Privacy Policy

Effective date: [EFFECTIVE DATE] · Controller: [LEGAL ENTITY NAME], Ohio, USA ("ArchTruth", "we", "us") · Contact: mike@mikereams.com

This policy explains what personal data we collect when you use archtruth.app, its APIs and MCP server (the "Service"), why, who we share it with, and the choices you have. For data inside your workspace (diagrams, documents, ServiceNow records) your organisation decides why it is processed; we process it on their instructions as described in the Terms of Service.

1. What we collect

Account data. Your email address and sign-in events (magic links or password), the workspaces you belong to and your role in each.

Workspace content. Diagrams, design documents, decision records, layers, versions, comments in change-set exports, share links you create, and API keys (stored as hashes; the key itself is shown once and never stored).

ServiceNow data. When a workspace owner connects a ServiceNow instance, we store an OAuth token set in an encrypted vault and read configuration items, relationships and related fields through the scopes granted. We keep a copy of the records needed to render and refresh diagrams; these may include names, owners and contact fields that your organisation stores against configuration items.

Usage and audit data. An append-only audit log of writes in each workspace (who, what, when, including API-key attribution), API request counts per key for rate limiting, AI usage counts, and server logs with IP address, user agent and request path, retained for operations and security.

Billing data. Plan, seat count and subscription status. Payment details are collected and held by Stripe, our merchant of record; we receive only a customer and subscription identifier and the billing status.

We do not use tracking cookies or third-party advertising. The only cookies are the ones needed to keep you signed in.

2. Why we use it (legal bases)

To provide and secure the Service and your workspace (performance of a contract); to bill paid plans (contract); to keep audit trails, rate limits and logs (legitimate interest in security and integrity, and legal obligation where applicable); to send service emails such as sign-in links, billing notices and material changes (contract and legitimate interest); and to answer support requests (legitimate interest). We do not sell personal data and we do not use your content to train AI models.

3. AI features

When you use AI generation, editing or drafting, the relevant content and prompt are sent to our model provider, Anthropic, PBC, to produce a response. Anthropic processes that data under a data-processing agreement, does not train on it, and retains it only as needed to provide the response and for abuse monitoring under its published retention periods.

4. Who we share data with (sub-processors)

• Supabase (database, authentication, encrypted secret vault) — United States.
• Vercel (hosting, serverless functions, logs) — United States.
• Stripe (payments, tax, invoicing; merchant of record) — United States.
• Anthropic (AI model provider, only for AI features) — United States.
• Supabase and Microsoft 365 (sign-in and service email delivery) — United States.

We share data with these providers only to operate the Service, under contracts that restrict their use of it. We may also disclose data when required by law, to protect the Service or its users, or in connection with a merger or acquisition (with notice).

5. Share links

A share link shows a rendered diagram to anyone holding the link, without sign-in, until it expires or is revoked. It never exposes the diagram's source text, versions, or linked ServiceNow records. Treat share links as you would any link to a document.

6. Retention

Account data: while your account exists and for 30 days after deletion. Workspace content: while the workspace exists and for 30 days after deletion, plus standard backup cycles. ServiceNow record copies: until the source is disconnected or the workspace is deleted, then purged. Audit logs: for the life of the workspace (they are part of the product) and 30 days after. Server logs: up to 30 days. Rate-limit counters: 24 hours. Billing records: as long as tax and accounting law requires.

7. Security

Data is encrypted in transit (TLS) and at rest. Database access is governed by row-level security so members only reach their own workspaces; OAuth tokens and client secrets live in an encrypted vault; API keys are hashed; the audit log is append-only; the web application enforces a strict Content Security Policy. No system is perfectly secure; if we learn of a breach affecting your data we will notify affected workspace owners without undue delay.

8. International transfers

We are based in the United States and our sub-processors operate there. If you use the Service from outside the US, your data is transferred to and processed in the US. Where required, we rely on standard contractual clauses or the sub-processor's equivalent safeguards.

9. Your rights

Depending on where you live you may have the right to access, correct, export, restrict or delete your personal data, to object to certain processing, and to complain to a supervisory authority. You can export your content from the Service at any time and delete your workspace yourself. For anything else, email mike@mikereams.com; we respond within 30 days. If you are a member of a workspace operated by another organisation, we may refer your request to that organisation as the controller of workspace data.

California residents: we do not sell or share personal information as defined by the CCPA/CPRA and we do not use it for targeted advertising. EU/UK residents: our legal bases are listed in section 2; you may contact us at the address above to exercise GDPR rights.

10. Children

The Service is for business use and is not directed at children under 16. We do not knowingly collect their data.

11. Changes

We will post changes here and, for material changes, email account holders at least 14 days before they take effect. The effective date at the top tells you when this version began to apply.