligations

4. AI Data Processing

Arkathos uses artificial intelligence to power its business management agents. When you interact with our AI agents, your prompts and business data are sent to third-party AI providers for processing. We use Anthropic and Google (Gemini) for certain agent tasks; which provider handles a given task depends on the task and the agent. Important details about this processing:

• Your data is sent to AI providers solely to generate responses to your requests. We do not sell your data to AI providers.
• AI providers process your data according to their own privacy policies and data processing agreements.
• Agent training data (your business profile, custom rules, and preferences) is stored in our database and used to personalize AI responses for your account. Except for the opt-in, de-identified platform-improvement uses described in Section 4.1, we do not use your identifiable business data to benefit other customers.
• What you tell an agent is saved to your business profile. When you tell one of our AI agents a fact about your business — for example where you operate, the size and roles of your team, the tools you use or the services you offer — the Service saves that fact to your business profile automatically, without asking you to confirm it first, so that you do not have to give it again. It is then used as the rest of your business profile is used under the bullet above: the AI agents and features that need a fact about your business read it from your profile instead of asking you (for example the content and search-visibility tools, the AI phone secretary and the document assistant). Only facts about your business of the kinds your business details settings hold are saved this way. A person's details, a customer's details, a child's record (Section 10), payment card numbers and authentication secrets are never saved this way, and a fact saved this way is saved only to your own account and is never read by another business's account.
• Seeing, changing and removing what was saved. When a fact is saved, the agent tells you what it saved, and you can undo it there, which puts back the value your profile held before unless you have since changed it yourself. Every fact saved this way appears on your business details settings, where you can change it at any time without using an AI agent, and remove it unless the settings need a value there (your business details must keep at least one service, for example). For each fact saved this way we keep, in your account, when it was saved, the value it replaced and a short excerpt of the words it was taken from, so that it can be undone. Saved facts are part of your account data and are retained and deleted under Section 7.
• What your customers give you. Details your customers give through your booking page, client portal or intake form, and details you or your staff enter for them, are kept on that customer's record in your account (see Section 5.7). A booking may be matched to the record you already hold for that customer. The booking page shows nothing from that record, except that a page opened through a personal booking link you gave the customer (Section 29.2(e) of our Terms) may greet the customer by the first name on it; when it does, the booking is made on that record and a name, email address or phone number typed on that page is not used. Apart from the call outcomes described in Section 5.6, the Service does not write anything into a customer's record from a conversation between that customer and an AI assistant.
• What is operating today, and what is not. Automatic saving of what you tell an agent is not operating in the Service today: no agent writes to your business profile, which holds only what you enter on the setup and business details screens. When a personal booking link you gave a customer opens a page that greets them by first name, they are booked on the record you already hold for them, without having to type their details again (Section 29.2(e) of our Terms). For a returning customer recognised by a one-time code or by their signed-in client portal, the Service does not fill in their details for them yet. We will state here when any of this changes.
• We do not use your business data to train general-purpose AI models, and our AI providers commit under their business/paid-tier terms not to train their foundation models on customer prompt or response content.
• Reading your website for business details. When you ask the Service to suggest your business details from your business's website (Section 2.3), and only after you have given the AI consent described in Section 7(c) of our Terms at its current version, text from that one page, and nothing else about your account, is sent to Google (Gemini), one of the AI providers named above, to find your business details in it. Before each such reading the Service checks that your consent is recorded at the current version, and sends nothing when it cannot confirm it. A detail from the provider's reply is suggested only where the words it came from appear on the page itself; otherwise that detail is left empty. The Service does not keep the page's text or the provider's reply. Without that consent, only the details the page publishes in machine-readable form are suggested.
• AI video generation. If you use the AI video features, the prompt text and any source image you upload for that video are sent to the video engine the composition pipeline routes that shot to — Google (Veo 3.1), ByteDance (Seedance), Runway, Higgsfield, MiniMax (Hailuo 02) or Kuaishou (Kling), each named in Section 7(c) of the Terms — to produce the requested asset. Do not upload images of people who have not agreed to that use.
• Voice calls. Where you enable the AI phone secretary, live call audio and the conversation itself are processed by SignalWire's voice AI. See Section 5.6. Separately from the secretary, where you enable call recording for the AI voice calls your business places (Section 23.4(e) of the Terms), we record those calls and keep the recording and its transcript for the period stated in Section 7. Every recorded call opens with a spoken notice, played before the assistant speaks, that the call may be recorded for quality assurance and to improve the assistant. Recording is off unless you turn it on, and you can turn it off at any time. We do not derive a voiceprint or any other biometric identifier from a recording (see Section 6.1). Call recording is not operating in the Service today; we will say so here when it is.
• Conversations with your customers. Where you enable it, an AI assistant may answer your own customers on the channels we operate for you — the web chat widget, SMS, WhatsApp, email, and AI voice calls. The first message of any such conversation says that the person is speaking with an AI assistant acting for your business, and how to reach a person instead. You are the controller of those conversations and we process them on your instructions; you can take the conversation over at any time, and every change of control between the assistant and a person is recorded. See Section 83 of the Terms. This is not operating in the Service today.
• Children's records. Where your business enters records about minors (childcare/daycare/education verticals), those records are not sent to any third-party AI provider and are excluded from any cross-customer analytics or platform-improvement processing. We do not use children's records to train AI models.

