隐私政策
Effective Date: November 9, 2026
Introduction
Welcome to Arcyria (“Arcyria”, “we”, “us”, or “our”).
Arcyria operates the website https://arcyria.com and the hosted application at app.arcyria.com, a data operations platform for data connections, ELT pipelines, SQL transformations, run monitoring, analytics, billing and integrations, and the Arcyria Agent (together, the “Service”).
This Privacy Policy explains what information we collect when you use the Service, how we use it, who we share it with, and the choices you have. It describes our current practices. It is not a statement that Arcyria has been certified or independently found compliant with any particular law or standard.
By using the Service, you agree to the collection and use of information as described in this Privacy Policy and our Terms of Service.
Definitions
Personal Data – any information about an identifiable living individual, alone or combined with other information.
Customer Data – data that you or your organization submit to, store in, or move through the Service, such as connection and pipeline configurations, SQL models, rows read from your sources and delivered to your destinations, data previews and saved queries, run records and run artifacts, and Arcyria Agent conversations.
Usage Data – technical information collected automatically when you use the Service, such as IP address, browser and device type, pages and features used, performance measurements, errors, and timestamps.
Controller and Processor – a controller decides why and how Personal Data is processed; a processor processes it on the controller’s behalf. For Personal Data we collect directly from you, Arcyria is the controller. For Personal Data inside Customer Data, your organization is the controller and Arcyria is its processor.
Information We Collect
1. Account and profile information. When you sign up or sign in with an email link or password, or with Google or GitHub, we collect your email address and, where you or the sign-in provider supply them, your name and profile picture. We also keep your organization memberships and roles, invitations you send or receive, and your profile and notification preferences. When you contact us by email, we collect what you send.
2. Customer Data. When you configure connections and pipelines, the Service reads data from the sources you choose and delivers it to the destinations you choose. That data may include personal information about your own customers, users, or contacts. While a run is in progress, data is staged temporarily, and the working copy is cleared when the run ends. For production runs we also keep run-scoped files in private object storage, such as extracted and transformed data files, manifests and delivery evidence, so you can review runs. We also store run records, such as status, timing, row counts, checkpoints, and error messages, and any saved queries, datasets and previews you create. We process Customer Data only to provide the Service to you and on your instructions given through the Service.
3. Connection credentials. Credentials you provide for sources and destinations, such as passwords, tokens, API keys and client secrets, are encrypted before they are stored, are masked in the product, and are not returned to browsers or sent to AI models. For connectors that use an OAuth or token sign-in, we receive the access that you authorize.
4. Arcyria Agent conversations. When you use the Arcyria Agent, we process your messages and any attachments, the pipeline, run and schema context the agent reads, the read-only queries it runs, and the results. We store conversations, results and supporting evidence, any feedback you give on an answer, and audit events for tool calls, failures and approval decisions.
5. Billing information. Paid plans are purchased through a hosted checkout run by our payment provider, which collects your payment details and billing information. We do not store full payment card numbers. We keep your plan, subscription and billing status, invoice and payment records synced from the provider, and usage against your plan limits.
6. Usage Data and product analytics. We automatically collect Usage Data and operational logs to run, secure, troubleshoot and improve the Service. In the application we also use product analytics, which records page views, navigation and feature events, interaction diagnostics, web performance measurements, and errors, and may include session recordings and heatmaps. Session recordings mask inputs and text, and we scrub credential-shaped values from analytics and error data. Analytics events are associated with your user ID and organization.
7. Emails and notifications. We send account, security and invitation emails, billing and usage notices, and, depending on your preferences, pipeline status emails, weekly digests, and onboarding or product emails. We record your notification preferences.
8. Cookies and similar technologies. We use cookies and similar technologies to keep you signed in, remember your preferences, protect the Service, and understand how it is used. We do not use them for third-party advertising. See Cookies and Tracking Technologies below.
9. Information from third parties. If you sign in or connect a service through a third party, we receive the information you authorize that service to share with us.
We do not sell Personal Data. We do not knowingly collect sensitive personal data for our own purposes, and you should not send us data that requires protections we have not agreed to provide in writing.
How We Use Your Information
Providing the Service: creating and managing accounts and organizations, running the pipelines you configure, monitoring runs, and operating the Arcyria Agent.
Support and communications: responding to your requests, and sending account, invitation, billing, usage, security, and service notices.
Security and reliability: detecting, preventing and addressing technical issues, fraud, and misuse, including applying rate limits and monitoring errors and service health.
Improving the Service: understanding how features are used, fixing problems, and evaluating the Arcyria Agent. We do not use Customer Data to train our own AI models.
Billing: managing subscriptions, plan limits and usage, and keeping records of payments.
Optional emails: pipeline status emails, weekly digests, and onboarding or product updates, according to your notification preferences. You can opt out of optional emails at any time.
Legal and protection: complying with legal obligations, enforcing our agreements, and protecting the rights and safety of Arcyria, our customers and others.
With your consent: for any other purpose we describe when we ask for it.
How We Share Your Information
We do not sell or rent Personal Data. We share information only in the following ways:
Service providers: We use third parties to host and operate the Service and to support it. They may process Personal Data only to provide their services to us. Providers we currently use include:
Vercel – hosting of the website and the application interface.
Amazon Web Services – compute, queueing and logging for the API and for pipeline runs, in the Mumbai, India region.
Supabase – our database, authentication and real-time services, including sign-in and the emails it sends.
Tigris – private object storage for run artifacts.
OpenRouter and the model providers it routes to – to power the Arcyria Agent.
Dodo Payments – checkout, payment processing, subscriptions, receipts and invoices.
AutoSend – delivery of account, product and billing emails.
PostHog (United States) – product analytics, session recordings, heatmaps and error tracking.
