Privacy Policy

Last updated: August 12, 2026

This Privacy Policy explains how Arciom, Inc. ("Arciom," "we," "us," or "our") collects, uses, discloses, and protects information in connection with the Arciom platform, including its web application, browser extension, and desktop capture agent (collectively, the "Service").

Arciom is a business-to-business (B2B) platform used by advertising agencies and their client organizations. This Policy is written for individuals who use Arciom on behalf of an agency or client account (each, a "user," "you"). If you are an individual whose voice, screen activity, or likeness is captured by a user of the Service in a working session, see Section 8 ("If You Were Recorded By an Arciom User").

By using the Service, you agree to the collection and use of information as described in this Policy. If you do not agree, do not use the Service.

01Information We Collect

1.1 Account information

When you register, we collect your email address, display name, hashed password, and your agency/account membership and role. Registration is restricted to email domains that your agency administrator has authorized.

1.2 Connected Google account data

If you or your agency authorizes the Service to connect to a Google Ads, Google Analytics, and/or Google Tag Manager account, we access that data via Google OAuth, using only the following scopes: your Google account's email/profile identifiers, and read-only access to the connected advertising and analytics data itself. During the Beta Period the Service does not write to your Google Ads account. If write functionality is introduced, it will require separate, explicit enablement by the account owner and a corresponding update to this Policy. This connection is used solely to detect changes, retrieve performance data, and power the governance features of the Service. Google account credentials themselves are never seen or stored by Arciom — only the OAuth tokens Google issues, which you can revoke at any time in your Google Account settings.

1.3 Capture and digital twin data

If the capture feature is enabled for your account, the Service may record:

• Screen video and click-level screenshots;
• Audio narration you provide during a session;
• Window and application titles active during the session;
• Typed context notes you enter.

This raw session data is processed by AI systems to reconstruct decision points and build a persistent record of expertise (a "digital twin") associated with your account, as described in Section 3.

Capture only runs when you start it. Nothing is recorded before you begin a session or after you end one. The raw screen video and audio remain within Arciom's systems and are not handed to your employer; what your organization receives from a session is the reconstructed decisions and reasoning.

If you leave the organization that recorded you, you may obtain a copy of the judgment layer derived from your sessions — the reasoning patterns, without anything specific to that organization's business. Their digital twin ceases to incorporate your subsequent development, and they have no visibility of what you do with your copy.

1.4 Voice debrief data

If the voice debrief feature is enabled, we record and transcribe conversational debrief sessions (audio and derived transcript). Voice debrief recordings and transcripts are retained for 90 days by default, after which they are automatically marked for deletion. Sessions are capped in length and size (approximately 30 minutes / 200 conversational turns / 200MB per session).

1.5 Usage and session data

We use functional cookies to operate the Service, including a session cookie (arciom-session) that keeps you logged in, and a short-lived cookie used to protect the Google OAuth connection flow from cross-site request forgery. We also log session metadata such as IP address (stored in hashed form) and browser/user-agent string, for security and fraud-prevention purposes. Within the Service itself we do not use advertising, marketing, or third-party tracking cookies.

1.5.1 Our public website

Separately from the Service, our public marketing website at arciom.com uses Google Analytics to understand how visitors find and move through the site. This sets cookies from Google and collects standard analytics data including pages viewed, referring source, approximate location derived from IP address, and device and browser type. We use it to measure which pages and channels bring us enquiries.

We do not use it to build advertising audiences, and we do not combine website analytics data with anything inside the Service. You can opt out using Google's browser add-on at tools.google.com/dlpage/gaoptout, or through your browser's cookie settings, without any loss of functionality.

1.6 Communications

If you contact support, submit a bug report, or otherwise communicate with us, we retain the content of that communication and any diagnostic information you provide.

02How We Use Information

We use the information described above to:

• Provide, operate, and maintain the Service, including authentication and role-based access control;
• Generate AI-assisted governance summaries, decision reconstructions, and digital twin content;
• Detect and alert on changes to connected Google Ads/Analytics/Tag Manager accounts;
• Maintain security, detect and prevent fraud or abuse, and enforce our Terms of Service;
• Respond to support requests and communicate with you about the Service;
• Monitor and improve the reliability and performance of the Service, using aggregated, de-identified operational metrics that cannot reasonably be associated with you or your organization.