4.1 De-Identified Platform Improvement (Opt-In)

To make Arkathos better for everyone, we may create de-identified and aggregated datasets from business records and agent interactions and use them to operate, secure, and improve the Service — for example:

• Vendor/supplier reference directory: aggregated, source-anonymized information about suppliers and typical price ranges, so the Armory inventory agent can suggest relevant vendors (it checks our directory first, then the web).
• Marketing and creator suggestions: aggregated signals about creators and channels relevant to a business's niche.
• AI response quality: when an agent produces a poor or incorrect response, we may use the de-identified prompt, response, and correction to improve agent prompts, rules, and retrieval so future responses are better.
• Per-industry improvement from conversations: with your opt-in, we use de-identified patterns and rewritten examples taken from reviewed conversations at businesses in your own industry to improve the AI that serves businesses in that industry — the instructions it follows, the examples it learns a good answer from, the sources it looks things up in, and the test sets we score it against. Data from another industry is never mixed into yours. This is a refinement of how the AI is instructed and what it can look up; it is not the training of an AI model on your content, which Section 4 says we do not do.
• Security and abuse detection: we collect and analyze patterns of malicious input (such as SQL-injection and prompt-injection attempts) to harden the platform's defenses.

How we protect you in all of the above:

• These datasets are de-identified (they do not identify you) and aggregated; we never expose one customer's private records, contacts, or specific pricing to another customer in identifiable form.
• We never sell this data, and it is never shared outside Arkathos for these purposes.
• Cross-customer improvement (the supplier directory, creator suggestions, and AI-quality corpus) is opt-in — you control it in your privacy settings. Within your own account, we always use your data to improve your own experience.
• Security and abuse detection is performed as a necessary measure to protect the Service and all customers.
• Excluded categories: protected children's records (Section 10), payment card numbers, authentication secrets, and biometric data are never included in any platform-improvement dataset. The exclusion is enforced by the Service before anything enters one of these datasets; it is not left to be assumed.
• The cohort rule, in plain words: a pattern is only used across businesses when it appears at several unrelated businesses. A pattern seen at one business stays with that business. Raw conversations never cross the boundary of the account they belong to — what crosses it is a de-identified pattern or a rewritten example, reviewed by a person before it is used.
• The sources, named. For the conversation uses above, the sources are the channels we operate for you: web chat, SMS, WhatsApp and email. Voice is separate and needs its own switch: a transcript of a recorded call is a source only where you have separately enabled call recording (Section 4, "Voice calls", and Section 23.4(e) of the Terms), and only as a transcript — call audio itself is never placed in one of these datasets, and no voiceprint is derived from it.
• The language of the conversation. Conversations are processed in the language they are written or spoken in, and the notices this Policy describes are shown in that language.
• WhatsApp conversations are excluded from any cross-customer dataset, because the WhatsApp Business Solution Terms restrict that use. The exclusion is recorded with its reason rather than applied silently.
• Withdrawal. You may withdraw from cross-customer improvement at any time in your privacy settings. Withdrawal stops any further use of your account's material and removes your account's contributions from what we build afterwards. It cannot retract an instruction, example or test set we have already published, and we will not tell you otherwise.
• From the date of notice forward. A purpose we add to this Section applies only to conversations and calls captured after that change takes effect and after we have given you notice of it. We do not apply a new purpose to what was captured before it.
• What is operating today, and what is not. Your choice is live: in your privacy settings you decide whether your conversations may contribute to this improvement — separately for written conversations and for recorded calls — and you can withdraw at any time. We record the choice, every change of it and the withdrawal, and withdrawal cannot retract an instruction, example or test set we have already published. Nothing has been captured yet: no part of the Service hands a conversation to this material, so it holds nothing of yours, nothing has been reviewed and nothing has been built from it. Call recording is not operating, so no call transcript is a source today. And nothing taken from one business's conversations is served to another: that use is built and is not switched on, and it cannot be switched on from an account. We will state here when any of this changes.

