Privacy Policy

1. What this policy covers

This policy explains how personal data is processed when you use ARCH-Insight, an IT landscape and enterprise architecture management service for organisations. It covers:

• the website at arch-insight.com/docs/welcome/ (product pages, documentation, legal pages);
• the web application at arch-insight.com (the hosted service, "the app");
• the native apps: iPhone and iPad and Mac (App Store), Android (Google Play), Windows (Microsoft Store) and the Linux packages. The Android, Windows and Linux apps open the same web application; the iPhone, iPad and Mac apps display it inside a native shell that adds the features described in section 11.

It is written to meet the information duties of Articles 13 and 14 of the General Data Protection Regulation (GDPR) and § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

2. Controller and contact

The controller responsible for the processing described here is the sole trader who operates ARCH-Insight:

For any question about data protection or to exercise your rights, write to the e-mail address above or use the contact form on our About page. We have not appointed a data protection officer, because none is required for our operation (Art. 37 GDPR, § 38 BDSG).

3. Content that organisations put into ARCH-Insight

ARCH-Insight is used by organisations (companies, public bodies, teams). Much of what is stored in a workspace is put there by an organisation and its members: fact sheets, applications, projects, documents, files, spreadsheets, tickets, chat messages, e-mail in the organisation's mailboxes, survey answers, HR and time records, monitoring data sent by the organisation's collector agents, and so on.

For that content the organisation is the controller and we process it on its behalf and on its instructions as a processor (Art. 28 GDPR). If you are a member of an organisation, a person in a document, a respondent to an organisation's survey or a customer writing to an organisation's help desk, please address questions about that content to the organisation; we will support it in answering them. The agreement on this processing is section 11 of our Terms of Service.

The rest of this policy describes the processing for which we are the controller: the website, your account, billing, advertising on the free plan, security and the operation of the service.

4. Visiting the website

Delivering the pages

When you open a page, your browser sends technical data: IP address, date and time, the address requested, the referring page, browser and operating system. Our traffic passes through Cloudflare (reverse proxy, content delivery and protection against attacks) and reaches our own servers, which are located in the European Union, through an entry server rented from Hetzner Online GmbH in Germany. This data is needed to deliver the pages and to keep the service secure. Server and proxy logs containing it are kept only as long as needed to detect and investigate attacks and faults and are then overwritten automatically. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a working, secure website.

Consent management (Cookiebot)

We use Cookiebot by Usercentrics A/S (Denmark) to ask for and record your consent. To show the banner, your browser loads Cookiebot's script from Usercentrics' servers. Cookiebot stores your choice in a cookie (CookieConsent) and processes your IP address in shortened form, the date of consent, the browser and the page. Legal basis: Art. 6(1)(c) GDPR together with Art. 7(1) GDPR (we must be able to demonstrate consent) and § 25(2) no. 2 TDDDG. You can change or withdraw your choice at any time with the Cookiebot settings shown on the page.

Statistics (Google Analytics 4)

With your consent to the "statistics" category we use Google Analytics 4 by Google Ireland Limited to understand how the website and the app are used. The Google tag is loaded only after you have given this consent; before that, and if you refuse, your browser makes no connection to Google Analytics. With consent, cookies (_ga, _ga_*) recognise your browser across visits, and Google receives the pages you view, the time, information about your browser and device and your IP address; according to Google, Analytics 4 uses the IP address only to derive an approximate location and does not store it. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. Google may process data in the USA (see section 15).

Fonts

The fonts used on the website are served from our own servers. Your browser makes no connection to Google Fonts or any other font provider.

Contact form and e-mail

If you use the contact form or write to us, we process your name, e-mail address, organisation (optional) and message to answer you. Form messages are not stored in a database; our own mail server forwards them to us by e-mail. Legal basis: Art. 6(1)(b) GDPR where your request concerns a contract or its preparation, otherwise Art. 6(1)(f) GDPR (answering enquiries). How long we keep enquiries is set out in section 16.

5. Your account and signing in

To use the app you need an account. We process your e-mail address, a password (stored only as a hash), your name and the profile details you choose to add (for example job title, department, phone number, profile picture), your organisation membership and role, and the time of registration and sign-in.

