Privacy Policy

ARCANIC TECHNOLOGIES., JSC ("Arcanic", "we", "us") provides AI solutions and related services to businesses and organizations.

This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit our website at arcanic.ai (the "Website"), communicate with us, or use our AI solutions and related services (the "Services"). It also explains your rights and how to exercise them.

Data we process on behalf of customers. When we build or operate a solution for a business customer, we often process personal data contained in that customer's documents, systems, and user conversations on the customer's behalf. In that case, the customer decides how the data is used, and our processing is governed by our agreement with that customer. If you are an end user of a solution that one of our customers has deployed, please contact that organization with privacy questions.

1. Personal data we collect

Data you provide to us

• Identity and contact data: your name, job title, organization, email address, and phone number when you fill in a contact form, request a demo or proposal, subscribe to updates, or create an account.
• Business communications: the content of emails, messages, meeting notes, and other communications you exchange with us, including requirements and documents you share during scoping and delivery.
• Account data: login credentials, user roles, and settings for Services that require an account.
• Inputs and Outputs: content you submit to our Services (such as prompts, questions, and uploaded files) and the responses the Services generate. If you include personal data in Inputs, we will process it and it may appear in Outputs.
• Feedback: ratings, comments, and suggestions about our Services. If you rate an Output, we may store the related conversation with your feedback.
• Billing data: billing contact details and invoicing information for business customers.

Data we collect automatically

• Device and connection data: IP address, browser type, operating system, device type, time zone, and approximate location derived from your IP address.
• Usage data: pages you visit, links you click, features you use, and the dates and times of access.
• Log and troubleshooting data: system logs, error reports, and performance data that help us keep the Services running.
• Cookies and similar technologies: we use cookies to operate the Website, remember your preferences, and understand how the Website is used. You can manage or disable cookies through your browser settings.

Data from other sources

We may receive business contact information from partners, event organizers, or publicly available professional sources, for example when you are introduced to us as a potential customer or partner.

2. How we use personal data

We use personal data to:

• Respond to your inquiries and prepare proposals, estimates, and demos;
• Provide, maintain, and support the Services, including creating and managing accounts;
• Communicate with you about projects, service updates, and administrative matters;
• Send newsletters and marketing communications where you have agreed to receive them;
• Invoice and collect payments;
• Monitor, secure, and debug the Website and Services, and prevent fraud, abuse, and misuse;
• Improve the Website and Services, including by analyzing aggregated usage;
• Comply with legal obligations and respond to lawful requests from authorities; and
• Establish, exercise, or defend legal claims.

AI model training. We do not use Inputs, Outputs, or other customer content to train or fine-tune AI models for other customers. We only train or fine-tune models on a customer's data for that customer's own solution, where our agreement with the customer provides for it.

3. Legal bases for processing

We process personal data in accordance with the data protection laws that apply to us and to you. These include Vietnam's Law on Personal Data Protection No. 91/2025/QH15 and, where applicable, the EU and UK General Data Protection Regulation (GDPR) and the data protection laws of other countries where our customers and users are located. Depending on the purpose, we rely on the following bases:

4. How we share personal data

We do not sell personal data. We share personal data only as follows:

• Service providers: companies that help us operate our business, such as cloud hosting, AI model providers, email, analytics, and accounting providers. They may process personal data only on our instructions and must protect it. A list of our key sub-processors is available on request at [email protected].
• Your organization: if you use the Services through your employer or another organization, that organization's administrators may access your account and content.
• Professional advisors: lawyers, auditors, and accountants under confidentiality obligations.
• Authorities: government authorities or law enforcement where required by law, or where disclosure is reasonably necessary to protect the rights, safety, or property of Arcanic, our customers, or others.
• Corporate transactions: a buyer or successor in a merger, acquisition, or sale of all or part of our business, subject to this Privacy Policy.
• With your consent: in any other case where you have agreed or instructed us to share data.

5. International data transfers

We and our service providers, such as cloud and AI model providers, may store or process data in countries other than the one where you are located. When we transfer personal data across borders, we do so in accordance with applicable law, including preparing and maintaining any required transfer impact assessments, and we put appropriate contractual and technical safeguards in place, such as standard contractual clauses where the EU or UK GDPR applies. Where a customer requires data to remain in a specific location, we agree this in the customer agreement.

6. Data retention

We keep personal data only as long as needed for the purposes described in this Privacy Policy, including to provide the Services, meet legal, tax, and accounting requirements, and resolve disputes. Customer content is retained, returned, or deleted as set out in the customer agreement. When data is no longer needed, we delete it or anonymize it.

7. Security

We use technical and organizational measures designed to protect personal data against loss, misuse, and unauthorized access, disclosure, alteration, or destruction. These include access controls, encryption in transit, logging, and confidentiality obligations for our staff. No system is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs, we will notify affected parties and authorities as required by law.

8. Your rights

Depending on the laws that apply to you, you may have the right to:

• Be informed about how your personal data is processed;
• Give or withdraw consent, without affecting processing that took place before withdrawal;
• Access your personal data and receive a copy;
• Correct inaccurate or incomplete personal data;
• Delete your personal data, subject to legal exceptions;
• Restrict or object to certain processing, including direct marketing;
• Data portability, where applicable; and
• Complain to the competent data protection authority.

To exercise your rights, email [email protected]. We may need to verify your identity before acting on your request. We will respond within the time required by applicable law. You can unsubscribe from marketing emails at any time using the link in each email.

We cannot always guarantee the accuracy of AI-generated Outputs. If an Output contains inaccurate personal data about you, you can ask us to correct it and we will make reasonable efforts to do so.

9. Children

Our Website and Services are intended for businesses and are not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at [email protected] and we will delete it where appropriate.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on the Website and change the effective date above. If changes are material, we will provide additional notice where appropriate.

11. Contact us

If you have questions, requests, or complaints about this Privacy Policy or our handling of personal data, please contact:

ARCANIC TECHNOLOGIES., JSC

• Registered address: No. 23, Lane 194, Doi Can Street, Ngoc Ha Ward, Hanoi, Vietnam
• D-U-N-S Number: 683832096
• Email: [email protected]
• Data Protection Officer: reachable at [email protected]

You may also have the right to lodge a complaint with the data protection authority where you live or work.