4.2 Sending Health Signals

When your business sends messages through Arkathos, the platforms that carry them report back on how they were received. We receive and store those reports per account so that we can advise you, apply sending limits, and stop sending on a channel a platform has flagged.

• What we receive: from the WhatsApp Business Platform, a quality rating, a messaging limit, an account or number restriction, and a scheduled disablement; from our email delivery provider, a bounce, a complaint and a suppression; from mobile carriers, a message-delivery error code; and, for a sending domain, the mailbox provider's aggregate spam-report rate and domain reputation. Where you connect a mailbox provider's reporting for a domain you control, we read that provider's aggregate reporting for that domain only.
• What we store: one record per report, scoped to your account, carrying the platform's own wording and the time it was observed. A report can include the fact that a recipient marked one of your messages as spam. We do not receive, and do not store, the identity of the recipient who reported it unless the platform includes it.
• What we do with it: advise you before a large or unusual send, apply the per-account sending limits described in Section 83.7 of the Terms, and keep the record an appeal to a platform would need. It is never sold and never shared outside Arkathos for these purposes.
• How long we keep it: see Section 7.
• What we cannot do: no platform offers a way for us to submit our own assessment of your sending before that platform makes its own. We read what the platforms report; we do not pre-empt it.
• What is operating today, and what is not. We receive and store the email delivery provider's reports, the carrier error codes and the WhatsApp platform reports described above, each as its own record scoped to your account, and what we have recorded is consulted before a message is sent for you. We do not yet read a mailbox provider's aggregate reporting for a sending domain, and we do not yet keep the record of an advisement or a sending limit that Section 37.9 of the Terms describes. Those are open items and we will not represent otherwise until they ship.

5. How We Share Your Information

We do not sell your personal information. We share your information only in the following circumstances:

5.1 Service Providers

We share data with third-party service providers who help us operate Arkathos:

5.2 Legal Requirements

We may disclose your information if required by law, subpoena, court order, or other governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5.3 Business Transfers

If TheApexFrameworkLLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on our Service before your information becomes subject to a different privacy policy.

5.4 Mobile Information, SMS Text Messaging, and WhatsApp Opt-In

Text-messaging program. Mobile phone numbers and the text-messaging opt-in consent you provide at signup are used to send you: (i) account verification codes (SMS-based two-factor authentication one-time passcodes); (ii) account-related and transactional service notifications; and (iii) business-communication messages that you or your business direct us to send through the platform (for example, scheduling or dispatch notifications to your own workers or contacts). We do not currently send marketing or promotional text messages. If we ever introduce marketing text messages, we will do so only with your separate, express written consent, and opting out of marketing messages will not affect delivery of verification codes or security notifications. SMS messages are delivered by our messaging provider, SignalWire (see Section 5.1), acting as our service provider (processor) solely to transmit messages on our behalf.

How consent is captured. Text-messaging consent is captured at signup through a dedicated consent checkbox. We retain the verbatim consent language presented to you, together with a timestamped, phone-number-scoped record of your opt-in (and any subsequent opt-out), as evidence of consent. See Section 7 for the retention period applicable to these consent records.

No sharing of mobile information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are not shared with any third parties. Stated plainly: mobile phone numbers and SMS opt-in/consent data are never shared with or sold to third parties or affiliates for their own marketing or promotional purposes. Sharing with subcontractors that support message delivery (such as SignalWire) occurs solely so those providers can deliver the messaging service on our behalf.

Opting out. You may opt out of SMS at any time by replying STOP to any message, and reply HELP for assistance. Message and data rates may apply, and message frequency varies.

WhatsApp Business channel. Some business-communication conversations may run over WhatsApp instead of SMS. Where a conversation runs over WhatsApp, message delivery is processed by Meta Platforms, Inc. through the WhatsApp Business Platform (Cloud API), acting as a service provider listed in Section 5.1, and your WhatsApp conversations are also subject to WhatsApp's and Meta's own terms of service and privacy policy. Recipients must opt in before receiving business-initiated WhatsApp messages, as required by Meta policy; where messages are sent at a business's direction, that business is responsible for obtaining the recipient's prior opt-in before enrolling the recipient's number. Opt-out (STOP) requests are recorded and honored across both SMS and WhatsApp: the phone-number-scoped opt-out/suppression record is channel-neutral, and the signup consent record described above covers the account holder's own number for both channels. Business-initiated WhatsApp messages sent outside WhatsApp's 24-hour customer-service window use Meta-approved message templates. To stop receiving WhatsApp messages, reply STOP (or request an opt-out) in the conversation, or block the sender within WhatsApp; an opt-out received on either channel is honored across both SMS and WhatsApp. The no-sharing commitments above apply equally to the WhatsApp channel: phone numbers and opt-in consent data are shared with Meta solely to deliver messages, never for Meta's or any other party's marketing or promotional purposes.