• Authentication runs on Supabase Auth (GoTrue), which we host ourselves; it is not Supabase's cloud service. It issues the session tokens your browser or app keeps (section 13).
• Two-factor authentication with an authenticator app (TOTP) is available; we store the shared secret needed to verify the codes.
• Sign-in with another provider: if you choose "Sign in with Apple", Google, Microsoft or GitHub, or your organisation's single sign-on (SAML), that provider confirms your identity and sends us your name, e-mail address and an identifier. The providers are independent controllers for their part; their own privacy policies apply. With Sign in with Apple you can choose to hide your e-mail address.
• Data we receive from others: if an administrator of your organisation invites you, creates an account for you on an address of the organisation's domain or adds an e-mail address to your profile, we receive your name and e-mail address from that administrator. If you buy in an app store, Apple or Google tell us the purchase and subscription status (section 8).
• Device recognition: the app keeps a random device identifier on your device and we record, per device, the browser or app, the IP address and the time of last use. We use this to show you the list of devices signed in to your account, to let a device you marked as trusted skip the second sign-in step for 30 days, and to warn you by e-mail about a sign-in from a new device.
• Bot protection: sign-up and sign-in forms may use Cloudflare Turnstile, which checks that a person, not a script, is using the form. Your browser sends Cloudflare technical data for this check.

Legal basis: Art. 6(1)(b) GDPR (providing the account under the Terms of Service); for device recognition, new-device warnings and bot protection, Art. 6(1)(f) GDPR (our legitimate interest in protecting accounts against misuse). You are not legally obliged to provide personal data. The data marked as required at sign-up is needed to conclude the contract and create an account; without it we cannot provide one. Everything else is optional.

6. Using the app

While you use the app we process what you enter and create, and the metadata needed to show it to the right people: who created or changed what and when, comments, notifications, read markers, and an audit trail of important actions in your organisation. For content entered on behalf of an organisation see section 3. For our own part (running the service, securing it, answering support requests) the legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR; our legitimate interest is a secure, working service.

Working hours and availability: members can log the hours they worked (date, times, number of hours, a description and, optionally, a task and other members who took part) and enter planned periods such as leave or appointments (dates and times, time zone, a status such as available, busy, away or on leave, an optional note, a repeat rule and other members the entry also applies to). These entries are visible to every member of the organisation. An entry that is in force changes the status shown next to the member's name, for example in the member list and the chat, and a planned working period can be set to be logged automatically as worked hours once it has ended. Members manage their own entries; administrators of the organisation can also manage other members' entries.

Some features involve other services:

• Search uses a search index (Elasticsearch) that we host ourselves.
• Video calls in the chat open a room on the public Jitsi Meet service (meet.jit.si, operated by 8x8, Inc., USA). Your display name is passed to the room; audio, video and your IP address are processed by 8x8 as an independent provider. Calls are only started when you choose to join one. If an administrator records a call, all participants are asked first and a banner is shown.
• Maps: an organisation's location can be shown on a Google Maps map (Google Ireland Limited). The map is loaded only when you click "Load map"; Google then receives your IP address and may store or read information on your device. If you use your current location to fill in an address, your browser asks for permission and the coordinates are sent to Google to look up the address. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG.
• Mailboxes: organisations can receive and send e-mail through addresses under arch-insight.com. These messages are handled by mail servers we operate ourselves.
• Public links and publishing: an organisation can share a document by link or publish files publicly. Anyone with the link can then see that content, until the organisation withdraws it.
• Integrations an organisation sets up (for example Slack or Microsoft Teams webhooks, or a ticketing system) send the data the organisation has configured to those services, on the organisation's instruction.

7. AI features

The app offers AI-assisted functions: the in-app assistant (the chat bubble), drafting fact sheets from uploaded documents, drafting e-mails, invoices, diagrams and presentations, analysing monitoring logs, summarising project boards and tasks and drafting tasks, suggesting survey questions, and recommendations and stakeholder reports on the IT landscape. When you use one of them, the text needed for the task is sent to a language model: for example your question, the relevant fact sheets, or up to 16,000 characters of text extracted from an uploaded file.

• Free plan: the requests go to a language model we host ourselves. No data leaves our infrastructure for this.
• Paid plans: for the AI features of paid plans we use OpenAI (OpenAI Ireland Ltd., Ireland, and OpenAI, L.L.C., USA) as our processor. Under OpenAI's terms for its API, data sent through the API is not used to train its models; OpenAI may keep it for up to 30 days to detect misuse and then deletes it.

AI results can be wrong. They are suggestions for people to check; ARCH-Insight does not take decisions about you on the basis of them (see section 19). Legal basis: Art. 6(1)(b) GDPR, and for content of an organisation, the organisation's instructions (section 3).