We do not use your recordings, captured decisions, or digital twin content to form or improve any other customer's digital twin, and we do not sell any model trained on your data. We do use de-identified data from across customers for a defined set of purposes: keeping the AI benchmark accurate, understanding how advertising platforms themselves behave, improving how well the product captures decisions, detecting faults across the Service, producing aggregate statistics, evaluating which AI models perform best, and telling an individual how their own decisions are performing. That data contains no reasoning or strategy attributable to you or to any individual. Where we report to someone how they are performing relative to others, we describe their performance; we do not pass on the specific approaches or tactics of anyone else. We do not sell your personal information, and we do not use your data to serve third-party advertising.

03How We Share Information — AI Processing and Sub-processors

To provide the Service, we share information with the following categories of third-party service providers ("sub-processors"), each acting under its own terms of service. Providers marked (planned) are not yet in use and will not receive data until they are:

AI processing disclosure. Because capture and voice debrief features send audio, screenshots, and text to third-party AI model and transcription providers for analysis, that content leaves Arciom's own infrastructure as part of normal operation of these features. We select vendors that publicly state they do not use API inputs to train their models by default, and we are working to formalize written data-processing and no-training agreements with each of these providers during the Beta Period. Until those agreements are fully executed, you should treat this as a known limitation of the beta service. If this is a concern for a particular session, do not enable capture or voice debrief for that session.

We may also disclose information: to comply with law, legal process, or governmental request; to protect the rights, property, or safety of Arciom, our users, or others; or in connection with a merger, acquisition, financing, or sale of assets (subject to this Policy continuing to apply to previously collected information).

04Data Retention

• Voice debrief recordings/transcripts: retained for 90 days by default, then automatically marked for deletion.
• Capture recordings and digital twin content: retained for as long as your account is active, unless you request earlier deletion under Section 6.
• Account information: retained for as long as your account is active, plus a reasonable period afterward for legal, security, and record-keeping purposes.
• Support communications: retained as long as reasonably necessary to resolve your request and for our records.

05Data Security

We use industry-standard safeguards, including: password hashing (passwords are never stored in plaintext), hashed session tokens, rate-limited login attempts, encryption at rest for stored capture media (server-side encryption on our object storage), and role-based access controls that limit which users can see which data. No system is completely secure, and we cannot guarantee absolute security of information transmitted to or stored by the Service.

06Your Choices and Rights

• Access/correction. You can review and update your account information within the Service, or by contacting us.
• Deletion or export requests. You may request deletion of your account and associated data, or an export of your data, by emailing Ryan@arciom.com. We will verify your request and fulfill it within 30 days, except where we are required or permitted to retain certain information (e.g., for legal, security, or dispute-resolution purposes).
• Capture opt-out. Capture and voice debrief are optional features. If you do not want a session recorded, do not enable these features for that session; if your agency has enabled them by default, contact your agency administrator or us to discuss opting out.
• Google account disconnection. You can revoke Arciom's access to your Google Ads/Analytics/Tag Manager account at any time via your Google Account security settings or within the Service.

07Children's Privacy

The Service is a business tool intended for use by adults acting on behalf of an organization. It is not directed at, and we do not knowingly collect information from, individuals under 18.

08If You Were Recorded by an Arciom User

If an Arciom user recorded a working session that included you (for example, a screen-share, meeting, or voice debrief you participated in), that recording was made by the Arciom user or their organization, who is responsible for obtaining any consent required by law before recording you. Arciom processes that content on their behalf as described in this Policy. To request access to, or deletion of, a recording that includes you, please contact the Arciom user or organization that made the recording directly; you may also contact us at Ryan@arciom.com and we will direct your request to the responsible organization.

09International Data Transfers

Arciom and its sub-processors host and process data primarily in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those of your jurisdiction.

10Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice (such as by email or an in-product notice) before the changes take effect. The "Last Updated" date at the top of this Policy indicates when it was last revised.

11Contact Us

Questions or requests regarding this Privacy Policy can be directed to:

Ryan@arciom.com

Arciom, Inc. 2810 N Church St, PMB 740352, Wilmington, Delaware 19802-4447, US