5.5 Integrations You Connect

Arkathos allows you to connect your own third-party accounts and services to the platform — for example, workspace messaging tools (such as Slack), email and calendar accounts, social media platforms, point-of-sale and payment services, sales-tax computation engines, bank-data connections, e-commerce stores, and similar business connectors. When you connect such a service using your own account or credentials, any data you direct Arkathos to send to that service (for example, a dispatch notification posted to your own Slack workspace, or content published to your connected account) is transmitted to that service and is thereafter governed by that service's own terms and privacy policy. In these cases we act on your instructions as a service provider (processor); you are the controller of the data you direct us to transmit and are responsible for ensuring you have the rights and any required consents to send it to the connected service. Credentials and tokens for connected services are stored encrypted (see Section 6) and are used only to operate the integration you configured.

Bank-data connections (Plaid). Bank-data connections are provided by Plaid Inc. ("Plaid"). When you connect a bank account, you sign in to your bank through Plaid, and Plaid sends Arkathos the account and transaction data for the accounts you choose to connect; Arkathos does not receive or store your bank login details. By connecting an account, you agree to Plaid's End User Privacy Policy (https://plaid.com/legal/#end-user-privacy-policy), which governs how Plaid itself handles your data. The access token Plaid issues for your connection is stored encrypted and is used only to import your transactions. The account owner can disconnect a bank account at any time; disconnecting revokes Arkathos's access at Plaid and deletes the stored access token. Transactions already imported stay in your account under Section 7 until you delete them.

Google user data. Where you connect a Google account (for example Gmail or Google Calendar), Arkathos's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. In plain terms: data received from Google APIs is used only to provide the mailbox and calendar features you configured; it is not used for advertising, is not sold, and is not transferred to third parties except as needed to provide those features, as required by law, or as part of a merger or acquisition with prior notice to you. Connections to Microsoft accounts (Outlook / Microsoft 365) and Apple calendar accounts are operated under the same internal restrictions.

5.6 AI Phone Secretary (Voice Calls)

Arkathos offers an optional AI phone secretary that answers inbound calls to a business phone number you have configured on the platform. It is off by default and answers calls only after the account owner turns it on.

Who processes the call. The AI secretary is operated by SignalWire, our telephony provider (listed in Section 5.1), using SignalWire's voice-AI service. When the secretary answers a call, the live audio of that call and the conversation itself — everything the caller says and everything the assistant says — are transmitted to and processed by SignalWire in order to hear the caller, speak back, and carry out the request. SignalWire processes this information as our service provider (processor) and under its own terms of service and privacy policy. Arkathos supplies the assistant's instructions (your business details, greeting, and any voice notes you have written for it); SignalWire supplies the speech processing.

Callers may not be you. Anyone who calls the business number reaches the assistant. Callers are frequently third parties who do not have an Arkathos account and who have no direct relationship with us — your customers, prospects, suppliers, and members of the public. Where a business enables the AI secretary on its number, that business is the controller of the call information and is responsible for any notice, disclosure, or consent that applicable law requires for AI-handled or recorded calls — including any state or national two-party/all-party consent requirement, and any requirement to disclose that the caller is speaking with an automated assistant. Arkathos acts as a service provider (processor) on the business's instructions.

What Arkathos stores. Arkathos does not store audio recordings of these calls, and does not store a transcript of the conversation. What we store is the outcome of the call, in text, in the business's own account:

• a message the caller asked us to pass along (stored as a short note on the account, limited in length and marked as coming from a call);
• a contact and lead record where the caller asked to be followed up with (which can include the name and phone number the caller gave);
• a booking request, or a draft estimate or draft invoice, where the caller asked for one — all created as drafts for the account owner to review;
• an internal event record of what the assistant did on the call, and the call's duration, which we use to meter the account's voice usage.

These records are stored in the business's account under the same tenant isolation, security, and retention terms as the rest of the account's data (Sections 6 and 7). The account owner may edit or delete them at any time. Where the assistant takes a message or captures a lead, we also notify the account owner by message on the account's configured channel.

Call metadata. Independently of the assistant, our telephony provider processes the standard call metadata required to connect any phone call — the calling and called numbers, the time, and the duration — as described in its own privacy policy.

5.7 If You Are a Customer of a Business That Uses Arkathos

This section is for people who deal with a business that uses Arkathos — for example by booking an appointment on its booking page, signing in to its client portal, sending its intake form, calling its AI phone secretary or receiving its messages — and who do not have an Arkathos account of their own.