8. Plans, payments and in-app purchases

Organisations with up to five members can use ARCH-Insight free of charge. Paid plans are billed per seat. Depending on where you buy, payment is handled by:

• Stripe (Stripe Payments Europe, Ltd., Ireland) on the website and in the web app. We send Stripe the organisation's identifier, the administrator's e-mail address, the number of seats and the language; Stripe collects payment details, billing address and, where given, the VAT number. We never see full card numbers. Stripe processes data as our processor and, for its own legal obligations (for example fraud prevention and anti-money-laundering checks), as an independent controller.
• Apple (App Store in-app purchase) in the iPhone, iPad and Mac apps, and Google (Google Play Billing) in the Android app. Apple and Google are independent controllers for the purchase and the payment. We receive the transaction and subscription status from them (App Store Server API and App Store Server Notifications; Google Play Developer API and real-time notifications) and link it to your organisation to unlock the seats you bought.

We keep the subscription status, number of seats, plan history and invoices. Legal basis: Art. 6(1)(b) GDPR; retention of accounting records, Art. 6(1)(c) GDPR with § 147 of the German Fiscal Code (AO) and § 257 of the German Commercial Code (HGB).

9. E-mails and notifications

• Service e-mails (confirmation of your address, password reset, invitations, security warnings, notifications you have switched on) are sent from our own mail server. Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for security warnings (our legitimate interest in protecting your account). You can switch notification e-mails off in the settings.
• Browser push notifications: if you allow notifications, your browser gives us a subscription address at its push service (for example Google for Chrome, Mozilla for Firefox, Apple for Safari) and we store it with your browser type. The content of each notification is end-to-end encrypted, so the push service cannot read it. You can revoke the permission in your browser at any time; subscriptions the push service reports as expired are deleted. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG.
• Notifications in the iPhone, iPad and Mac apps: after you sign in, the app sends the device token it receives from the Apple Push Notification service to our servers, where we store it with your account, the platform and the time of last use. We use it to send the notifications you have switched on; they are only displayed if you allowed notifications when the app asked. Title and text of each notification are delivered to your device through Apple's push service. The token is deleted when you sign out or delete your account, and you can switch notifications off at any time in your device settings. Legal basis: Art. 6(1)(b) GDPR and § 25(2) no. 2 TDDDG.
• SMS: if you enter a mobile number and switch on SMS notifications, we send a verification code to that number and then the notifications you chose. SMS are sent through our processor Twilio (Twilio Ireland Limited, Ireland), which receives the phone number and the text. Legal basis: Art. 6(1)(b) GDPR.

10. Advertising on the free plan

The free plan is financed by advertising. Advertising is shown only to members of organisations on the free plan, on every platform; paid plans show no advertising. Advertising is only shown after the consent required for it has been given.

Web app: Adsterra

For organisations on the free plan, and only if you have consented to the "marketing" category in Cookiebot, the web app (in a browser and in the Android app) loads an advertising script from the Adsterra network (profitableratecpmnetwork.com). The network receives your IP address, browser information and the page, and may set cookies or similar identifiers to select and count advertisements. If you withdraw consent, the script is removed. It is not loaded in the iPhone, iPad or Mac app. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG.

Mobile apps: Google AdMob

For members of organisations on the free plan, the iPhone and iPad app shows a banner and the Android app can show a full-screen advertisement when it opens. Both use Google AdMob (Google Ireland Limited) and Google's User Messaging Platform, which asks for your consent in the EEA, the United Kingdom and Switzerland before any advertisement is requested. On iPhone and iPad, Apple's "App Tracking Transparency" prompt then asks whether Google may use the advertising identifier (IDFA); on Android, Google uses the advertising ID (AAID). AdMob processes the advertising identifier, IP address (and from it an approximate location), device and app information and interactions with advertisements. Google is an independent controller for this processing. If you refuse, you may still see non-personalised advertising, served without the identifier. You can change your choice at any time with "Ad privacy choices" in the app, reset or delete the advertising ID in your device settings, and on iPhone and iPad refuse tracking under Settings → Privacy & Security → Tracking. The Mac app shows no advertising. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG.

11. The native apps

• Face ID, Touch ID and device passcode (iPhone, iPad, Mac): if you use the app lock, the app asks the operating system to confirm that you are the device owner. The check happens entirely on your device; the app only learns whether it succeeded. Your biometric data never reaches the app or us.
• Sign in with Apple and in-app purchases are handled by Apple, the Google sign-in on Android by Google (sections 5 and 8).
• Crash reports: if you have agreed on your device to share analytics with app developers, Apple or Google provide us with crash reports that do not identify you directly.
• The Android, Windows and Linux apps use your installed browser engine (Chrome on Android) to display the web application; the storage described in section 13 then lives in that browser.

