Working draft, pending review by licensed counsel before launch. Confirm the sub-processor list matches production and finalize the legal-bases, rights, and international-transfer sections. Bracketed items are placeholders.
Privacy Policy
This policy explains what we collect, why, and your choices.
1. Information we collect
- Account data: name, email, password (hashed), and profile details you provide.
- Payment data: processed by Stripe. We receive confirmation and limited details (e.g., last4, status); we do not store full card numbers.
- Learning data: your progress, quiz and exam responses and scores, roleplay and mock-interview transcripts and scores, and the coaching profile we build to personalize your coach (weak spots, goals, style).
- Content you submit: messages to the AI coach, practice answers, and interview responses.
- Usage & device data: pages viewed, actions, approximate location, browser/device info, and similar analytics.
- Communications: emails you send us and support requests.
2. How we use it
To provide and personalize the service (including tailoring your AI coach), process payments, issue and verify credentials, send transactional emails (verification, receipts, important notices), provide support, secure the platform, comply with law, and improve our product.
3. AI processing
When you use the AI coach, roleplay, or mock interview, your inputs are processed by our AI provider(s) to generate responses. We use Anthropic (Claude) for these features [and ElevenLabs for voice, if/when enabled]. These providers process the data to deliver the feature under their own terms; we do not use your private content to train public models.
4. Service providers (sub-processors)
We share data with vendors who help us run ArcSim, under contract and only as needed:
- Stripe — payments
- Supabase — database, authentication, storage
- Vercel — application hosting
- Anthropic — AI coach / roleplay / interview [ElevenLabs — voice, if enabled]
- Resend — transactional email
- PostHog — product analytics
[Confirm/adjust this list to match production.]
5. How we share information
We do not sell your personal information. We share it only with the providers above, if required by law or to protect rights and safety, or in connection with a business transfer (e.g., merger), with notice where required.
6. Cookies & analytics
We use cookies and similar technologies for authentication, preferences, and analytics (PostHog). Where required, we ask for consent and you can manage choices via the in-app banner/settings.
7. Data retention
We keep personal data for as long as your account is active and as needed to provide the service, then for any period required by law or for legitimate business purposes (e.g., records of credentials issued). You can request deletion (see below).
8. Your rights
Depending on where you live (e.g., GDPR/UK GDPR, CCPA/CPRA), you may have rights to access, correct, delete, port, or restrict processing of your data, and to opt out of certain processing. To exercise these, contact us at [privacy@yourdomain.com]. We won't discriminate against you for exercising your rights.
9. Security
We use technical and organizational measures to protect your data, including row-level access controls and encryption in transit. No system is perfectly secure, but we work to safeguard your information and limit access to it.
10. Children
ArcSim is not directed to children under 18, and we do not knowingly collect their data. If you believe a minor has provided us data, contact us and we'll delete it.
11. International transfers
We and our providers may process data in countries other than yours. Where required, we use appropriate safeguards for these transfers. [Counsel to confirm mechanism, e.g., SCCs.]
12. Changes
We may update this policy; we'll post a new effective date and, for material changes, provide notice.
13. Contact
Privacy questions or requests: [privacy@yourdomain.com], [LEGAL ENTITY NAME], [ADDRESS].