ARCLASP PRIVACY POLICY
Last updated: September 4, 2026
Privacy Policy
This Privacy Policy explains how Ansh Pradhan, operating under the name Arclasp (“Arclasp,” “we,” “us,” or “our”) collects, uses, discloses, stores, and otherwise processes personal information when you visit https://arclasp.com/, use the Arclasp web application, dashboard, hosted services, software development kit, APIs, documentation, public verification features, or other services that link to this Privacy Policy (collectively, the “Services”).
Arclasp provides runtime governance and evidence infrastructure for AI-agent and automated workflows. Depending on how the Services are used, Arclasp may process information relating to account holders, members of customer organizations, reviewers and approvers, developers, end users of customer systems, and other individuals whose information is included in customer-submitted workflow data.
This Privacy Policy does not apply to third-party websites, applications, or services that are governed by their own privacy policies.
1. INFORMATION WE PROCESS
The information we process depends on how you interact with the Services.
1.1 Account and Profile Information
When you create or use an Arclasp account, we may process information such as:
- your name;
- email address;
- authentication identifiers;
- account and profile identifiers;
- organization membership and role information;
- account status and related account-management information.
We do not currently operate payment or subscription functionality and therefore do not currently collect payment-card information through the Services.
1.2 Social Sign-In Information
You may be able to sign in using third-party identity providers such as Google or GitHub.
When you use a social sign-in option, the relevant provider and our authentication infrastructure may provide us with information necessary to identify you and establish your account, such as:
- provider account identifier;
- name or profile information;
- email address;
- username or avatar information where made available by the provider.
For Google sign-in, Arclasp currently requests only the standard identity scopes:
openid;https://www.googleapis.com/auth/userinfo.email;https://www.googleapis.com/auth/userinfo.profile.
These scopes permit Arclasp to associate your account with your Google identity and receive basic account information such as your Google account identifier, email address, and profile information made available through those scopes. Arclasp uses this information solely for authentication, account creation and administration, security, and operation of the Services.
Arclasp may store this identity information as part of your Arclasp account records for as long as reasonably necessary to operate your account and for the other purposes described in this Privacy Policy. Google sign-in information may be processed by service providers that support authentication, hosting, database infrastructure, security, and operation of the Services, subject to the limitations described in this Privacy Policy. Arclasp does not sell Google user data or use it for advertising.
Arclasp does not currently request OAuth access to Gmail, Google Drive, Google Calendar, Google Contacts, or other Google service data beyond the identity information described above.
1.3 Organization and Team Information
If you use Arclasp through an organization, we may process:
- organization name and identifiers;
- organization memberships;
- member roles and access status;
- team invitation information;
- administrator and reviewer information;
- organization-level settings and configuration.
1.4 API and Authentication Information
When you create or use API credentials, we may process information relating to those credentials, including:
- API-key identifiers and metadata;
- key names and environment information;
- cryptographic verification or fingerprinting information;
- status, revocation, pause, and usage metadata;
- timestamps relating to credential use.
Where Arclasp generates an API secret for a user, the raw secret may be displayed at creation while verification material is retained for later authentication.
You are responsible for protecting API keys and other credentials associated with your account.
1.5 Workflow and Customer-Submitted Data
When you integrate Arclasp into an application, workflow, AI-agent system, or automated process, the Services may receive information relating to the operation of that workflow.
Depending on your implementation, this may include:
- workflow or Chain identifiers and metadata;
- agent names and identifiers;
- action types and action names;
- action payloads;
- tool inputs and tool results;
- prompts or portions of prompts;
- model outputs or portions of outputs;
- graph or workflow state;
- policy configuration;
- policy decisions and decision reasons;
- risk classifications;
- financial-exposure information;
- token usage, model identifiers, and estimated cost information;
- cumulative workflow metrics;
- timestamps and sequencing information;
- other data that you choose to include in a governed action or workflow.
Certain Arclasp SDK and backend paths apply sanitization, redaction, or truncation controls intended to reduce the transmission or storage of credentials and other sensitive values.
These safeguards are pattern-based and cannot guarantee detection or removal of every secret, personal-data value, or sensitive field. You should therefore avoid submitting information that is not reasonably necessary for your use of the Services and should implement appropriate controls for your own data.
1.6 Approval and Review Information
Where a workflow requires human review or approval, we may process information such as:
- approval status and reason;
- identity of an approver or reviewer;
- decision timestamps;
- decision notes or review context;
- fallback approvers;
- exception or override information;
- approval-related verification information;
- notification information.
1.7 Evidence, Receipt, Audit, and Verification Information
Arclasp may generate and maintain governance and evidence records relating to workflows and decisions, including:
- receipts and chain records;
- approval certificates;
- audit records;
- cryptographic signatures;
- hashes and integrity metadata;
- receipt sequencing and linkage information;
- verification status;
- evidence-status or adjudication information;
- timestamp-verification information;
- recovery or correction-related evidence.
These records are part of Arclasp’s governance and verification functionality.
1.8 Public Verification Information
Authorized users may be able to create public verification links or tokens for eligible evidence.
When such a link is created, a limited verification view may be accessible to anyone who possesses the relevant link or token.
Arclasp is designed to limit public verification responses to appropriate verification information rather than exposing raw credentials, private notes, or unrestricted internal evidence.
However, information intentionally made available through a public link may be viewed, copied, captured, or retained by third parties. Revoking or expiring a link cannot require third parties to delete copies they previously obtained.
Customers are responsible for determining whether information should be made publicly accessible.
1.9 Technical, Device, and Usage Information
When you access or use the Services, we and the infrastructure providers that support the Services may process technical information such as:
- Internet Protocol address;
- browser and device characteristics;
- operating system;
- request and response metadata;
- date and time of access;
- pages or features used;
- application errors;
- security events;
- diagnostic information;
- performance and operational telemetry.
We use this information primarily to operate, secure, troubleshoot, and improve the reliability of the Services.
1.10 Communications
If you contact us, we may process:
- your name;
- email address;
- organization;
- the content of your communication;
- any information you choose to provide;
- related support or correspondence records.
2. HOW WE USE INFORMATION
We may process information described above to:
- create and administer accounts;
- authenticate users;
- manage organizations, memberships, permissions, and API access;
- provide runtime governance functionality;
- evaluate configured policies and workflow conditions;
- record governed actions;
- calculate cumulative workflow metrics;
- create and manage approval requests;
- notify authorized reviewers and approvers;
- create, sign, maintain, and verify governance evidence;
- operate public verification links when authorized;
- maintain security and prevent unauthorized access;
- identify misuse, fraud, technical failures, and security incidents;
- troubleshoot and improve reliability and performance;
- communicate with users;
- provide support;
- enforce our Terms of Service;
- protect our legal rights and the rights of others;
- comply with applicable legal obligations.
Arclasp does not currently operate a backend process that uses Customer Content to train or fine-tune a generalized AI or machine-learning model.
Sample applications or customer applications may themselves use third-party AI providers; those uses are controlled by the customer or developer operating those applications and are not the same as Arclasp using Customer Content for model training.
3. OUR ROLE WHEN PROCESSING PERSONAL INFORMATION
The legal role Arclasp performs depends on the relevant processing activity.
For information relating to Arclasp accounts, website operation, authentication, service security, support, business administration, fraud prevention, and our own legal obligations, Arclasp generally determines why and how that information is processed.
For personal information included in Customer Content or customer-configured workflows, Arclasp generally processes that information in order to provide the Services on behalf of the relevant customer.
Accordingly, depending on the law that applies:
- Arclasp may act as a controller, data fiduciary, or similar responsible party for certain processing; and
- Arclasp may act as a processor, service provider, contractor, or subprocessor for customer-directed processing.
Customers are responsible for determining whether they have a lawful basis and appropriate authority to submit personal information to the Services.
Where applicable law requires a data-processing agreement or equivalent contractual terms between Arclasp and a customer, the parties may enter into appropriate data-processing terms.
4. LEGAL BASES FOR PROCESSING
Where the GDPR, UK GDPR, or similar laws require us to identify a legal basis, we may rely on one or more of the following, depending on the context:
Performance of a Contract
We process information where necessary to provide the Services, authenticate users, operate accounts, deliver requested functionality, and perform our agreements with users or customers.
Legitimate Interests
We may process information where reasonably necessary for legitimate interests such as:
- securing the Services;
- preventing abuse;
- troubleshooting;
- maintaining system integrity;
- improving reliability and functionality;
- communicating with customers;
- protecting and enforcing legal rights.
We consider these interests in light of the rights and interests of affected individuals.
Legal Obligations
We may process information where necessary to comply with applicable law, legal process, regulatory obligations, or lawful government requests.
Consent
Where applicable law requires consent for a particular activity, we may rely on consent. You may withdraw consent where the relevant law gives you that right.
5. HOW WE DISCLOSE INFORMATION
We do not sell personal information.
We do not use personal information for cross-context behavioral advertising or targeted advertising.
We may disclose information in the following circumstances.
Service Providers
We use third parties that perform services supporting Arclasp, including categories such as:
- authentication and identity infrastructure;
- cloud hosting and application infrastructure;
- database and storage infrastructure;
- transactional email services;
- security, error-monitoring, and observability services;
- network and security services;
- technical verification or timestamp infrastructure.
These providers may process information only to the extent reasonably necessary to perform the relevant service or as otherwise permitted or required under their contractual and legal obligations.
Customer-Directed Disclosures
Information may be disclosed where a customer or authorized user directs the disclosure, including through public verification features or team-management functionality.