• Who is responsible for your information. The business you deal with decides what it collects about you and why; it is the controller of that information. Arkathos processes it on that business's behalf and under its instructions, as its service provider (processor). Your information is kept in that business's own account. It is not shared in a form that identifies you with any other business that uses Arkathos (Section 4.1 describes the only de-identified uses, which the business chooses whether to allow), and, apart from the referral record described below, it is not used for Arkathos's own marketing.
• What the business may collect through Arkathos. On a booking page: your name, email address, phone number and any notes you add. On an intake form: your name, email address, phone number and a description of what you need, your state and your location where you give them, and, as a record of the submission, the IP address and browser information it was sent from. In a client portal: your email address, your answer to whether you are 18 or older and, where it applies, a parent's or guardian's consent, your invoices and payments (card payments are processed by Stripe, and we never store your full card number), any files you send through it, and the pages, invoices and project views you open. If you follow the "Powered by Arkathos" link in a client portal, Arkathos records that the visit came through that business's portal, with a keyed one-way code made from your email address, for its referral program (Section 68.8 of our Terms). On a call with an AI phone secretary: see Section 5.6. For text and WhatsApp messages: see Section 5.4. The business may also enter details about you itself.
• How you are recognised. You first reach a business's client portal through the invitation link the business gives you and a one-time code sent to your email address on file or given to you by the business, and a portal session lasts at most 12 hours. Once you have access, you can also ask for a new code on the business's portal sign-in page by entering your email address: the page gives the same answer whether or not that address is on file, and a code is sent only to an email address the business already holds for you. The client portal asks whether you are 18 or older before it gives you access; it takes your answer as given and does not check it. A booking you make may be matched to the record the business already holds for you. The booking page shows you nothing from that record, except that if the business gave you a personal booking link, the page opened through it may greet you by the first name on that record; when it does, your booking is made on that record without your having to enter your details again, and a name, email address or phone number you type on that page is not used. Anyone who has that link can book as you, so keep it private. No Arkathos page shows anyone your details from a business's records because your name, phone number or email address was typed into it, with one exception: if someone joins a business's waitlist on its booking page with the same details as a waiting entry made earlier on that page for the same service, the page says that the entry already exists and gives its place in line.
• What is stored on your device. When you sign in to a client portal, your portal session is kept in your browser's local storage (see our Cookie Policy) until you sign out; after it expires it no longer works, and the portal removes it the next time it is opened in that browser. If you use a shared computer, sign out when you finish.
• Your choices and rights. To see, correct or delete what a business holds about you, contact that business first: it controls your information and can act on it. You may also write to privacy@arkathos.com with the subject line "Data Rights Request", naming the business, and we will tell that business about your request and help it respond. The rights described in Section 8 apply to the extent the law gives them to you.
• Security and retention. Your information is protected by the measures described in Section 6 and is kept as part of the business's account data under Section 7.

6. Data Security

We implement comprehensive security measures to protect your information, organized in five layers:

• Network perimeter. The Service is served behind Cloudflare's edge network, which provides DDoS protection and terminates SSL/TLS. All traffic between your device and Arkathos, and between Arkathos and its service providers, is encrypted in transit.
• Abuse and fraud controls at signup and sign-in. Cloudflare Turnstile bot protection, per-IP and per-account rate limiting on the abuse-facing endpoints (account creation, sign-in, and verification-code requests), device fingerprinting at web signup and payment as described in Section 2.2, and input validation on request payloads. Our rate limiting is applied to those abuse-facing endpoints rather than to every endpoint of the Service.
• Infrastructure. Application data is held in a managed Postgres database (Supabase) that is encrypted at rest and in transit and backed up on the provider's managed backup schedule. Tenant isolation is enforced in the database itself by row-level security: every request runs inside a transaction bound to the authenticated user's identity, so the database — not just the application — is what prevents one business's data from being read by another.
• Encryption of sensitive fields and secrets. Sensitive fields and third-party credentials are encrypted at the column level with AES-256-GCM under an envelope model: the database stores only ciphertext, and the data keys that decrypt it are held separately in our key store (Supabase Vault). Keys are separated by data domain, so the key that protects one category of personal information cannot decrypt another. Protected children's records use a dedicated key and a fail-closed posture: if that key is not available, the write is rejected rather than stored unprotected.
• Application-level controls. When you sign in, we issue a signed session token (a JSON Web Token) that expires after a limited period. Your client presents it to our API in an Authorization header on each request; it is held in browser local storage on the web and in application storage on mobile. We do not issue cookie-based session identifiers for the workspace. Sessions can be revoked on the server: signing out invalidates that token, and changing your password invalidates every token issued before the change. Verification and two-factor codes are stored only as a one-way hash, are never readable by us or by anyone with database access, expire ten minutes after they are issued, and are invalidated as soon as they are used or replaced.

While we use commercially reasonable efforts to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6.1 Biometric Information

Arkathos does not collect, capture, store, transmit, sell, lease, or otherwise process biometric identifiers or biometric information. We do not use fingerprint, face-geometry, iris, voiceprint, retina, or hand-geometry recognition to identify or authenticate anyone, and we do not maintain a biometric database. Where your device offers a screen lock or a device-level unlock method, that is a function of your own device and operating system; the associated biometric data stays on your device, is matched entirely by your device's secure hardware, and is never transmitted to or accessible by Arkathos.

The following state-law disclosures are provided for clarity, regardless of whether the state law would otherwise apply to our practices:

• Illinois (Biometric Information Privacy Act, 740 ILCS 14): We do not collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information as defined by 740 ILCS 14/10, and we do not possess, store, disclose, or profit from any such information.
• Texas (Capture or Use of Biometric Identifier, Texas Business and Commerce Code §503.001): We do not capture biometric identifiers as defined by Texas B&CC §503.001, and we do not possess, store, sell, lease, or otherwise disclose biometric identifiers.
• Washington (RCW 19.375 and Washington HB 1493): We do not enroll biometric identifiers in a database for a commercial purpose, and we do not possess or use biometric identifiers as defined by RCW 19.375.
• Other state biometric privacy laws: Where applicable state biometric privacy laws apply to our practices, the same posture holds — we do not possess, store, or transmit biometric identifiers.

If we ever introduce a feature that would process biometric information, we will update this Policy and obtain any consent that applicable law requires before that feature is activated.

7. Data Retention

We retain your information according to the following schedule. Where a retention window is operational and may be adjusted within reasonable bounds, we say so explicitly.

• Active account data: retained for the duration of your subscription.
• After cancellation: business data is retained for a brief operational window (currently 30 days) to permit subscription reinstatement, after which it is deleted. The 30-day window is operational and may be adjusted within reasonable bounds; specific shorter deadlines apply for state-law-required deletion rights (see Section 8). This 30-day deletion does not apply to the categories carved out below — financial and transaction records, and text-messaging consent records — which we are required to keep for longer under tax, accounting, and telecommunications law. Where you exercise a deletion right, we delete what the law permits us to delete and retain only those records we are legally required to keep, for no longer than the applicable retention period.
• Financial and transaction records: retained for at least 7 years, and for longer where a longer period is required, in order to meet applicable tax, accounting, and recordkeeping obligations. This retention period overrides the 30-day post-cancellation deletion window above and survives an account deletion request to the extent the law requires.
• In-product session recordings: retained for 12 months from the start of the recorded session, then automatically and permanently deleted by a scheduled purge.
• Text-messaging and WhatsApp consent records: phone-number-scoped opt-in and opt-out (STOP) records — including the verbatim consent language presented at signup and the timestamps of consent and any revocation — are retained for at least 4 years after the later of the last message sent to you or your revocation of consent, consistent with the federal TCPA limitations period. This retention also overrides the 30-day post-cancellation window above.
• Verification and two-factor codes: stored only as a one-way hash, never in readable form. A code expires ten minutes after it is issued and is invalidated as soon as it is used or replaced.
• Security, audit, and first-party product-analytics records: retained for as long as they remain necessary for security monitoring, abuse investigation, billing accuracy, and product improvement. These records are held on our own infrastructure and are not sent to any third-party logging, error-monitoring, or analytics service. We do not currently operate a fixed automatic purge window for these records; if we adopt one, we will state it here.
• AI-generated video content: retained in your account until you delete it or your account data is deleted under the windows above.
• Voice-call records: we do not retain audio recordings or transcripts of calls handled by the AI phone secretary (see Section 5.6). The text records created from a call — messages, leads, bookings, and draft documents — are retained with the rest of your account data under the windows above and can be deleted by the account owner at any time. Recorded AI voice calls are separate: where you have enabled call recording for the AI voice calls your business places (Section 23.4(e) of the Terms), the recording and its transcript are retained for 90 days from the date of the call and are then deleted, unless you delete them earlier from the Service's settings or a legal hold applies. Call recording is not operating in the Service today, so no such recording exists.
• Conversation records: the messages exchanged in a conversation between an AI assistant and one of your customers, the changes of control between the assistant and a person, and the decisions recorded against an AI-drafted reply are communication records and are retained with the rest of your account data under the windows above. A recorded call is the exception and follows the line above.
• Sending-health signals: the platform reports described in Section 4.2 are retained on the same schedule as the communication records they describe, and are deleted with your account data under the windows above.
• Backup data: follows the managed backup retention schedule of our database hosting provider (Supabase).

8. Your Rights

Depending on your location, you may have certain rights regarding your personal information. Time periods specified for our response apply per applicable state law; in all cases we strive to respond as promptly as practicable.

8.1 All Users

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate personal information
• Deletion: Request deletion of your personal information and account. We honor deletion requests except where a record must be kept to meet a legal obligation — see the retention carve-outs in Section 7 (financial and transaction records; text-messaging consent records). Where we must keep such a record, we tell you which category it falls into and delete it once the applicable period ends.
• Data Export: Request a machine-readable export of your data. Currently fulfilled via written request to privacy@arkathos.com with subject line "Data Rights Request" and your account email address. We respond within 30 days for general requests; specific state-law deadlines (see Sections 8.2 through 8.10) apply where applicable. A self-service consumer portal for instant data export is planned for a future release.

8.2 California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and California Privacy Rights Act:

Right to Know: You can request details about the categories and specific pieces of personal information we collect, the sources of that information, our business purposes for collecting it, and the categories of third parties with whom we share it.

Right to Delete: You can request that we delete your personal information, subject to certain exceptions.

Right to Opt-Out of Sale: We do not sell your personal information. If this changes, we will provide a clear opt-out mechanism.

Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us at privacy@arkathos.com. We will respond to verified requests within 45 days, with one extension of up to 45 additional days where reasonably necessary, consistent with the CCPA / CPRA.

8.3 New Jersey Residents (NJDPA)

If you are a New Jersey resident, you have rights under the New Jersey Data Privacy Act ("NJDPA"), including the right to access, correct, delete, and obtain a portable copy of your personal data, and the right to opt out of targeted advertising, the sale of personal data, and certain profiling. We do not sell personal data and do not engage in targeted advertising. To exercise NJDPA rights, contact us at privacy@arkathos.com; we will respond within 45 days, with one extension of up to 45 additional days where reasonably necessary, consistent with the NJDPA.

8.4 Virginia Residents (VCDPA)

If you are a Virginia resident, you have rights under the Virginia Consumer Data Protection Act ("VCDPA"), including the right to access, correct, delete, and obtain a portable copy of your personal data, and the right to opt out of targeted advertising, the sale of personal data, and certain profiling. We do not sell personal data and do not engage in targeted advertising. To exercise VCDPA rights, contact us at privacy@arkathos.com; we will respond within 45 days, with one extension of up to 45 additional days where reasonably necessary, consistent with the VCDPA.

8.5 Connecticut Residents (CTDPA)

If you are a Connecticut resident, you have rights under the Connecticut Data Privacy Act ("CTDPA"), including the right to access, correct, delete, and obtain a portable copy of your personal data, and the right to opt out of targeted advertising, the sale of personal data, and certain profiling. We do not sell personal data and do not engage in targeted advertising. To exercise CTDPA rights, contact us at privacy@arkathos.com; we will respond within 45 days, with one extension of up to 45 additional days where reasonably necessary, consistent with the CTDPA.

8.6 Texas Residents (TDPSA)

If you are a Texas resident, you have rights under the Texas Data Privacy and Security Act ("TDPSA"), including the right to access, correct, delete, and obtain a portable copy of your personal data, and the right to opt out of targeted advertising, the sale of personal data, and certain profiling. We do not sell personal data and do not engage in targeted advertising. To exercise TDPSA rights, contact us at privacy@arkathos.com; we will respond within 45 days, with one extension of up to 45 additional days where reasonably necessary, consistent with the TDPSA.

8.7 Oregon Residents (OCDPA)

If you are an Oregon resident, you have rights under the Oregon Consumer Privacy Act ("OCDPA"), including the right to access, correct, delete, and obtain a portable copy of your personal data, and the right to opt out of targeted advertising, the sale of personal data, and certain profiling. We do not sell personal data and do not engage in targeted advertising. To exercise OCDPA rights, contact us at privacy@arkathos.com; we will respond within 45 days, with one extension of up to 45 additional days where reasonably necessary, consistent with the OCDPA.

8.8 Colorado Residents (CPA)

If you are a Colorado resident, you have rights under the Colorado Privacy Act ("CPA"), including the right to access, correct, delete, and obtain a portable copy of your personal data, and the right to opt out of targeted advertising, the sale of personal data, and certain profiling. We do not sell personal data and do not engage in targeted advertising. To exercise CPA rights, contact us at privacy@arkathos.com; we will respond within 45 days, with one extension of up to 45 additional days where reasonably necessary, consistent with the CPA.

