Privacy Policy

The controller of your personal data is Archyno s.r.o.:

• Registered office: to be confirmed, Slovak Republic
• Registration number: to be confirmed

Write to privacy@archyno.com about anything on this page. We have not appointed a data protection officer; we are not required to.

Where you use Archyno through an organization that invited you, that organization is the controller of the model content in its projects and we act as its processor for that content. This policy describes what we do as controller of your account data.

Account data

Email address, display name, the organizations and roles you hold, and authentication metadata such as sign-in timestamps. If you sign in with a third-party identity provider we receive your email address and name from it, not your password.

Content you create

Projects, models, diagrams, element documentation, comments, and files you import or export. This is the substance of the service and we hold it because we have to in order to show it back to you.

Billing data

Plan, seat count, invoices, and billing address. Card details are entered directly with our payment processor and never reach our servers - we store a customer reference, not a card number.

Technical and usage data

IP address, browser and device type, and server logs of requests. We record structured events for exports and AI runs - which capability, how many tokens, how long it took, and whether you accepted the result - because those two numbers are how we tell whether the product works.

• To provide the service - accounts, projects, collaboration, exports, billing. Legal basis: performance of a contract.
• To keep it secure and working - abuse prevention, rate limiting, debugging, capacity planning. Legal basis: our legitimate interest in a service that stays up and is not abused.
• To improve the product - aggregate usage measurement, AI accept rates. Legal basis: legitimate interest. This never involves reading your model content for product research.
• To meet legal obligations - tax and accounting records for invoices. Legal basis: legal obligation.
• To send product email you asked for - invites, seat changes, billing notices. Marketing email, if we ever send it, goes only to people who opted in, and every message carries an unsubscribe link. Legal basis: consent.

When you use an AI feature, the current project and your current selection are sent to our AI provider so it can return a suggestion. Nothing else goes with it: a prompt never contains another organization's data.

Your content is not used to train AI models, ours or the provider's. This is enforced by the configuration of our provider account, not only by policy.

If you never use an AI feature, your model content is never sent to an AI provider at all.

We use the providers below to run the service. Each is bound by a data processing agreement and may only act on our instructions. We do not sell personal data, and we do not share it with advertisers.

We may also disclose data where the law requires it, or to protect our rights or the safety of others.

Some providers above process data outside the European Economic Area, principally in the United States. Those transfers rely on the European Commission's standard contractual clauses, or on an adequacy decision where one applies. You can ask us for a copy of the safeguards in place for a specific provider.

• Account and content - for as long as the account exists. Deleting your account or organization deletes its projects.
• Backups - deleted content persists in encrypted backups for up to 30 days, then ages out.
• Server and security logs - up to 90 days.
• Invoices and accounting records - for as long as tax law requires, which is longer than the rest and outside our discretion.

Under the GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct it if it is wrong;
• delete it;
• restrict or object to how we process it;
• export it in a portable, machine-readable format;
• withdraw consent you gave, without affecting what we did before you withdrew it.

Email privacy@archyno.com. We answer within one month. There is no charge unless a request is manifestly excessive.

If your content lives in an organization someone else administers, send the request to that organization - they control it, and we will help them act on it.

We set the cookies the service cannot work without: a session cookie that keeps you signed in, and a cookie that remembers the language you chose so we do not re-negotiate it on every visit. Both are strictly necessary and neither needs consent.

We do count visits, to see which pages are read. We use Google Analytics for this. It is a third-party service: it stores cookies in your browser (_ga and one named for our measurement ID), reads them on each page you open, and sends the visit to Google, who act as a processor on our behalf and may store it outside the EU.

None of that is strictly necessary, so we ask before it loads. The script is not on the page at all until you say yes - it is not deferred or loaded-and-idled, it is absent. Declining is a complete answer: nothing is loaded, nothing is stored, and no cookie is set beyond the one recording that you declined.

We do not run advertising and we do not use analytics to build advertising profiles or sell data to anybody.

The service is not directed at children. You must be at least 16 to hold an account. If you believe a child has given us personal data, tell us and we will delete it.

We will update this page when what we do changes. Material changes are announced by email or in the product at least 30 days before they take effect, and the date at the top always reflects the current version.

Privacy questions: privacy@archyno.com. Anything else: hello@archyno.com.

You also have the right to complain to a supervisory authority. Ours is the Office for Personal Data Protection of the Slovak Republic. You may instead complain to the authority where you live or work.