ARQIV PRIVACY POLICY

A. Account and Profile Information

• Identifiers and contact information (such as name, email address, phone number, and authentication credentials).
• Account type and role information (e.g., merchant, customer, admin).
• Organization and tenant information for business users (such as merchant name, location, and configuration settings).

B. Receipt and Transaction Information

The Services may process item-level receipt data and related transaction metadata, which can include:

• Purchase details (line items, item descriptions, quantities, prices, discounts, taxes, totals);
• Transaction and order identifiers;
• Date/time and store/location data; and
• Other metadata associated with the receipt or order.

C. Integration and Connected Account Information

If you connect a third-party service (such as Square, or Google if you connect your Gmail account), we may collect and process:

• OAuth tokens and integration identifiers;
• Transaction events or other data made available through the integration; and
• Integration configuration and status information.

D. Communications

• Information you provide when you contact us (support requests, emails, form submissions, and feedback).
• If enabled by a merchant, communications delivered through the Services (e.g., operational receipt delivery or offer-related messages).

E. Device, Usage, and Log Information

We collect information automatically when you access the Services, such as:

• Device and browser characteristics;
• IP address and general location derived from IP;
• Access timestamps and usage/activity data within the Services; and
• Security and audit logs (including login events and administrative actions).

F. Cookies and Similar Technologies

We may use cookies and similar technologies to operate our websites and Services, keep you signed in, and understand usage. Session tokens are stored in httpOnly cookies for security. We also use browser localStorage for client-side session management. You can control cookies through your browser settings; disabling cookies may affect functionality.

A. With Service Providers

We disclose information to vendors and service providers who help us operate the Services (such as hosting, monitoring, security, email/SMS delivery, and customer support). These providers are contractually required to protect information and use it only to provide services to Arqiv.

B. With Merchants and Business Customers

• Business-user information and activity may be visible to the merchant organization that administers the tenant.
• Where a customer experience is enabled, certain receipt and offer information may be presented to the customer and, within the merchant tenant, to authorized merchant users.

C. With Third-Party Integrations You Authorize

If you authorize a connection to a third-party service (such as Square), we may exchange data with that service as needed to provide the integration.

D. For Legal, Safety, and Security Reasons

We may disclose information if we believe disclosure is reasonably necessary to:

• Comply with law, regulation, legal process, or governmental request;
• Protect the rights, property, or safety of Arqiv, our users, or others;
• Detect, prevent, or address fraud, abuse, or security issues.

E. Corporate Transactions

We may disclose information in connection with an actual or contemplated merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of our business or assets.

A. What We Request

We request read-only access to your Gmail mailbox using the Google OAuth scope gmail.readonly. We never request or obtain the ability to send, modify, or delete your email, or to change your mailbox settings.

B. What We Access

• To find purchase receipts, we scan message metadata — headers such as sender, subject, and date — across your mailbox. Identifying which messages are receipts necessarily involves examining metadata of messages that turn out not to be receipts.
• We read the contents (body) of a message only after its metadata identifies it as a purchase receipt from a recognized merchant sender. We do not read the contents of any message that has not been identified as a receipt.

C. What We Store

• From identified receipt messages: parsed purchase details (merchant, line items, prices, discounts, taxes, totals, and — where present on the receipt — payment card brand and last four digits), the sending domain, and Gmail message identifiers.
• A temporary raw copy of an identified receipt message, held for up to 72 hours solely to support parsing and retries, and deleted automatically by infrastructure-enforced expiration.
• OAuth access and refresh tokens, encrypted at rest.
• We do not store the contents, subject lines, or sender addresses of non-receipt messages, and we do not create permanent copies of your mailbox.

D. Retention

Temporary raw copies of receipt messages expire within 72 hours. Parsed receipt data is retained while your Gmail connection or account remains active, or until you delete it. Tokens are deleted when you disconnect.

E. Disconnect and Deletion

You can disconnect your Gmail account at any time within the Services. Disconnecting revokes Arqiv's access with Google and stops all synchronization. You can also revoke Arqiv's access from your Google Account security settings (myaccount.google.com/permissions). You may delete all data derived from your Gmail connection; deletion covers stored receipt data, line items, temporary copies, and related telemetry.

F. Limits on Our Use of Google User Data

We do not:

• Sell Google user data;
• Transfer Google user data to third parties, or use it, for serving advertisements;
• Use Google user data to determine creditworthiness or for lending purposes;
• Use Google user data to train generalized artificial intelligence or machine learning models; or
• Permit humans to read Google user data, except with your explicit consent for specific messages, where necessary for security purposes (such as investigating abuse), where necessary to comply with applicable law, or where the data has been aggregated and anonymized for internal operations.

G. Limited Use Disclosure

Arqiv's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

A. Account Information

You may update certain account information through the Services or by contacting us.

B. Marketing Communications

Where applicable, you can opt out of marketing emails by using the unsubscribe link or contacting us. Operational and transactional communications may still be sent.

C. Data Rights (Access, Deletion, Portability)

Depending on your location and applicable law, you may have rights to request access to, correction of, deletion of, or portability of certain personal information. Currently, customers may request deletion of their account data, and both merchants and customers may export their order/receipt data in multiple formats (CSV, XLSX, JSON, PDF). We will respond to verified requests as required by law.