Sentry – error and performance monitoring.
Better Stack – service monitoring and our public status page.
Google and GitHub – sign-in, only if you choose to use them.
This list may change as the Service develops. To ask about the current list, email support@arcyria.com.
Your organization: If you are a member of an organization, its owners and administrators can see your name, email address, role and activity in that organization, and Customer Data is visible to members according to their roles.
At your direction: When you connect a source or destination or direct us to deliver data somewhere, we share data with that system as you instruct. We are not responsible for what that system does with it.
Corporate transactions: If we are involved in a merger, acquisition, financing, reorganization or sale of assets, information may be transferred as part of it. We will give notice before Personal Data becomes subject to a different privacy policy.
Legal reasons: We may disclose information if required by law or a valid request from a public authority, and, where legally permitted, we will tell you.
Protecting rights and safety: We may disclose information where reasonably necessary to protect the rights, property or safety of Arcyria, our customers or others, including fraud and abuse prevention.
The Arcyria Agent and AI Providers
The Arcyria Agent sends your messages, the pipeline, run and schema context it reads, and query results to an AI model provider through a routing service. We do not send connection credentials to the model, and we turn off recording of prompts and results in our model telemetry. We do not use Customer Data to train our own AI models. How a model provider handles data is governed by that provider’s terms and our agreements with it, so please do not put data in Agent messages that you are not permitted to share with those providers.
Cookies and Tracking Technologies
Cookies are small files stored on your device. We also use similar technologies, such as local storage. We use them for:
Session and security: keeping you signed in through our authentication provider, and protecting your account from abuse.
Preferences: remembering settings such as theme and layout, and workspace state. We clear persisted workspace data from your browser when you sign out.
Analytics and errors: understanding how the application is used and finding errors, using our product analytics and error monitoring providers.
We do not use cookies for third-party advertising or to track you across other websites. The application also checks our public status page from your browser to show service status. You can set your browser to refuse cookies or to alert you when one is set, but parts of the Service, such as staying signed in, may then not work. Our service providers may set their own cookies as part of providing their services; we do not control them.
Data Security
We use technical and organizational measures to protect Personal Data. They include authentication, organization-level access controls and role checks on every request, database-level row security that keeps one organization’s data separate from another’s, rate limiting, encrypted traffic to our API, private object storage, and encryption of secret fields in connection configurations before they are stored. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, and we do not claim any security certification. You should also protect your own credentials and devices. If a breach of security affects your Personal Data, we will notify you and the appropriate authorities as required by law.
Data Retention
We keep Personal Data for as long as needed for the purposes in this policy, such as while you have an account and to provide the Service. We may also keep it to meet legal, tax or accounting obligations, resolve disputes, and enforce our agreements.
Customer Data stays in the Service until you or your organization delete it or ask us to. Run records and run artifacts are kept so you can review and investigate runs, and Arcyria Agent conversations are kept so you can return to them. The temporary working copy of data created during a run is cleared when the run ends. When your account ends or you ask us to delete data, we delete or de-identify it, unless we must keep it for legal reasons or for security and audit records. Copies in backups are removed when the backups are replaced; until then we protect them from further use. We do not currently publish fixed deletion timelines.
We keep Usage Data, analytics and operational logs for as long as needed for security, troubleshooting and analysis; some operational logs are kept only for a short period. Billing records are kept as needed for accounting and legal purposes.
Your Rights and Choices
Depending on where you live, you may have rights over your Personal Data. These can include the right to:
access the Personal Data we hold about you;
correct inaccurate or incomplete data;
delete your data, subject to legal exceptions;
restrict or object to certain processing;
receive your data in a portable format;
withdraw consent where we rely on it; and
lodge a complaint with your local data protection authority, where one exists.
Residents of the European Economic Area, the United Kingdom and California may have additional rights under local law. We do not sell Personal Data or share it for cross-context behavioral advertising, and we do not discriminate against anyone for exercising their rights.
You can update your profile and notification preferences in the application, and you can opt out of optional emails at any time. To make another request, email support@arcyria.com. We may need to verify your identity first. We will review your request and respond as required by applicable law. Some rights have exceptions, and we may not be able to act on a request where the law allows us to decline it.
If your Personal Data is inside your organization’s Customer Data, please contact your organization first, as it decides how that data is used. We will help it respond to your request where we can.
International Data Transfers
Arcyria operates the Service with providers whose infrastructure is in several countries. Our API and pipeline runs are hosted on AWS in the Mumbai, India region, and other providers, such as our hosting, database, storage, analytics and AI providers, process data in other places, including the United States. Your information may therefore be processed in countries other than your own. We do not currently promise that data stays in a particular country or region.
Where the law requires a safeguard for transferring Personal Data across borders, such as for data from the European Economic Area, the United Kingdom or Switzerland, we rely on the mechanism that applies, such as Standard Contractual Clauses. If you have questions about transfers, contact us at support@arcyria.com.
Links to Other Sites
Our Service may link to sites we do not operate, such as documentation, and the systems you connect. We have no control over and are not responsible for their content or privacy practices. When you leave our site, this policy no longer applies, and we recommend reading the privacy policy of every site you visit.
Children’s Privacy
Our Service is not intended for anyone under 18, and we do not knowingly collect Personal Data from anyone under 18. If you believe a child has given us Personal Data, contact us and we will take steps to delete it.
Changes to This Privacy Policy
We may update this policy from time to time. We will post the updated policy on this page and update the Effective Date. If a change is material, we will notify you by email or by a prominent notice in the Service before it takes effect. Continued use of the Service after a change takes effect means you accept it, to the extent the law allows.
Contact Us
If you have any questions about this Privacy Policy, or want to make a privacy request, email us at support@arcyria.com.