Legal basis: Art. 6(1)(b) GDPR; for the device checks, § 25(2) no. 2 TDDDG.

12. Security, error reports and operation

• Hosting: the app, its database (PostgreSQL), file storage, search index, authentication, error tracking and mail run on servers we operate ourselves, all located in the European Union. The public entry server and the mail server are rented from Hetzner Online GmbH, Germany.
• Backups: the databases are backed up continuously and every night to encrypted storage at Cloudflare R2 (Cloudflare, Inc.). Backups are kept for 30 days.
• Error reports: when the app fails in your browser, an error report (error message, the page, browser details and your IP address) is sent to an error tracking service (GlitchTip) that we run ourselves.
• Tracing: the server records how requests are handled (timing, which internal and external calls were made) to find faults and measure reliability. These records are kept in our own database and deleted with the monitoring data (section 16).

Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a secure, reliable service. We protect data with encrypted connections (TLS), access controls and separation of organisations (Art. 32 GDPR).

13. Cookies and storage on your device

Storing information on your device, or reading it, needs your consent unless it is strictly necessary for a service you asked for (§ 25 TDDDG). We use:

Strictly necessary (no consent needed)

• sb-…-auth-token (local storage, app): your sign-in session.
• arch-device-token (local storage, app): the device identifier from section 5.
• arch-insight-lang, arch:theme, homepage-lang, homepage-theme (local storage): the language and light or dark theme you chose.
• Other entries whose names begin with arch (for example arch:tab, arch_currency, archNativeUnlockArmed) in local and session storage, and primaryNavCollapsed, mfa_recommend_dismissed, passwordRecoverySession: the state of the screen you are working on, display settings you chose, notices you dismissed, the app lock of the native apps and a password reset in progress.
• The service worker cache (app): the app's own files and the images you have viewed, so that it loads quickly and works offline. It holds no answers from our servers' interfaces.
• CookieConsent (cookie): your Cookiebot choice, for up to 12 months.
• In the iPhone, iPad and Android apps, the consent status of Google's User Messaging Platform.

Only with your consent

• _ga, _ga_* (cookies, Google Analytics, "statistics"): up to 2 years. The Google tag itself is only loaded with this consent.
• Cookies and identifiers of the Adsterra network ("marketing", free plan, web app).
• The advertising identifier (IDFA on iPhone and iPad, AAID on Android) read by Google AdMob (section 10).
• Whatever Google Maps stores, once you click "Load map" (section 6).

You can withdraw consent at any time in the Cookiebot settings or, in the apps, with "Ad privacy choices" and in your device settings. Withdrawal does not affect processing carried out before it.

14. Who receives data

We do not sell personal data. Within our operation, only the controller has access. Data is received by:

Processors working on our instructions (Art. 28 GDPR)

We engage them as processors under agreements pursuant to Art. 28 GDPR where the provider's standard terms include one.

• Hetzner Online GmbH, Germany: entry server and mail server.
• Cloudflare, Inc., USA: reverse proxy, content delivery and protection against attacks, DNS, backup storage (R2), bot protection (Turnstile).
• Usercentrics A/S, Denmark: consent management (Cookiebot).
• Google Ireland Limited, Ireland: Google Analytics.
• OpenAI Ireland Ltd., Ireland / OpenAI, L.L.C., USA: AI features on paid plans.
• Stripe Payments Europe, Ltd., Ireland: payment processing on the web.
• Twilio Ireland Limited, Ireland: SMS (section 9).

Independent controllers

• Apple Inc. / Apple Distribution International Ltd.: App Store, in-app purchase, Sign in with Apple, push service, App Tracking Transparency.
• Google Ireland Limited / Google LLC: Google Play and Play Billing, Google sign-in, AdMob, Google Maps.
• Microsoft (Microsoft Store, sign-in with Microsoft) and GitHub, Inc. (sign-in with GitHub).
• Stripe, for its own legal obligations (section 8).
• The Adsterra advertising network (section 10).
• 8x8, Inc. (Jitsi Meet video calls).
• Your browser's push service (section 9).
• Services an organisation connects itself (section 6).

We also disclose data to authorities where we are legally obliged to (Art. 6(1)(c) GDPR).

15. Transfers outside the EU and EEA

Our own servers are in the European Union. Some of the recipients above are based in the USA or process data there: Cloudflare, Google, OpenAI, Stripe, Twilio, Apple, Microsoft, GitHub, 8x8 and the push services. The European Commission has decided that the USA ensures an adequate level of protection for companies certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Where a recipient is not certified, the transfer is based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards from us. For the Adsterra network, we cannot rule out that data is processed outside the EEA without such safeguards; that is why it is only loaded with your consent, which also covers this transfer (Art. 49(1)(a) GDPR).

16. How long we keep data

• Account data: for as long as your account exists; after you delete it, see section 17.
• Organisation content, including its audit trail: for as long as the organisation uses ARCH-Insight or until it deletes the content; the organisation decides (section 3).
• Data from discontinued features: the HR assessment, the HR timeline (posts, likes and the weekly HR summary post) and company events were removed from ARCH-Insight on 19 October 2026. No such data has been collected since then, and no AI assessments are produced. Records created before that date are kept unchanged but are no longer shown, changed or otherwise used in the app; they remain part of the organisation's content (section 3) until we delete them.
• Devices you signed in from: until you remove them from your account, at the latest when your account is deleted.
• Push subscriptions and device tokens: until you revoke the permission or sign out, the push service reports them as expired, or your account is deleted.
• Your notifications: until you delete them or your account is deleted.
• Logs of e-mails and SMS sent through the app (recipient, time): 30 days.
• Monitoring data (alerts, checks, log lines, traces): 3 days by default; an organisation can set up to 30 days for alerts and checks, 90 days for logs and traces and 365 days for metrics. Hourly summaries of service levels are kept for 35 days.
• Error reports and server logs: only as long as needed to find and fix the fault or investigate an attack.
• Backups: 30 days. Data you or an organisation deleted remains in the backups until they expire.
• Invitation codes: expire after the period the organisation chose (24 hours, 7 days, 30 days or never) or when revoked.
• Invoices and accounting vouchers: 8 years; books and annual accounts: 10 years; business letters: 6 years (§ 147 AO, § 257 HGB).
• Enquiries and support requests: for as long as needed to deal with them, and after that only where commercial or tax law requires.
• Your Cookiebot choice: 12 months; analytics cookies: up to 2 years.

Where the law requires us to keep data, we restrict its processing to that purpose.

17. Deleting your account

You can delete your account yourself, in the app and on the web: Account → Danger Zone → Delete Account Permanent (arch-insight.com/#/account). Step-by-step instructions are on our Support page. You can also ask us by e-mail.

• Your account is deactivated immediately, you are signed out on every device and push notifications to your devices stop.
• After 30 days your personal data is erased: your name, e-mail addresses, phone number (including a verified number), address, profile text and every profile picture you uploaded are removed; the records of the devices you signed in from, your push subscriptions and device tokens, your notifications and the log of SMS sent to you are deleted; your name is removed from help-desk and chat messages you sent; and your sign-in account, including its two-factor settings, is deleted.
• What stays: content you created in an organisation's workspace (for example documents, fact sheets, tickets, chat messages, HR and time records, e-mail in its mailboxes) belongs to that organisation, which is its controller (section 3); it is then shown without your name. The organisation's audit trail keeps its entries about your actions with the name and e-mail address recorded at the time, so that the organisation can trace changes; to have them removed, contact the organisation. Accounting records are kept as described in section 16, and backups expire after 30 days.
• If you are the only administrator of an organisation, you first need to make another member an administrator, or contact us. To delete a whole organisation, write to us.

18. Your rights

You also have the right to:

• access your personal data (Art. 15 GDPR);
• have it rectified (Art. 16) or erased (Art. 17);
• have its processing restricted (Art. 18);
• receive it in a structured, commonly used, machine-readable format and have it transmitted to another controller (Art. 20);
• withdraw any consent at any time, with effect for the future (Art. 7(3));
• lodge a complaint with a supervisory authority (Art. 77). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. You can also contact the authority where you live or work.

To exercise a right, write to [email protected]. We may ask you to confirm your identity. For content that an organisation controls (section 3), we pass your request on to the organisation.

19. Automated decisions and profiling

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

ARCH-Insight has no function that scores, ranks or assesses members of an organisation. AI results (section 7) are suggestions for people to check. Advertising on the free plan may be personalised by Google if you consent (section 10).

20. Children

ARCH-Insight is a service for organisations and is not directed at children. It must not be used by anyone under 16, and we do not knowingly process data of children. If you believe a child has given us data, please contact us and we will delete it.

21. Changes to this policy

We update this policy when the service or the law changes. The current version is always available on this page, with its effective date at the top. If a change affects processing based on your consent, we will ask for consent again.