Privacy Policy

The data controller for your personal data is Arcvee, based in Buenos Aires, Argentina.

Contact: [email protected]

Arcvee collects categories of data that may qualify as sensitive under applicable legislation:

• Health data and medical records
• Menstrual cycle data
• Personal diary entries
• Financial information
• Nutrition and fitness data

This data is collected and processed solely with your explicit consent, given at the time of registration, and exclusively for the purpose of providing you the service (organizing your personal information).

Under Argentina's Law 25,326 (Art. 7) and the European GDPR (Art. 9), processing sensitive data requires explicit consent. By creating your account and accepting these terms, you grant that consent.

You can delete this data at any time from the application or by requesting the deletion of your account.

• Service delivery: process, organize, and display your content
• AI processing: analyze and categorize your content using artificial intelligence
• Personalization: adapt the experience based on your preferences
• Analytics: improve the product through aggregated usage analysis (with your consent)
• Security: prevent fraud and unauthorized use
• Communication: send you relevant information about the service

Your content is processed by third-party artificial intelligence services to understand and organize it. This is Arcvee's core functionality.

Arcvee does not sell your personal data to third parties. We never have and never will.

Messages sent through WhatsApp pass through Meta's infrastructure before reaching Arcvee. We recommend reviewing Meta/WhatsApp's privacy policy.

Arcvee stores the content of received messages to provide you the service. Message metadata (phone number, timestamp) is used to identify your account and process your request.

We implement technical and organizational security measures to protect your data:

• Passwords encrypted with bcrypt (never stored in plain text)
• Authentication via JWT tokens in secure cookies (HttpOnly, Secure, SameSite=Strict)
• HTTP security headers (HSTS, XSS protection, framing prevention)
• Request rate limiting to prevent abuse
• Files stored on AWS S3 with temporary access URLs (presigned URLs)
• Encryption in transit (TLS/HTTPS)

No system is 100% secure. While we do our best, we cannot guarantee absolute security.

Your data is retained as long as your account is active.

When you request account deletion, a 30-day grace period begins. After that period, all your data is permanently and irreversibly deleted, including:

• Database records
• Files stored on S3 (photos, audio, documents)
• Cached data and processing queues

You have the following rights over your personal data:

• Access: right to know what data we have about you
• Rectification: right to correct inaccurate data
• Erasure: right to request deletion of your account and data
• Portability: right to request a copy of your data in a readable format
• Objection: right to object to the processing of your data
• Withdrawal of consent: you can withdraw your consent at any time by deleting your account

To exercise these rights, contact us at [email protected].

Your data is processed by servers and service providers that may be located outside Argentina, including the United States (AWS, OpenAI, Google, PostHog).

These international transfers are made under your consent (given by accepting this policy) and in accordance with Art. 12 of Argentina's Law 25,326.

For European Union users, transfers are based on standard contractual clauses and each provider's data processing agreements.

Arcvee is not intended for minors under 16 years of age. We do not knowingly collect data from minors under that age.

If you believe a minor has provided data without parental consent, please contact us so we can delete it.

In the event of a security incident that may affect your personal data, we will notify you by email within 72 hours of becoming aware of the incident.

The notification will include the nature of the incident, the data affected, the measures taken, and recommendations to protect yourself.

We may update this policy periodically. We will notify you of material changes by email or through an in-app notice.

We recommend reviewing this policy periodically. The last update date is indicated at the beginning of the document.

For inquiries about this policy or to exercise your rights:

[email protected]

Regulatory authorities:

• Argentina: Agency for Access to Public Information (AAIP) — aaip.gob.ar
• Brazil: National Data Protection Authority (ANPD) — gov.br/anpd