Privacy Policy

1. Introduction

ArcanoLabs ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered marketing suite and content generation platform ("Service", "Platform").

By using our Service, you consent to the data practices described in this Privacy Policy. If you do not agree with the practices described in this policy, please do not use our Service.

2. Information We Collect

2.1 Personal Information

We may collect personal information that you voluntarily provide to us, including:

• Name and contact information (email address, phone number)
• Account credentials (username, password)
• Payment information (processed securely through third-party payment processors)
• Profile information (display name, preferences, timezone)
• Content you create and store on our platform
• WordPress and third-party integration credentials (encrypted and stored securely)

2.2 Usage Information

We automatically collect information about how you use our Service:

• Device information (IP address, browser type, operating system)
• Usage patterns (pages visited, features used, time spent)
• Performance data (error logs, response times)
• Credit usage and transaction history
• Content generation requests and AI model usage

2.3 Cookies and Tracking

We use cookies and similar tracking technologies to:

• Maintain your login session
• Remember your preferences and settings
• Analyze platform usage and performance
• Provide personalized user experience

3. How We Use Your Information

We use the collected information for the following purposes:

3.1 Service Provision

• Provide, maintain, and improve our AI-powered marketing tools
• Process and fulfill content generation requests
• Manage your account and subscription
• Enable WordPress and third-party integrations
• Process payments and manage credit transactions

3.2 Communication

• Send service-related notifications and updates
• Provide customer support and respond to inquiries
• Send marketing communications (with your consent)
• Notify you of important changes to our Service or policies

3.3 Platform Improvement

• Analyze usage patterns to improve user experience
• Develop new features and functionality
• Monitor and improve AI model performance
• Ensure platform security and prevent abuse

4. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

4.1 Service Providers

We may share information with trusted third-party service providers who assist us in:

• Cloud hosting and data storage (Firebase, Google Cloud)
• AI services (OpenAI for DALL-E and GPT models)
• Payment processing (Stripe, PayPal)
• Analytics and performance monitoring
• Customer support services
• Social media platforms you choose to connect (e.g., Pinterest, TikTok) to publish content on your behalf

4.2 Legal Requirements

We may disclose information if required by law or to:

• Comply with legal obligations or court orders
• Protect our rights, property, or safety
• Protect the rights, property, or safety of our users
• Investigate and prevent fraud or abuse

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction, subject to appropriate confidentiality protections.

5. Data Security

We implement industry-standard security measures to protect your information:

• Encryption of data in transit and at rest
• Secure authentication and access controls
• Regular security audits and monitoring
• Secure coding practices and vulnerability assessments
• Encrypted storage of sensitive credentials and API keys

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as necessary to:

• Provide our Service and maintain your account
• Comply with legal obligations
• Resolve disputes and enforce agreements
• Improve our Service and develop new features

When you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal purposes.

7. Your Privacy Rights

You have the following rights regarding your personal information:

7.1 Access and Portability

• Request access to your personal information
• Receive a copy of your data in a portable format
• View and download your content and account data

7.2 Correction and Deletion

• Correct inaccurate or incomplete information
• Request deletion of your personal information
• Deactivate or delete your account

7.3 Control and Consent

• Opt out of marketing communications
• Manage cookie preferences
• Control data sharing with third parties
• Withdraw consent where applicable

To exercise these rights, please contact us at [email protected] or through your account settings.

8. AI-Generated Content and Privacy

When you use our AI content generation features, please be aware that:

• Your prompts and inputs may be processed by third-party AI services (OpenAI)
• We do not share your prompts with other users or use them for training
• Generated content is stored securely and privately in your account
• You retain ownership and control over content you create
• We may analyze usage patterns to improve AI model selection and performance

9. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your information in accordance with applicable data protection laws.

For users in the European Union, we comply with GDPR requirements and ensure adequate protection for any data transferred outside the EU.

10. Children's Privacy

Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

11. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of the sale of personal information (we do not sell personal information)
• Right to non-discrimination for exercising privacy rights

12. Changes to Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on our website
• Sending email notification to registered users
• Displaying a prominent notice in our Service

Your continued use of our Service after such modifications constitutes your acceptance of the updated Privacy Policy.

13. Social Media Integrations (Pinterest, TikTok, and Others)

ArcanoLabs lets you connect your own third-party social media accounts — including Pinterest and TikTok — so you can create and publish content to them from within the Platform. These connections are optional and are made through each provider's official OAuth authorization flow.

13.1 How We Connect

• You authorize the connection on the provider's own login and consent screen. ArcanoLabs never sees or stores your social media password.
• For Pinterest, we request only the permissions needed to power the features you use: reading your boards, and reading and creating Pins on your behalf (boards:read, boards:write, pins:read, pins:write). Pinterest requires boards:write to place a Pin on one of your boards; we use it for that alone, and never to create, rename, delete or reorganize your boards.
• For TikTok, we request only the permissions needed to identify your connected account and upload/publish videos you create in ArcanoLabs: user.info.basic, video.upload, and video.publish.
• We do not request access to your Pinterest or TikTok analytics, your followers, your private messages, or other private account details beyond what those scopes allow.

13.2 What We Store and How

• We store the access and refresh tokens the provider issues for the account you connected. These tokens are encrypted at rest and are associated only with your ArcanoLabs account.
• Each user can only access and manage their own connected accounts. Tokens are never shared between users and are accessible only to our backend services — never exposed to the browser or to other accounts.
• We may store limited operational data such as your board names, the identifiers of Pins you create, and TikTok account display information or publish status for videos you send through the Platform, so we can display and schedule your content.

13.3 How We Use It

• Solely to provide the features you request: listing your boards, publishing or scheduling Pins, and uploading/publishing videos to the TikTok account you connected.
• We do not use your social media data for advertising, and we do not sell or share it with third parties.
• Our use of the Pinterest API complies with Pinterest's Developer Guidelines and API Terms of Service.
• Our use of the TikTok API complies with TikTok's Developer Guidelines, Login Kit, and Content Posting API terms.

13.4 Disconnecting

You can disconnect any social media account at any time from your ArcanoLabs settings, which deletes the stored tokens for that connection. You may also revoke ArcanoLabs' access directly from your Pinterest or TikTok account settings. When you delete your ArcanoLabs account, associated connection data is removed as described in the Data Retention section.

14. Google User Data (YouTube, Google Search Console, Google Drive and Google Slides)

ArcanoLabs lets you optionally connect your own Google account so the Platform can work with content you already own. Every connection is made through Google’s official OAuth consent screen, is entirely optional, and can be revoked by you at any time. ArcanoLabs never sees or stores your Google password.

ArcanoLabs’ use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. https://developers.google.com/terms/api-services-user-data-policy

14.1 What Google Data We Access, and Why

We request the narrowest scopes that make each feature work. We access nothing from your Google account until you connect it, and only for the integration you chose:

• YouTube (youtube.upload, youtube.readonly) — so that ArcanoLabs can upload a video you created in the Platform to your own YouTube channel when you approve it, set that video’s thumbnail, and read your own channel’s public profile and video metadata (channel name, description, subscriber and video counts, video titles, descriptions, tags and statistics) to build your brand voice profile and suggest content. We access only the channel you connected.
• Google Search Console (webmasters.readonly) — read-only access to the search performance data (queries, impressions, clicks, average position, and the list of properties you own) for websites you have already verified in Search Console, so the Platform can show you rank tracking and underserved-search opportunities for your own site.
• Google Drive and Google Slides (drive.file) — per-file access only. To import an existing deck, you choose it in Google’s own file picker, and ArcanoLabs can then read that one presentation’s slides, text and images. ArcanoLabs can also create new presentations in your Drive from decks you generate in ArcanoScript, and read back the files it created. ArcanoLabs cannot see, list or open any other file in your Drive — only the presentations you hand it and the ones it made for you.
• Basic profile (userinfo.email, userinfo.profile) — your email address and display name, so the Platform can show you which Google account is connected and let you switch accounts.

14.2 How We Use Google User Data

• Solely to provide and improve the user-facing features you requested, as described in 14.1.
• Some features send Google data to an AI model to produce a result for you — for example, your own YouTube channel description and video titles are sent to our AI provider (OpenAI) so the Platform can draft a brand voice profile and content suggestions for your account. This output is shown only to you.
• We do not use Google user data for advertising, ad targeting, ad personalization, credit or lending decisions, or to build profiles for any purpose other than the features you use.
• We do not use raw or derived Google user data — including Google Workspace (Drive, Slides) data — to develop, improve or train generalized AI or machine learning models, and we do not transfer it to any third-party service that would do so. Our AI providers are used under terms that exclude customer data from model training.
• We do not use the YouTube API to reward, incentivize or automate subscriptions, likes, comments or other engagement on any channel.

14.3 What We Share, and With Whom

• We do not sell, rent or trade Google user data, and we do not transfer it to data brokers, advertisers or ad networks.
• We share it only with the infrastructure and AI subprocessors needed to deliver the feature you asked for: Google Cloud and Firebase (hosting, database and file storage) and OpenAI (the AI drafting described in 14.2). These providers act on our instructions and may not use the data for their own purposes.
• We disclose Google user data otherwise only where legally compelled, as described in Section 4.2.
• Google user data is never shared with other ArcanoLabs users or accounts.

14.4 How We Protect It

• All traffic between you, ArcanoLabs and Google is encrypted in transit over TLS/HTTPS.
• Google OAuth access and refresh tokens are encrypted at rest before being written to our database, and are readable only by our backend services — never by the browser.
• Every request for Google data is authenticated and authorized against your ArcanoLabs account, so one user can never reach another user’s Google connection or data.
• Access to production systems is restricted, logged and monitored, and secrets are held as managed environment configuration rather than in source code.

14.5 Retention and Deletion

• We retain your Google OAuth tokens only while the connection is active. Data fetched from Google (such as channel metadata, Search Console metrics or an imported presentation’s contents) is retained only as long as needed to power the feature and display your results.
• Disconnecting: you can disconnect any Google integration at any time from your ArcanoLabs settings, which deletes the stored tokens for that connection. Data derived from YouTube that is held in our systems is deleted no later than 30 days after it is fetched, or immediately upon disconnection.
• Revoking from Google: you can revoke ArcanoLabs’ access directly at https://myaccount.google.com/permissions
• Account deletion: when you delete your ArcanoLabs account, all stored Google tokens and data derived from Google user data are deleted or anonymized within 30 days, as described in Section 6.
• You can also request deletion of your Google-derived data at any time by contacting [email protected].

14.6 YouTube-Specific Terms

ArcanoLabs’ YouTube features use YouTube API Services. By using them you also agree to the YouTube Terms of Service, and you can read the Google Privacy Policy. https://www.youtube.com/t/terms · https://policies.google.com/privacy

15. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: