# Privacy

> Draft for lawyer review

Last updated: 2026-11-03

What Arcadium Data collects about you, why, how long we keep it, and who processes it for us.

DRAFT. Lawyer review pending. Items marked [L] are questions for the lawyer and [A] are facts still to be checked.

This notice covers the arcadiumdata.io website, the early access list, customer accounts, the API and the MCP server. The controller is AENIGMA EOOD, Mladost 1, 1784 Sofia, Bulgaria (UIC 206749528), the company behind the Arcadium Data brand. Write to [hello@arcadiumdata.io](mailto:hello@arcadiumdata.io) with any question or request. [L1]

The API, accounts and payments are not open yet. Sections that describe them apply from the day they open.

## What we collect

### Early access list

Your email address, the data you need, and, if you give them, your company and use case. We also store the version of this notice you agreed to, the time, whether the confirmation email was sent and, if your link carried them, campaign tags such as `utm_source`.

### Your account

- Your email address, the version of our terms you accepted and when, when the account was created and when you last signed in.
- Your company's name and country and, if you give one, its VAT ID. For EU VAT IDs we ask the European Commission's VIES service whether the number is valid and store the result and the date of the check.
- Sign-in links and sessions. We store only a hash of each link and session token, never the token itself. Sign-in links expire after 15 minutes; sessions after 30 days.
- Your API keys: the name you give each key, its non-secret prefix, a keyed hash of the secret part, when it was created and last used, and when it was revoked.

### Payments

Card payments are handled by Stripe. We never see or store your card number. We keep a record of each top-up, charge, hold and refund in our ledger, linked to a random account ID rather than to your email. [A1]

### Your runs

The inputs you send to a scraper (for example a business URL or a search term), the run's status, row count and cost, and the results. Results are kept for 7 days so you can download them, then deleted. [A2]

### Emails we send

Sign-in links, confirmations and service notices go through a queue in our database before they are sent. A sent message is deleted from the queue after 7 days; a message that could not be delivered is deleted after 30 days.

### Logs and security

- Our API writes one log line per request with the time, method, path, status and duration. It does not log your IP address, email address, inputs or keys.
- To limit abuse, our API counts requests per IP address in memory for up to an hour. These counts are never written to disk.
- Our web server does not keep an access log. Its error messages can include the IP address of the request that caused the error. [A3]
- Server logs are rotated by size and overwritten as new lines arrive. [A3]
- Forms use Cloudflare Turnstile to tell people from bots. Turnstile processes technical data about your browser and connection for that check.

### What we do not collect

The site sets no advertising or tracking cookies and uses no analytics that track you across sites. We count page views with Cloudflare Web Analytics, which sets no cookies and does not build a profile of you; it sees the page address, referrer, browser type and country for that count. If you switch between light and dark themes, your browser stores that choice locally; it is not sent to us.

## Why we use it

| Purpose | Data | Legal basis |
| --- | --- | --- |
| Early access emails and the invitation | Early access entry | Your consent (GDPR Art. 6(1)(a)) |
| Deciding which sources to build next | Data need and use case | Your consent |
| Running your account, runs and billing | Account, company, keys, runs, ledger | Our contract with you (Art. 6(1)(b)) |
| Invoices, VAT and accounting records | Company, VAT ID, ledger, payments | Legal obligation (Art. 6(1)(c)) |
| Keeping the service secure, stopping abuse | Logs, rate counts, bot check | Our legitimate interest in a secure service (Art. 6(1)(f)) |
| Service notices about your account | Email address | Our contract with you |

We do not sell your data and do not use it for advertising. We send marketing email only if you ask for it. [L2]

## How long we keep it

| Data | How long |
| --- | --- |
| Early access entry | Until 12 months after the API opens, or until you ask us to delete it [L3] |
| Account, company and API keys | Until you delete your account |
| Sign-in links | Deleted 7 days after they expire |
| Sessions | Deleted when they expire (30 days at most) |
| Run results | 7 days [A2] |
| Run records and ledger entries | 10 years, as accounting records [ACC] |
| Email queue | 7 days after sending, 30 days if delivery failed |
| Backups | Encrypted copies of the database are kept for 30 days, so deleted data leaves the backups within 30 days |
| Server logs | Overwritten by size rotation [A3] |

Deleting your account removes your account, company data, keys, sessions, sign-in links and queued emails at once. Ledger entries stay, linked only to the random account ID.

