REVIEW DRAFT — NOT YET EFFECTIVE
The existing draft wording below is preserved for owner and legal review. Incorporation confirmation, the contractual operator, applicable jurisdiction, and final operating practices remain to be confirmed. No effective date has been assigned.
Project Arc is a connected project and practice-management platform for architectural work, from pursuit and proposals through design, tender, construction administration and closeout. This policy is prepared for Project Arch Technologies Inc. (“Project Arc”, “Arc”, “we”, “us”). It covers our marketing website, enquiries, demonstrations, pilot administration and personal information we handle for our own business purposes. Our intended operating jurisdiction is British Columbia, Canada. Contact: hello@projectarc.io, attention Privacy Lead. The responsible individual and business mailing address must be confirmed before this policy takes effect.
Arc’s own business records are different from information an architecture practice or other customer places in its workspace. A customer generally determines the purpose of its project records, who may access them and how long professional or contractual records must be retained. Arc’s proposed role is to process that information to deliver the agreed service under the customer’s instructions and applicable law. A separate pilot/subscription agreement and data-processing terms will define those responsibilities. This policy does not give Arc ownership of customer records or override a customer’s professional duties.
When you contact us, request a walkthrough or discuss a pilot, we may receive your name, email address, business role, firm name, country, team size, workflow needs and the contents of your correspondence. Participation in a pilot may also involve user account details, support requests, feedback and agreed demonstration material. Please provide only what is necessary. Do not send passwords, identity documents, payment-card details, employee files, confidential client records or sensitive project documents through a general enquiry. Business contact information and work product may be treated differently under applicable privacy laws; we nevertheless aim to handle them responsibly.
The website is built and hosted using Framer. Delivering and protecting a website can involve technical request information, such as IP address, browser/device information, requested pages, timestamps and error/security logs. Framer describes its built-in analytics as cookie-free and uses a daily rotating method to calculate unique visits. That description does not establish the configuration of every Arc page or embedded service. Additional analytics, advertising pixels, scheduling tools or embedded media can have different practices. Before public launch, Arc must verify its actual scripts and cookies and update this section with any additional providers, purposes and required consent choices.
Our proposed purposes are to answer enquiries; arrange and follow up on demonstrations; assess and administer an agreed pilot; support authorized users; investigate errors and protect the service; understand feedback and improve relevant workflows; manage customer relationships and business records; and meet lawful obligations. We will seek appropriate consent or rely on another lawful authority where permitted. We will not make access conditional on permission for unnecessary uses. A request for a demo is not, by itself, consent to unrelated promotional campaigns.
We explain important collection purposes at the point of collection where appropriate. Where required, optional marketing or a new materially different use will have a separate choice. You may withdraw consent or ask to stop optional communications by contacting hello@projectarc.io; any marketing email should also provide an unsubscribe method. Withdrawal may limit a service that depends on the information, and legal or contractual restrictions may still apply. Essential account, security and service communications are distinct from optional marketing. Browser controls can limit cookies, but do not necessarily disable every server-side log or cookie-free measurement.
Arc’s proposed approach is to share information only as necessary with personnel and service providers who support hosting, communications, account administration, support, security, payment processing or a specifically enabled product feature. Providers should be subject to appropriate contractual restrictions and safeguards. Framer is the identified website platform; the email, application-hosting, authentication, database, payment and AI provider inventory remains to be verified. We may also disclose information where lawfully required, to address misuse or security issues, or in a business transaction subject to applicable legal protections. The proposed policy is not to sell personal information or disclose customer workspace content to advertising networks. These commitments require operational verification before launch.
The planned BC registration does not mean that all information will be stored or accessed only in British Columbia or Canada. Cloud and communications providers may process information in other jurisdictions, where local authorities may have lawful access. Arc must confirm the locations and safeguards for each production/pilot provider before receiving confidential customer data. We do not presently promise Canadian-only residency. If a customer needs a particular location, confidentiality arrangement or public-sector compliance framework, it must be assessed and expressly agreed before use.
Ask Arc is a product direction for assistance grounded in a project record. Illustrations on the website are not proof that a production AI feature is enabled. Before enabling AI on customer information, Arc must identify the relevant provider, the information sent, processing locations, retention/training settings and available controls, and establish the required authority. The proposed policy is not to use customer workspace content to train general-purpose AI models without separate, specific authorization. This is an intended contractual/product requirement, not a verified statement about every prototype tool. Do not submit sensitive project data to an unapproved AI workflow. AI output may be incomplete or wrong and must be checked against its sources by an authorized person.
Arc’s proposed program calls for reasonable safeguards proportionate to the information, including controlled access, appropriate authentication, provider oversight, confidentiality obligations, secure disposal and incident response. Specific controls must be tested in the actual environment; a policy alone does not implement them. No online system can be guaranteed secure. We do not claim a particular security certification, audit, uptime level, encryption configuration or backup/recovery result unless separately verified and documented. Where an incident occurs, the response should include investigation, containment and notification to affected customers, individuals or regulators as required by applicable law and agreement.
Information should be kept only as long as reasonably needed for the identified purpose, a legitimate business need or a legal obligation. Enquiry and demonstration records should be reviewed when the relationship becomes inactive; an annual review is the proposed operational starting point, not a verified deletion schedule. Workspace retention, customer export, account closure and backup deletion will be set in the relevant service agreement and verified against the chosen infrastructure. A deletion request may be limited by litigation holds, professional/contractual records requirements or other lawful obligations. Where BC PIPA requires information used to make a decision directly affecting an individual to be retained for at least one year, that requirement takes precedence. Information no longer needed should be securely destroyed or made non-identifiable.
You may ask about our practices, request access to your personal information, seek correction of an error or withdraw consent where applicable. Email hello@projectarc.io with “Privacy request” in the subject and describe the request without sending unnecessary sensitive information. We may take proportionate steps to verify identity or authority. If information is controlled by a customer firm, we may direct you to that firm or assist it under the relevant agreement. We will respond within applicable legal time limits—ordinarily 30 days under BC PIPA, subject to its rules and permitted extensions. Access may be restricted by lawful exceptions, including protection of others’ information and privilege. We will explain a refusal or applicable fee where required.
Arc is designed for professional/business use, not services directed at children. Do not submit a child’s personal information unless an agreed workflow and lawful authority specifically permit it. External sites and linked product services have their own policies. If Arc introduces payments, new integrations, Facility Management or other materially different features, the relevant privacy disclosures and agreements must be updated before those activities begin; a roadmap does not authorize new data uses.
Contact hello@projectarc.io, attention Privacy Lead, to raise a concern or request an explanation. We will investigate and respond through our privacy process. You may also contact the Office of the Information and Privacy Commissioner for British Columbia at oipc.bc.ca, or another regulator with jurisdiction, without giving up that right by contacting us first. Once approved, the effective date and material revisions will be identified here. We will give appropriate notice and obtain any additional consent required for a new purpose rather than treating a policy update as automatic permission.
This is a near-complete review draft, not a statement that the proposed controls are already operating. Confirm incorporation and the responsible operator before incorporation; the Privacy Lead and mailing address; the actual providers, locations, cookies and AI settings; retention/export/deletion procedures; and the incident-response and request-handling process. Obtain Canadian legal review and assess any additional requirements for the customers and regions served. No effective date has been assigned.
Implementation note for legal review
The Website V2 demo form now sends the submitted name, work email, company, organization type, team size, interests, and enquiry source to HubSpot for enquiry management. The connection was tested using the owner’s designated email. This verified implementation detail needs to be reconciled with the service-provider and collection clauses before approval.