Privacy Notice

The data controller for personal information collected through arcanflows.com is Windconsul Tech LLC, 759 Hadley Ln NE, Marietta, GA 30068, United States. Privacy and data-protection requests: [email protected]. Arcanflows ("we", "us") is a product of Windconsul Tech LLC and operates the Arcanflows platform: AI agents, workflows, forms, data tables, apps, voice and video tooling. This notice explains what we do with personal data when you use the platform, and applies alongside our Terms of Service. Two roles. For your own account data we act as the data controller (responsable). For the content you put into the platform — the documents you upload, the conversations your agents hold with your customers — we act as a data processor (encargado) on your behalf. You decide what goes in and why; we process it to run the service you asked for.

Account data. Name, email address, password hash, organization, role, and multi-factor authentication settings. Usage and billing data. Metered consumption across the platform's eight buckets — tokens, images, audio, voice minutes, storage and related counters — plus subscription and invoice records. Content you provide. Prompts, uploaded documents and knowledge-base files, form submissions, data-table rows, conversation history, and any credentials you store in the vault. Communications data. Where you enable them: chat transcripts, email sent through the platform, and — for phone agents — call metadata, and call recordings only where you have enabled recording and obtained the consent your jurisdiction requires. Technical data. IP address, browser and device information, authentication events, and security and audit logs. We do not intentionally collect special-category data (health, biometrics, political opinions and similar). Do not upload it unless you have a lawful basis and have configured the platform appropriately.

We do not sell personal data. We share it only with the sub-processors needed to deliver the features you use:

• AI model providers — OpenAI, Anthropic, Google, Mistral, Cohere, xAI and Alibaba, depending on which models you enable. Prompts and the content they need are sent to the provider you select. Self-hosted models (Ollama and compatible backends) keep that data inside your infrastructure.

• Payments — Stripe, for subscriptions and invoicing. We do not store card numbers.

• Telephony and real-time media — Twilio and LiveKit, where phone or voice agents are enabled.

• Email delivery — SendGrid or your configured SMTP server.

• Storage — S3-compatible object storage for files you upload.

• Security and delivery — Cloudflare, including Turnstile for bot protection.

• Search — where an agent uses web search, the query is sent to the configured search provider.

We also disclose data where the law requires it, and to protect the rights and safety of users and the public. We do not use your content to train our own models. When you route requests to a third-party model, that provider's terms govern what they do with it — review the policies of the providers you enable.

• Credentials stored in the vault are encrypted at rest with AES-256-GCM.

• Traffic is encrypted in transit with TLS.

• Access is controlled by role and by granular permissions, with optional multi-factor authentication.

• Each organization's data is isolated by tenant, and access is scoped to that tenant on every request.

• Platform-level AI guardrails screen for prompt injection, credential leakage and requests aimed at internal infrastructure.

• Authentication and administrative actions are recorded in audit logs.

No system is perfectly secure. We cannot guarantee absolute security, and we will notify affected users and regulators of a personal-data breach as required by applicable law.

• Account data — for the life of the account, and afterwards only as long as needed for legal, tax or accounting obligations.

• Your content — until you delete it. Deleted items may sit in trash for a recovery window before permanent removal.

• Conversation history — until deleted by you or by your organization's retention settings.

• Call recordings — per the retention policy you configure on the agent.

• Security and audit logs — retained for a limited period for security and troubleshooting.

• Backups — encrypted backups may retain data for a short period after deletion, then age out.

Mexico (LFPDPPP) — ARCO rights. You may request Access to your personal data, Rectification of inaccurate data, Cancellation (deletion), or you may Oppose specific processing. You may also revoke consent you previously gave. California (CCPA/CPRA). You may request disclosure of the categories and specific pieces of personal information we hold, request deletion, request correction, and opt out of any sale or sharing of personal information. We do not sell personal information. You will not be discriminated against for exercising these rights. Other jurisdictions. Where the GDPR or a US state privacy law applies, you have equivalent rights of access, correction, deletion, portability, restriction and objection, and the right to lodge a complaint with your supervisory authority. To exercise any of these, email [email protected]. We will verify your identity before acting, and respond within the period the applicable law requires. If you are an end user of a customer's agent, contact that organization first — they control that data and we act on their instructions.

Data may be processed on servers in the United States or other jurisdictions, and the AI model providers you enable may process it in their own regions. Where required, transfers are made under appropriate safeguards. If you need data to stay within a specific jurisdiction, use self-hosted models and a deployment in that region.

We use cookies and browser storage for what the product needs to work: keeping you signed in, remembering your theme and interface preferences, and bot protection on sign-up and sign-in. We do not use advertising cookies. Blocking essential cookies will prevent you from signing in.

The platform is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.

We will update this notice as the platform changes. Material changes will be announced in the product or by email, and the "last updated" date above will change. Continuing to use the platform after an update means you accept the revised notice.

Arcanflows Privacy and data protection: [email protected] ARCO requests (Mexico): [email protected] CCPA requests (California): [email protected] Legal: [email protected]