Privacy Policy

1. Data Controller

Arcamatrix is the data controller. Contact: support@arcamatrix.com

2. Data We Collect

• Account data: email address, hashed password
• Usage data: token consumption, session metadata
• Payment data: processed by Stripe (we do not store card details)
• Analytics: anonymous usage via PostHog (opt-in via cookie consent)
• Connected social accounts: when you link TikTok, YouTube, Instagram, or X, we store an encrypted OAuth access token plus your public account identifier (handle, display name, avatar) to confirm which account is connected

3. Legal Basis (GDPR Art. 6)

• Contract performance: account, billing, service delivery
• Consent: analytics cookies (revocable at any time)
• Legitimate interest: security monitoring, fraud prevention

4. Data Storage

All data is stored on EU-based infrastructure (Hetzner, Helsinki/Falkenstein, Germany). No data is transferred outside the EU/EEA.

5. Data Retention

Account data is retained while your account is active. Upon deletion, all personal data is removed within 30 days. Chat logs and AI-generated content are purged immediately.

6. Your Rights (GDPR Art. 15-22)

• Access: request a copy of your data
• Rectification: correct inaccurate data
• Erasure: delete your account and all associated data
• Portability: export your data in machine-readable format
• Objection: opt out of analytics processing

Exercise your rights via the GDPR section in your account settings or by emailing us.

7. Cookies

We use essential cookies (session, CSRF) and optional analytics cookies (PostHog). Analytics cookies are only set after explicit consent via our cookie banner.

8. Third-Party Processors

• Stripe (payments) — US, EU SCCs
• Brevo (transactional email) — EU
• Sentry (error tracking) — US, EU-US Data Privacy Framework certified; opt-in via cookie banner
• PostHog (analytics, opt-in) — EU
• TikTok, YouTube (Google), Instagram (Meta), and X — only when you connect that account, to publish videos you approve via the platform’s authorized OAuth API

9. Connected Social Accounts & Publishing

Arcamatrix lets you connect your own social accounts — TikTok, YouTube, Instagram, and X — to publish videos you create on Arcamatrix directly to your own account. Each connection is initiated by you through the platform’s official OAuth flow.

• What we access: a basic profile (for TikTok, the user.info.basic scope — display name and avatar) only to show you which account is connected, and a publishing permission (for TikTok, the video.publish scope) used only to post a video you have explicitly approved.
• What we do not access: we do not read your existing posts, followers, direct messages, or analytics, and we never post anything without your explicit action.
• What we store: only an encrypted OAuth token and your public account identifier. We do not keep a copy of the video after it has been sent to the platform.
• Revoking access: you can disconnect a platform at any time in Settings → Integrations, which deletes the stored token; you can also revoke access from the platform itself (for TikTok: Settings → Security & permissions → Manage app permissions). Deleting your Arcamatrix account removes all stored tokens.

Once published, your content is also governed by that platform’s own terms and privacy policy (for example, the TikTok Privacy Policy).

10. Contact

Data protection inquiries: support@arcamatrix.com