Privacy Policy

1. Who we are

Arckium is a CMMS (Computerized Maintenance Management System) platform developed and operated by Arcana Soft. Registered address: Avenue Habib Bourguiba, Bir Mchergua, Zaghouan 1141, Tunisia. Tax registration number: 1815896P.

2. Data we collect

We collect data necessary to provide the Arckium platform. This includes:

• Account data: name, work email address, job title, and company name provided during registration.
• Usage data: actions performed within the platform, feature usage patterns, and session timestamps, used for product improvement and support.
• Operational data: work orders, asset records, inventory movements, and maintenance logs created by your team while using Arckium.
• Technical data: IP addresses, browser type, and device identifiers collected automatically for security and reliability purposes.

3. How we use your data

We use collected data to:

• Provide, maintain, and improve the Arckium platform.
• Authenticate users and enforce access controls.
• Send transactional communications (work order notifications, system alerts, account changes).
• Provide customer support and troubleshoot technical issues.
• Comply with legal obligations.

We do not sell your data to third parties. We do not use your operational maintenance data for training AI models without explicit consent.

4. Data storage and security

Each customer's data is scoped to their property and organisation. Every authenticated request resolves a tenant context, and queries are constrained to that tenant by server-side guards before they reach the database. Cross-property access requires an organisation-admin role.

Traffic to the platform is served over TLS. Credentials we hold on your behalf, meaning SMTP passwords, PMS client secrets and push notification signing keys, are encrypted in the database with AES-256-GCM under a key supplied by environment configuration and held outside the database. Disk-level encryption at rest and network configuration are provided by our hosting platform; we provide those details, and the identity of the provider, under NDA during procurement.

Access to production systems is restricted to authorised personnel. Security-relevant actions write to an append-only audit log.

5. Sub-processors

We use a small number of third-party processors to deliver the Service. Each processes data only on our documented instructions.

• Mistral AI: AI dispatch, work-order analysis and report summarisation. Receives the work-order text submitted for analysis.
• Google reCAPTCHA: bot protection on public forms on this website. Receives visitor IP address and browser signals.
• Calendly: demo scheduling. Receives the name and email of people who book a demo.
• Transactional email provider: work-order notifications, escalations and account messages.
• Cloud hosting and database provider: application hosting and data storage.

We maintain a current sub-processor list naming each provider and its processing location, and notify customers of additions before they take effect. Request the version applicable to your contract at contact@arcana-soft.com.

6. International data transfers

Arcana Soft is established in Tunisia. If you are in the European Economic Area or the United Kingdom, providing the Service involves transferring personal data outside that area.

Tunisia is not currently the subject of a European Commission adequacy decision. These transfers therefore rely on Standard Contractual Clauses together with a transfer impact assessment, both provided as part of our data processing agreement.

The hosting region for your tenant is set at provisioning and recorded in your service agreement. Tell us before signature if you require a specific region.

7. Data retention

Operational data (work orders, asset records, audit logs) is retained for the lifetime of your subscription plus 90 days after termination, during which you may export your data. After 90 days, data is permanently deleted.

Account data is retained for as long as your account is active. You may request deletion at any time by contacting contact@arcana-soft.com.

8. Your rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data. To exercise any of these rights, contact us at contact@arcana-soft.com. We respond within 30 days.

9. Cookies

Arckium uses session cookies required for authentication and preference storage. We do not use third-party advertising cookies. Analytics cookies (if used) are disclosed in the cookie consent banner and can be rejected without losing platform functionality.

10. Business transfers and change of control

If Arcana Soft is involved in a merger, acquisition or sale of assets, your data may transfer to the acquiring entity. We will notify you before your data becomes subject to a different privacy policy, and the retention and deletion rights described above continue to apply.

If we cease operating the Service, section 2 of the Terms of Service applies: at least 90 days' notice, during which you may export your operational data in full.

11. Contact

For privacy-related questions, data requests, or to report a concern, contact our data protection team at: