Privacy Policy
⚠️ Incorporation Notice: Archon is currently operating as an unregistered business. Upon incorporation, this Privacy Policy will be updated to reflect the registered legal entity name, registration number, and jurisdiction.
1. Introduction
Welcome to Archon ("Archon," "we," "us," or "our"). Archon is an AI-powered sales automation platform that helps businesses qualify leads, book appointments, and manage customer conversations across multiple channels.
This Privacy Policy explains how we collect, use, store, share, and protect information when you:
- Visit our website
- Register for and use the Archon platform
- Interact with our AI agents as an end customer of one of our subscribers
By using Archon, you agree to the practices described here.
2. Who This Policy Covers
This policy addresses two distinct groups:
Subscribers — Businesses and individuals who create an Archon account, deploy AI agents, and pay for the service. We are a data controller with respect to subscriber account data.
End Customers — People who interact with an Archon-powered AI agent on behalf of a Subscriber's business. We process this data as a data processor on behalf of the Subscriber. If you are an end customer with questions about your data, contact the business whose AI agent you interacted with.
3. Data We Collect
3.1 Subscriber Account Data
When you register for Archon, we collect:
- Identity data: Full name, email address
- Authentication data: Password (stored as a cryptographic hash). Authentication is managed by Clerk.
- Profile data: Avatar/profile image URL, notification preferences
- Billing data: Payment method details, subscription plan, billing history. Processed by Stripe — we do not store full card numbers.
- API credentials: API key identifiers and hashed keys
- Integration tokens: OAuth access tokens for connected platforms (Facebook, Instagram, WhatsApp, Gmail). Important: These tokens are currently stored in our database. We are implementing column-level encryption for token storage, to be completed before any enterprise customers are onboarded.
3.2 Agent and Configuration Data
- Agent name, instructions, system prompt, and personality settings
- Knowledge base content (documents, FAQs, product information you upload)
- Channel configuration
- Team member information
3.3 End Customer Conversation Data
- Conversation transcripts: Full text of messages exchanged
- Lead data: Name, phone number, email address, budget, location, stated intent, readiness score
- Booking data: Preferred dates, contact details, appointment notes
- Channel metadata: Platform of origin, message timestamps, external message IDs
- AI processing metadata: Confidence scores, escalation flags, sentiment indicators
3.4 Usage and Technical Data
- IP address, browser type, operating system
- Pages visited, features used, actions taken within the dashboard
- API request logs
- Rate limit events
4. How We Use Your Data
4.1 Subscribers
| Purpose | Legal Basis (GDPR) |
|---|---|
| Create and manage your account | Contract performance (Art. 6(1)(b)) |
| Process payments and manage subscriptions | Contract performance (Art. 6(1)(b)) |
| Provide and operate the platform | Contract performance (Art. 6(1)(b)) |
| Send transactional emails | Contract performance (Art. 6(1)(b)) |
| Respond to support requests | Legitimate interests (Art. 6(1)(f)) |
| Improve and develop the platform | Legitimate interests (Art. 6(1)(f)) |
| Comply with legal obligations | Legal obligation (Art. 6(1)(c)) |
| Send product updates and marketing (with opt-out) | Legitimate interests (Art. 6(1)(f)) |
4.2 End Customer Data
We process end customer data exclusively to provide the contracted service to Subscribers. We do not:
- Use end customer conversation data to train AI models for general purposes
- Sell or share end customer data with third parties for their own commercial purposes
- Use end customer data to profile individuals beyond what the Subscriber has authorised
4.3 AI Processing
Conversation content is transmitted to our AI sub-processors to generate responses. Current provider: Groq. Planned future providers: OpenAI, Anthropic. We have reviewed their API terms to confirm they do not train on API-submitted data.
5. Data Retention
| Data Category | Retention Period |
|---|---|
| Subscriber account data | Active subscription + 30 days after cancellation |
| Conversation transcripts | Active subscription + 30 days after cancellation |
| Lead and booking data | Active subscription + 30 days after cancellation |
| Payment records | 7 years (legal/tax obligation) |
| API request logs | 90 days |
| Deleted agent data | Permanently deleted immediately upon agent deletion |
After the 30-day grace period following account cancellation, all subscriber data, conversation data, lead data, and agent configurations are permanently and irreversibly deleted. To request deletion before the grace period expires, contact legal@archon.qd.je.
6. Data Sharing
We do not sell your data. We share data only in the following circumstances:
6.1 Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Clerk | User authentication and session management | United States |
| Stripe | Payment processing and billing management | United States |
| Supabase | Database hosting (PostgreSQL) | Based on selected region |
| Groq | AI language model inference | United States |
| Meta Platforms | Facebook/Instagram/WhatsApp channel integration | United States |
| Gmail channel integration | United States | |
| Redis / BullMQ | Message queue processing | Your hosted infrastructure |
We will notify you of changes to this sub-processor list with at least 14 days' notice.
6.2 Legal Requirements
We may disclose data if required by law, court order, or governmental authority, or where necessary to protect the rights, property, or safety of Archon, our subscribers, or others.
6.3 Business Transfers
In the event of a merger, acquisition, or sale of assets, subscriber data may be transferred to the acquiring entity. We will provide notice before any such transfer.
7. International Data Transfers
Archon is operated primarily from Egypt. Our sub-processors are located in the United States. For subscribers in the EEA, UK, or other jurisdictions with transfer restrictions, transfers are covered by Standard Contractual Clauses (SCCs) under GDPR Art. 46(2)(c) or adequacy decisions where applicable.
8. Your Rights
8.1 For Subscribers (GDPR — EEA/UK users)
You have the right to access, rectify, erase, restrict, port, and object to processing of your data, and to withdraw consent where processing is consent-based. Email legal@archon.qd.je — we will respond within 30 days.
Note: Account deletion and data export are currently handled manually. Self-service tools are planned for Q3 2026.
8.2 For Subscribers (CCPA — California residents)
California residents may request to know what data is collected, request deletion, and opt out of sale (we do not sell personal information). Email legal@archon.qd.je.
8.3 For End Customers
Contact the Subscriber (the business whose agent you spoke with) to exercise data rights. If you cannot reach them, contact us at legal@archon.qd.je and we will assist.
9. Security
Current measures include Clerk-managed authentication, TLS 1.2+ for all data in transit, Supabase database hosting with network isolation, rate limiting, and API key hashing.
Known limitations in remediation: OAuth tokens are currently stored without column-level encryption (target: Q3 2026). Automated database backups are being implemented.
10. Cookies
We use cookies and similar technologies. See our Cookie Policy for full details. A consent banner is presented to users in jurisdictions where consent is required.
11. Children's Privacy
Archon is a business-to-business platform. We do not knowingly collect personal data from anyone under 18. Contact legal@archon.qd.je if you believe a minor has submitted data to us.
12. Third-Party Links and Integrations
Our Privacy Policy does not cover the privacy practices of third-party platforms we integrate with. Review their policies before connecting them to Archon.
13. Changes to This Policy
For material changes, we will update the "Last Updated" date and notify registered subscribers by email at least 14 days before changes take effect.
14. Contact Us
Email: legal@archon.qd.je
Website: archon-three.vercel.app
Upon incorporation, this section will be updated with the company's registered address and registration number.