Privacy Policy

Arch (“Arch”, “we”, “us”) provides tools that help businesses work with AI agents: Agent Experience, Agent Intelligence and the Agentic Readiness Check. You can contact us about this policy at [email protected].

This policy covers the Arch website at itsarch.com, including the Readiness Check, the contact form and email updates, and the Arch for Shopify application. It explains what information we collect, why, who helps us process it, how long we keep it and the choices you have.

When you send the contact form (“Talk to Arch”, or a request after a readiness result), we collect:

• your name and work email address;
• your company name and your message, if you add them;
• which form you used; and
• if you write to us after a Readiness Check, the website address you checked and a reference to that result.

A website address you checked tells us what you asked about. We do not treat it as proof of who you work for.

We use this information to reply to you and to handle your request. Depending on how the site is hosted, it is stored in our internal records, delivered to us through a form or email delivery service that we configure for this purpose, or both. We do not add contact form submissions to our email updates list.

If you enter your email address in the footer and select “Get updates”, we store:

• your email address;
• the consent statement shown next to the form at the time (“Occasional ARCH updates by email. Unsubscribe anytime.”) and the date and time you agreed to it; and
• where on the site you signed up.

We do not record your IP address for this. The confirmation “You’re subscribed” appears only after your address has been stored. If it cannot be stored, you see an error instead.

We use this address only to send occasional ARCH updates by email. It is kept separately from contact form enquiries and is not sold or shared for advertising.

Unsubscribing

You can unsubscribe at any time on our unsubscribe page or by emailing [email protected]. Once you unsubscribe, we keep a record that your address unsubscribed and when, so that we do not email it again. If you would rather we delete the address entirely, tell us.

When you enter a website address, the Readiness Check reads that website’s public pages: its homepage, robots.txt, sitemap, llms.txt and at most one sample product or room page. It identifies itself as ARCH-ReadinessCheck, reads only public pages and does not sign in, submit forms or complete purchases or bookings.

For each check we keep a record of:

• the address you entered and the website it resolved to;
• the outcome (for example completed or rejected), the score and how much could be verified, the type of site detected and how long the check took;
• a visitor identifier: a one-way hash of your IP address combined with a secret value, so the same connection can be recognised without storing the IP address itself; and
• your browser’s user-agent string and, where our hosting provider supplies it, the country your connection appears to come from.

We use these records to run and protect the service (including rate limits), to understand how the check is used and to improve it. We do not store your IP address in these records, but a hashed identifier together with a user-agent string can still be personal data, so we treat these records as personal data.

A readiness result can be opened from its link for 24 hours. After that, the link stops working. The check records described above are kept as set out in “How long we keep information”.

Results describe public signals of a website at the time of the check. They are not a statement about any person.

On the Arch website, we do not record the activity of AI agents beyond the Readiness Check records and form submissions described above, and we do not receive or observe conversations between people and AI assistants.

Agent activity data is collected only through the Arch for Shopify application, for the merchants who install it. This is described in the next section. Agent Intelligence beyond that application is in development; if it starts to collect new kinds of data, we will update this policy first.

Arch for Shopify is a pre-release application for Shopify merchants. When a merchant installs it, Arch processes store information, product catalogs, sales and order data, browsing activity, checkout events, technical identifiers, and results from simulated AI shopping journeys.

Certain direct personal identifiers are redacted before storage. Other identifiers, including customer, browser and order IDs, may be retained.

We use this information to provide storefront analytics, evaluate AI shopping readiness, run simulated AI shopping tests, identify technical issues and operate the application.

The application uses Shopify Web Pixel and storefront tracking technologies to collect activity data, subject to applicable consent requirements.

For this application, Arch uses Shopify, Heroku, and third-party AI services accessed through OpenRouter. AI providers may receive product information, sales-related data and shopping journey content. Data may be processed internationally, depending on the provider.

If you are a customer of a merchant that uses Arch for Shopify, you can also direct requests about your information to that merchant.

The Arch website does not set cookies and does not use analytics, advertising or third-party tracking scripts. Our fonts are served from our own website.

The “Are you an Agent?” view is carried in the page address (for example ?view=agent). It is not stored in your browser.

The Arch for Shopify application uses the tracking technologies described in the previous section on the storefronts of merchants who install it.

We use information only for the purposes described in this policy:

• to reply to enquiries and act on your requests (contact form);
• to send occasional updates you asked for, based on your consent, which you can withdraw at any time (email updates);
• to operate, secure and improve the website and the Readiness Check, based on our legitimate interest in providing a reliable and safe service (Readiness Check records); and
• to provide the Arch for Shopify application to merchants who install it, under our agreement with them.

We do not sell personal information and we do not use it for advertising.

We share information only with service providers that help us run Arch, and only for the purposes above:

• the hosting and infrastructure provider that serves this website and stores the records described in this policy;
• the form or email delivery service that delivers contact form submissions to us; and
• for the Arch for Shopify application: Shopify, Heroku and AI services accessed through OpenRouter, as described above.

We may also disclose information where the law requires it, or to protect the rights, safety and security of Arch, our users or others.

Our service providers may process information in countries other than the one you live in. Where the law requires safeguards for such transfers, we rely on the safeguards our providers make available.

• Readiness results: the result link works for 24 hours.
• Contact form submissions, Readiness Check records and email update subscriptions: we have not set an automatic deletion period. We keep them only for as long as we need them for the purposes in this policy, and we delete them earlier when you ask us to and the law allows it.
• Unsubscribed addresses: we keep the record that an address unsubscribed, so that we do not email it again, unless you ask us to delete it.
• Arch for Shopify: information is retained as necessary to operate the service, subject to applicable agreements and legal requirements.

Depending on where you live, you may have the right to ask for access to your personal information, to have it corrected or deleted, to object to or restrict how we use it, to receive a copy of it, and to withdraw consent you have given. You may also have the right to complain to your local data protection authority.

To make a request, email [email protected]. We may need to confirm that the request comes from you before we act on it. To stop email updates, use the unsubscribe page.

We limit access to our internal records to people who need it, and our internal dashboard requires authentication. Readiness Check records store a hash of the IP address rather than the address itself. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Arch is a service for businesses. It is not directed to children, and we do not knowingly collect information from children.

We will update this policy when our services or practices change. The current version is always on this page, with the date it was last updated. Where the law requires it, we will tell you about material changes.