8.9 Utah Residents (UCPA)

If you are a Utah resident, you have rights under the Utah Consumer Privacy Act ("UCPA"), including the right to access, delete, and obtain a portable copy of your personal data, and the right to opt out of targeted advertising and the sale of personal data. We do not sell personal data and do not engage in targeted advertising. To exercise UCPA rights, contact us at privacy@arkathos.com; we will respond within 45 days, with one extension of up to 45 additional days where reasonably necessary, consistent with the UCPA.

8.10 Montana Residents (MTCDPA)

If you are a Montana resident, you have rights under the Montana Consumer Data Privacy Act ("MTCDPA"), including the right to access, correct, delete, and obtain a portable copy of your personal data, and the right to opt out of targeted advertising, the sale of personal data, and certain profiling. We do not sell personal data and do not engage in targeted advertising. To exercise MTCDPA rights, contact us at privacy@arkathos.com; we will respond within 45 days, with one extension of up to 45 additional days where reasonably necessary, consistent with the MTCDPA.

9. Do Not Sell My Personal Information

TheApexFrameworkLLC does not sell, rent, or trade your personal information to third parties for monetary or other valuable consideration. The data shared with our service providers (listed in Section 5.1) is shared solely to operate and improve Arkathos, not for those providers' independent use.

10. Children's Privacy

Arkathos is a business management platform designed for use by adults. We do not knowingly allow children under 13 (or 16 in certain jurisdictions) to create accounts or use the Service directly, and we do not knowingly collect personal information directly from children as users of the Service.

Childcare, daycare, and education customers. Some businesses that use Arkathos — such as childcare centers, daycares, and tutoring services — keep records about the minors in their care. Where such a business enters children's records into the Service, Arkathos acts solely as a service provider (processor) handling that information on the business's behalf and under its instructions. The business is the controller of those records and is solely responsible for providing required notices to, and obtaining any required consent from, the children's parents or legal guardians, including under the Children's Online Privacy Protection Act (COPPA) and applicable state childcare, education, and privacy laws. For these records we provide additional safeguards, including encryption under a dedicated key that is separate from the keys protecting other personal information and that fails closed (if that key is unavailable the record is rejected rather than stored unprotected, see Section 6), role-based per-employee access controls, access logging, and consent tracking. Children's records are not sent to any third-party AI provider. We do not use children's records to train AI models, to generate cross-customer analytics, or for any purpose other than providing the Service to the business that entered them. Children's records are never included in any de-identified or aggregated platform dataset — including the vendor/supplier directory, creator suggestions, or AI-improvement corpus described in Section 4.1 — and are never shared with any other customer or third party.

If you believe a child has provided personal information to us directly (as opposed to a business customer entering records about a child in its care), please contact us at privacy@arkathos.com and we will promptly delete it.

11. Mobile Application Data Practices

The Arkathos mobile applications (iOS and Android) provide authenticated access to your Arkathos account. The mobile applications do not perform on-device fingerprinting, do not call platform fingerprinting APIs for the purpose of uniquely identifying a device, and do not transmit derived device-identification signals from the application process. Device fingerprinting (canvas, WebGL, font, and browser-derived signals described in Section 2.2) is performed only during web-based signup, account activation, and payment flows accessed through the in-app browser surface (SFSafariViewController on iOS, Chrome Custom Tabs on Android). Subscription purchases and billing actions are handled through the same web flow; the mobile applications display billing status as read-only. The mobile applications retain your workspace session token in application storage on the device so you remain signed in between launches (see Section 6). Where you sign in to a business's client portal as a portal visitor, the portal session token is retained in browser local storage on the web and is held only in memory, for the duration of the app session, in the native applications.

Trusted-device recognition. To recognize trusted devices and help secure your account, the mobile applications compute, on-device, a hashed device identifier (derived from device and application characteristics) and transmit ONLY that hash to Arkathos's own systems when you sign in and during your session, so the device appears in your account's authorized-devices list and sign-ins from unrecognized devices can be detected. This is separate from, and does not change, the web-flow device fingerprinting described in Section 2.2 (which remains web-only): the recognition hash is used for account security, is not a fraud-grade fingerprint, is never shared with third parties, and no underlying device signals leave the device. This disclosure supersedes the statement above that the mobile applications do not transmit derived device-identification signals — to the extent of this trusted-device-recognition purpose only.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Effective Date" above. For significant changes, we will provide additional notice via email. Your continued use of Arkathos after changes become effective constitutes acceptance of the revised policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

TheApexFrameworkLLC

• Email: privacy@arkathos.com
• Address: 971 US Highway 202N, Suite N, Branchburg, NJ 08876, United States
• State of Incorporation: New Jersey

For data access or deletion requests, please email us with the subject line "Data Rights Request" and include your account email address. We will verify your identity before processing any request.