Arkup Privacy Policy

Account information

• name
• email address
• profile information
• organization or company name
• role or permissions within a workspace
• authentication information
• account preferences

Business and user content

Users may provide Arkup with business information including:

• documents, files and reports
• spreadsheets and notes
• company data and business records
• uploaded content and information entered into Arkup
• information generated while using Arkup

Connected services and integrations

When a user chooses to connect an external service, Arkup may access information that the user authorizes us to access. Depending on the integration and permissions granted, this may include information from services such as Google Workspace, Gmail, Google Drive, Google Calendar, Microsoft Outlook, Microsoft OneDrive, Microsoft 365, SharePoint, accounting platforms, CRM systems, cloud storage and other business applications. Arkup only requests permissions that are necessary to provide user-facing functionality.

Usage and technical information

• IP address, browser and device information
• application activity, feature usage and timestamps
• authentication and security events
• error logs and performance information

Payment information

If a user purchases a paid Arkup service, payment processing is handled by a third-party payment provider. Arkup does not store complete payment card numbers.

If a user connects a Google account, Arkup accesses Google user data only according to the permissions the user explicitly grants through Google OAuth. Arkup does not access Google user data without the user's authorization. The permissions currently requested are:

• Account identity — openid, userinfo.email and userinfo.profile to identify which Google account is connected.
• Google Drive — read-only access (drive.readonly) to automatically import your Drive files (PDFs, Docs, Sheets, Slides and Office files) into Arkup and keep them in sync. Arkup never edits, moves or deletes files in your Drive.
• Gmail — read-only access (gmail.readonly) to import messages so they can be searched, cited and summarized inside Arkup. Arkup never sends, deletes or labels email.
• Google Calendar — read-only access to your calendars and events (calendar.readonly) for answers and renewal/obligation context. Arkup never creates or edits events or calendars.
• Google BigQuery — read-only access (bigquery.readonly), requested only when you connect BigQuery, to discover projects, datasets, tables and schemas and to read data you authorize. Arkup never modifies tables, datasets, permissions or configuration.

Arkup uses this information to provide user-facing functionality such as:

• retrieving authorized business information
• searching connected information
• answering user questions and summarizing authorized content
• analyzing business information
• generating reports and insights
• connecting information across authorized sources

• provide the Arkup service and authenticate users
• maintain user accounts and workspaces
• process user requests and retrieve authorized information
• provide AI-assisted search and analysis
• generate reports, summaries, dashboards and insights
• synchronize authorized integrations
• maintain security and detect fraud or abuse
• troubleshoot technical issues and provide customer support
• improve reliability and product functionality
• administer subscriptions
• comply with legal obligations

Arkup uses artificial intelligence technologies to provide features such as search, analysis, summaries, question answering, report generation and business insights. When a user asks Arkup to analyze information, relevant authorized content may be processed by Arkup and authorized infrastructure or AI service providers solely as necessary to provide that functionality.

Arkup does not use Google Workspace user data to train or improve generalized artificial intelligence or machine learning models outside the user's requested and authorized Arkup functionality.

Arkup does not:

• sell Google user data
• use Google user data for advertising
• transfer Google user data to advertising platforms or data brokers
• use Google user data for determining creditworthiness
• use Google user data to train generalized AI or machine learning models
• allow human access to Google user data, except when necessary and permitted for support requested by the user, security, legal compliance, or other circumstances permitted by Google's policies

Google user data is used only to provide or improve user-facing Arkup functionality that the user has authorized.

Arkup uses trusted service providers to operate the platform, including providers for:

• hosting and cloud infrastructure
• database services
• authentication
• artificial intelligence processing
• email delivery
• monitoring and security
• payment processing
• analytics necessary to operate and improve the service

Service providers may only process information as necessary to provide their services to Arkup and are subject to appropriate contractual and security obligations. Arkup does not sell users' personal information or connected business data. Arkup may disclose information when required by law, legal process, security investigation, or to protect the rights and safety of Arkup, users, or others.

Arkup is designed for organizations. Information stored within an Arkup workspace may be accessible to other authorized members of that workspace according to their roles and permissions.

An organization's administrator may control:

• workspace membership
• user permissions
• connected data sources
• access to company information
• retention or removal of company content

Information uploaded to a company workspace may belong to or be controlled by that organization.

Arkup uses technical and organizational safeguards intended to protect information, including:

• encrypted network connections
• authentication controls
• role-based access controls
• workspace isolation
• database access policies
• secured credentials
• logging and monitoring
• encryption where appropriate
• restricted administrative access

No system can guarantee absolute security. More detail is available on our Security page.

OAuth access and refresh credentials used to connect third-party services are stored encrypted, are never exposed to other users, are never sent to the browser, and are never exposed to the AI model.

Users may disconnect connected accounts through Arkup. Disconnecting stops future synchronization. Previously imported data remains until the user or organization removes it, using the "remove imported data" control or account deletion.

Arkup retains information for as long as reasonably necessary to:

• provide the service
• maintain the user's account
• meet contractual obligations
• comply with legal requirements
• resolve disputes
• maintain security

Users and authorized administrators may request deletion, subject to legal, contractual or security retention requirements.

Users may delete their account from inside Arkup, and may remove imported integration data using the controls on the Integrations page. Account deletion runs after a 10-day grace period during which the request can be cancelled.

• choose which integrations to connect
• revoke OAuth permissions
• disconnect connected accounts
• request deletion
• manage workspace access where authorized
• update eligible account information

Users may also revoke Google account access through their Google Account security settings.

Arkup and its service providers may process information in the United States and other locations where infrastructure or service providers operate. Where required, Arkup will implement appropriate safeguards for international data transfers.

Arkup is intended for business and professional users and is not designed for children under the age required to independently consent to data processing in their jurisdiction.

Arkup may update this Privacy Policy as the product, legal requirements or data practices change. The updated policy will display a revised "Last Updated" date. Material changes may be communicated through the service where appropriate.

Questions about privacy or data practices may be sent to Arkup at moroni@arkup.ai, or via https://arkup.ai.