## Who processes it for us

| Provider | What for | Where |
| --- | --- | --- |
| Hetzner Online GmbH | Servers and database | Germany [A4] |
| Cloudflare, Inc. | Website delivery, page-view counts, network protection, bot check, encrypted backup storage | EU and worldwide network |
| Resend | Sending email | United States [A5] |
| Google (Workspace) | Our email inbox, where your messages to us arrive | EU and United States [A6] |
| Stripe Payments Europe, Ltd. | Payments, from the day payments open | Ireland, with transfers to the United States |
| Cloud compute and proxy infrastructure provider | Running the scrapers with your inputs; results until deleted | EU [L4] |

The [sub-processor list](/legal/subprocessors/) has the full details. Transfers outside the EU rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified, or on standard contractual clauses. [L5]

VIES is run by the European Commission. When we check a VAT ID, the number goes to VIES and to the tax authority of the country that issued it.

## Your rights

You can ask for a copy of your data, ask us to correct or delete it, ask us to restrict or stop using it, ask for it in a portable format, and withdraw your consent at any time. Write to [hello@arcadiumdata.io](mailto:hello@arcadiumdata.io) from the address the request is about. We answer within one month. You can delete your account yourself in your account settings.

You can also complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or to the data protection authority in your own country.

## Personal data in scraper output

Our scrapers are built not to return personal data. Reviewer names, profile links, emails and phone numbers are not collected, and names inside review text and business owner replies are replaced with [name]. If you find data about yourself in our output, write to us. We remove it and fix the scraper. Our [takedown policy](/legal/takedown/) explains how.

## Changes

We date every version of this notice. If a change affects how we use data we already hold, we email account holders before it takes effect.

---

## Questions for the lawyer and facts to check

Remove this section and every [L], [A] and [ACC] marker before publishing.

- [L1] Do we need a Data Protection Officer or an EU representative? We assume no (small company, no large-scale monitoring, EU establishment).
- [L2] Can we email account holders about new scrapers under the soft opt-in (ePrivacy Art. 13(2), Bulgarian Electronic Communications Act), or do we need consent?
- [L3] Is "12 months after the API opens" an acceptable retention for the early access list, or should it be "12 months after the last contact"?
- [L4] Must we name the engine provider here and in the sub-processor list? Its terms make naming it in marketing risky; a factual entry in a privacy notice may be different.
- [L5] Which transfer mechanism do we cite for each US provider?
- [L6] Do the scrapers themselves need a separate notice (Art. 14) for the people whose public reviews pass through our systems before names are removed? Can we rely on Art. 14(5)(b)?
- [A1] Confirm which Stripe data we store (customer ID, payment intent IDs, amounts) once the Stripe integration is built.
- [A2] The runs module is not built yet. The 7-day result retention comes from the plan; confirm it in code and with the engine provider's dataset retention.
- [A3] Our Caddy configuration has no access log. Check on the server what the Caddy error lines contain and how long Docker keeps them (rotation is set to 3 files of 50 MB per container, with no time limit). If the period is open-ended, set a time limit or state the longest period here.
- [A4] Confirm the Hetzner data centre location of the production server.
- [A5] Confirm the Resend sending region of our account (US or EU).
- [A6] Confirm whether hello@arcadiumdata.io is received through Google Workspace.
- [ACC] Retention period for accounting records under the Bulgarian Accountancy Act.