Legal and Safety Reasons
We may disclose information where we reasonably believe disclosure is necessary to:
- comply with applicable law;
- respond to lawful legal process;
- enforce our agreements;
- investigate abuse or security incidents;
- protect Arclasp, our users, or others;
- establish, exercise, or defend legal claims.
Business Transactions
If Arclasp or substantially all relevant assets are transferred, sold, reorganized, financed, or acquired, information may be transferred as part of that transaction subject to applicable law.
6. INTERNATIONAL PROCESSING
Arclasp is operated from India.
The Services use infrastructure that may process or store information outside your country, including in the United States and potentially other countries in which our service providers operate.
Those jurisdictions may have different data-protection laws from your own.
Where applicable law requires additional safeguards for a restricted international transfer, we will take appropriate measures required by that law, which may include contractual, organizational, or other recognized safeguards.
7. DATA RETENTION
We retain different categories of information for different periods depending on the purpose for which the information is processed.
Factors we may consider include:
- how long an account or customer relationship remains active;
- the nature of the information;
- operational and security requirements;
- integrity of governance and evidence records;
- audit and verification requirements;
- prevention of fraud and abuse;
- dispute-resolution needs;
- applicable limitation periods;
- legal, regulatory, or contractual obligations.
Deletion or closure of an account does not necessarily result in immediate deletion of all associated information.
In particular, certain workflow, evidence, audit, security, approval, receipt, verification, or integrity records may be retained where reasonably necessary to preserve the integrity of the Services, maintain evidence histories, resolve disputes, prevent abuse, or comply with law.
Some records may be deactivated, restricted, or logically deleted rather than immediately erased from all systems.
Information contained in backups, security logs, or systems designed to preserve evidence integrity may also remain for a period before it is overwritten, deleted, or otherwise no longer retained.
We do not represent that every category of information is subject to a single fixed retention period.
8. SECURITY
We use technical and organizational measures designed to protect information processed through the Services.
These measures may include, as appropriate:
- authentication and access controls;
- tenant and organization scoping;
- credential protection;
- sanitization and redaction controls;
- security and error monitoring;
- token and capability protections;
- cryptographic signatures and integrity controls for certain evidence;
- restricted public-verification responses.
No Internet transmission, computer system, or storage technology can be guaranteed to be completely secure.
You are responsible for protecting your own systems, accounts, API keys, credentials, and integration configuration.
Security concerns may be reported to:
9. COOKIES AND BROWSER STORAGE
The Services use cookies and similar browser-storage technologies primarily for authentication, security, and functional preferences.
We do not use advertising cookies or behavioral advertising trackers.
For more information, please review our Cookie Policy at:
10. YOUR PRIVACY RIGHTS
Depending on where you live and the laws that apply, you may have rights relating to your personal information, including rights to:
- request access;
- request correction;
- request deletion;
- request restriction of certain processing;
- object to certain processing;
- request data portability;
- withdraw consent where processing relies on consent;
- lodge a complaint with a competent data-protection authority;
- appeal certain decisions where applicable law provides an appeal right.
These rights are not absolute. Certain information may be retained or processing may continue where permitted or required by law.
If Arclasp processes your information solely on behalf of an Arclasp customer, we may direct your request to that customer or assist the customer in responding to the request.
To exercise applicable rights, contact:
We may take reasonable steps to verify your identity and authority before acting on a request.
11. UNITED STATES PRIVACY DISCLOSURES
Residents of certain U.S. states may have additional privacy rights where the relevant state law applies to Arclasp or the relevant processing.
Arclasp does not currently:
- sell personal information;
- share personal information for cross-context behavioral advertising;
- process personal information for targeted advertising;
- use personal information for profiling in furtherance of decisions producing legal or similarly significant effects as part of the ordinary Services.
Where applicable law provides additional rights, you may submit a request to:
12. CHILDREN
The Services are intended for users who are 18 years of age or older.
Arclasp does not knowingly offer accounts to, solicit personal information directly from, or market the Services to children under 18.
If you believe a child has provided personal information to Arclasp in violation of this Policy, contact us at:
Customers are responsible for ensuring that their own use of Arclasp complies with laws governing children's data.
13. THIRD-PARTY SERVICES
The Services may integrate with or link to third-party services.
Your use of a third-party service is subject to the terms and privacy practices of that provider.
Arclasp is not responsible for the privacy practices of third parties that you independently choose to use.
14. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect changes in:
- the Services;
- our processing activities;
- applicable law;
- operational practices.
The revised version will be identified by an updated “Last updated” date.
Where required by applicable law, we will provide additional notice of material changes.
15. CONTACT US
Arclasp is operated by:
Ansh Pradhan, operating under the name Arclasp
India
Privacy matters:
Legal matters:
General inquiries:
A business correspondence address is available for legitimate legal or business correspondence upon request through legal@arclasp.com.