Privacy Policy

This Privacy Policy explains how arcodash ("arcodash", "we", "us"), a service operated by an individual sole proprietor based in Israel, handles information in connection with the arcodash platform. Please read it together with our Terms of Service.

1. Scope

This policy covers arcodash Cloud — the hosted service we operate — and describes what we collect, store, and process when you use it, along with any account or website interactions you have directly with us.

Unless stated otherwise, the sections below describe arcodash Cloud.

2. Information We Collect

Account information. When you register, we collect your name, email address, and authentication credentials (stored in hashed form), along with basic account and organization settings.

Customer business data. When you connect a data source and run a query, the query result rows returned by your query — your own business data — are stored in arcodash's hosted database (as JSON) to enable caching and to display your dashboards and monitors. This is not merely pass-through: the result data is persisted until it is overwritten or deleted as described in Section 6. This data may itself contain personal data belonging to your own users or contacts; that content is determined and controlled by you, not by arcodash.

Data source connection credentials. The credentials you provide to connect a data source (such as database passwords or API keys) are storedencrypted at rest using AES-256-GCM.

AI feature inputs. If you use the optional AI-assisted query feature, we process your database schema (table and column names only) and the natural-language question or SQL text you provide. See Section 4.

Technical and operational data. We process the minimal technical data needed to operate the service securely, such as authentication session data.

3. How We Use Information

We use the information above to:

• provide, operate, and maintain the dashboarding, visualization, and data-observability monitoring service;
• authenticate you and secure your account;
• run the queries and monitors you configure and cache their results for display;
• power the optional AI SQL-generation feature (Section 4); and
• communicate with you about the service and respond to your requests.

4. The AI-Assisted Query Feature

The AI feature is optional and administrator-configurable. When it is enabled and used, arcodash sends your database schema (table and column names only)and the question or SQL text you provide to a third-party large-language-model provider (currently Google's Gemini API) to generate SQL.

Your actual data rows and query results are never sent to the LLM provider — only schema metadata and your own question text. The provider processes this input under its own terms and privacy policy. If you do not wish to use this feature, it can be left disabled.

5. Legal Basis for Processing (GDPR)

For users in the EU, UK, and similar jurisdictions, we rely on the following legal bases:

• Performance of a contract — to provide the service you have signed up for, including storing account data, running queries, and caching results.
• Legitimate interests — to secure, maintain, and improve the service, prevent abuse, and communicate with you, where those interests are not overridden by your rights.
• Consent — where specifically requested, and which you may withdraw at any time.

With respect to the business data you push through connected data sources, arcodash acts as a data processor and you act as thedata controller; you are responsible for having a lawful basis to process that data and to make it available to arcodash.

6. Data Retention

We retain your account information for as long as your account remains open. We retain cached query result data and connection credentials for as long as your account and the relevant data source, dashboard, or query remain active.

There is currently no fixed, time-based automatic purge of cached query result data. Cached result data is overwritten when the corresponding query is re-run (by default when it is older than roughly 24 hours), and is deleted when you delete the corresponding data source, dashboard, query, or your account/organization. In other words, we retain your data for as long as your account and the relevant connection remain active, and delete it when you delete the corresponding resource or close your account.

On account closure, you have a reasonable grace period of approximately thirty (30) days to request an export of your data before it is deleted. After that period, data associated with your account is deleted.

7. Data Sharing and Subprocessors

We do not sell your personal data, and we share it only as needed to run the service:

• AI/LLM provider (Google Gemini API) — only if you use the AI feature, and only schema metadata and your question text, as described in Section 4.
• Email delivery — the service may send transactional email via an SMTP server configured by the operator; a specific named email subprocessor is not fixed at this time.

arcodash currently does not use third-party analytics, tracking, error-reporting, or advertising services. This subprocessor list is intentionally minimal and may be updated as the service evolves. Where required, we will make an updated list available on request at[email protected] or publish it, and will provide notice of material changes.

8. International Data Transfers

arcodash is operated from Israel and may store or process data in the United States, the European Union, Israel, or other countries where arcodash or its infrastructure providers operate. This means your data may be transferred to and processed in countries other than your own. Where such transfers involve personal data subject to GDPR, we rely on appropriate safeguards (such as adequacy decisions or standard contractual clauses) where required by law.

9. Security

We protect your data using technical and organizational measures, includingencryption at rest of connection credentials (AES-256-GCM), encrypted transport, hashed authentication credentials, and server-side access controls that enforce tenant isolation so that each account can access only its own data. No system is perfectly secure, and we cannot guarantee absolute security, but we work to protect your information using reasonable measures.

10. Your Rights

GDPR (EU/UK) rights. Subject to applicable law, you have the right to access your personal data, to rectify inaccurate data, to erase data, to receive your data in a portable format, to object to certain processing, and to restrict processing. You may exercise these rights by contacting[email protected]. You also have the right to lodge a complaint with your local data protection authority. For business data you process as a controller, requests from your own users should be directed to you, and we will assist you as your processor.

California (CCPA) rights. If you are a California resident, you have the right to know what personal information we collect and how we use it, to request deletion, to opt out of the sale of personal information, and to non-discrimination for exercising your rights. arcodash does not sell personal information.

11. Children's Privacy

arcodash is not directed to children and is not intended for anyone under the age of 16 (or under 18 where required by local law). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

12. Cookies

arcodash uses only essential cookies necessary for authentication and session management. We do not currently use analytics, advertising, or tracking cookies. Because we use only strictly necessary cookies, no separate cookie consent banner is presented; if this changes, we will update this policy and obtain consent where required.

13. Data Processing Addendum

If you require a Data Processing Addendum (DPA) under GDPR Article 28 for the business data you process through arcodash, one is available on request. Please contact[email protected].

14. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide reasonable advance notice by email or through an in-app or website notice. Your continued use of the service after the changes take effect constitutes acceptance of the updated policy.

15. Contact

For any privacy questions or to exercise your rights, contact us at[email protected].