Privacy Policy

1. Data we collect

• Account data: name, email address (via Clerk).
• Usage data: the ideas and constraints you submit, generated plans, ratings and feedback you provide.
• Technical data: IP address, browser/user agent, and similar data collected automatically for security and rate-limiting purposes.
• Payment data: handled entirely by Stripe. We store only your Stripe customer ID and subscription status — we never see or store your card number.

2. How we use your data

We use your data to operate the Service (generating and storing your plans), to process payments, to secure the Service (rate limiting, fraud/abuse prevention), and to improve the quality of our AI outputs (for example, aggregate — not individually identified — feedback ratings inform prompt improvements).

3. Legal basis (EEA/UK users)

Where GDPR applies, we process your data on the following bases: performance of a contract (providing the Service you signed up for), legitimate interests (security, fraud prevention, and improving the Service), and consent (for optional analytics or marketing communications, where applicable).

4. Who we share data with

We share data only with the service providers that operate ARCHETYPE on our behalf, each acting under its own data-processing terms:

• Anthropic — processes your idea/constraint inputs to generate AI content.
• Clerk — authentication and account management.
• Supabase — database hosting for your account and plan data.
• Upstash — rate-limiting infrastructure (does not store your content).
• Stripe — payment processing and billing.
• Vercel — application hosting, and (if configured) file storage for exported PDFs.
• Sentry — error monitoring, if configured for this deployment.

We do not sell your personal data. [If an email-delivery provider such as Resend is added later, list it here before it goes live — it is not in use as of this draft.]

5. Your rights

Depending on where you live, you may have the right to: access the personal data we hold about you; correct inaccurate data; request deletion; receive a portable copy of your data; and object to or restrict certain processing. To exercise any of these rights, contact us at [PRIVACY CONTACT EMAIL]. We aim to respond within 30 days.

California residents have equivalent rights under the CCPA/CPRA, including the right to know, delete, and opt out of the sale or sharing of personal information. We do not sell personal information as defined by the CCPA.

6. Data retention

We retain your account and plan data while your account is active. If you cancel your subscription or delete your account, we retain your data for 30 days (to allow reactivation or export), then permanently delete it, except for data we’ve anonymized or aggregated such that it no longer identifies you.

7. Cookies

We use essential cookies required for authentication (Clerk) and payments (Stripe) — the Service cannot function without these. If we add analytics cookies in the future, they will be anonymized where possible, and we will show a consent banner to visitors in the EU/EEA, UK, and California before enabling them. See our Cookie Policy for details.

8. Security

We use encryption in transit (TLS) and at rest for stored data, role-based access controls, and audit logging on administrative actions. No system is 100% secure, and we cannot guarantee absolute security of your data.