Privacy Policy

What we collect

• Account data — your email address (used for sign-in and to contact you).
• Scan data — the store/product URLs you submit, and the results we generate (scores, agent journeys, screenshots of the pages our agents visit, the real Grok prompt, response, and fact check when that call runs, and the agent-rails HTTP check: whether a catalog tool answered, whether a profile was valid JSON, and whether a cart link came back). We do not send payment or personal data on that check, and we do not store the cart link.
• Billing data — ARC no longer sells anything. Older accounts may still have Stripe customer identifiers on file; we never saw or stored full card numbers.
• Technical data — basic request logs used to run the service, prevent abuse, and rate-limit free scans. A client IP in those logs is stored only as an HMAC-SHA256 keyed by a server secret. If that secret is not set, the log stores no IP. The raw address is not written.
• Outside MCP calls — a daily count of the tool, the client family, and the store domain checked. We also keep a hashed caller id (an HMAC of the network address, not the raw IP) for 30 days, stored separately from that domain. The raw IP is not kept in this log.
• /api/precheck and /api/ask accept an optional ref / X-ARC-Client label naming the integration or docs snippet, never a user; unknown values are stored as "other"; deleted after 30 days.

How we use it

• To run your scans and deliver results, sign-in links, and (if you opt in) monitoring alerts.
• To operate, secure, and improve the service, and to prevent abuse.

We do not sell your personal data, and we don’t use it for third-party advertising.

Service providers we share data with

We use a small set of processors strictly to run ARC:

• Vercel — hosting and serverless compute.
• Turso (libSQL) — database.
• Vercel Blob — private storage for scan screenshots.
• Stripe — payment records from before ARC became free.
• Resend — transactional email (sign-in links, alerts).
• OpenRouter — large-language-model inference that powers the shopping agents.
• Browserless — the headless browsers the agents drive.

A note on scanning

When you run a scan, our agents browse the URL you provide like a visitor would and capture screenshots of public pages. You must only scan sites you own or are authorized to test (see our Terms). We don’t submit forms, make purchases, or enter payment details.

Retention & your rights

We keep account and scan data while your account is active. You can ask us to access or delete your data at any time by emailing hello@arcreport.ai; we’ll respond within a reasonable period. Deleting your account removes your scans and personal data, except where we must retain records (e.g. for tax/accounting).

Cookies

We use a single essential, signed session cookie to keep you logged in. No advertising or third-party tracking cookies.

We measure site usage with Vercel Web Analytics, which is cookieless: it counts page views and a few button clicks in aggregate and does not identify or follow individual visitors.

We also keep our own funnel counts in our database: the page path, the referring site’s domain, the visitor’s country (a two-letter code from our host, Vercel), and whether a free scan was started, rejected, finished, emailed, or followed into checkout. The same log counts a store check from the homepage box (the domain checked), a search (the query), a dataset download (the file name), and a page view of a store page, the leaderboard, the open dataset, for-agents, or the blog. That log does not store an IP address or user agent and does not use a cookie. An email address or IP address typed into a search is removed before it is saved. Known bots and ARC’s own tools are left out of page views. An email address and store URL are saved with the scan itself, not in the funnel log.

Children

ARC is a business tool not intended for anyone under 18.

Changes

We’ll update this page and the “last updated” date when this policy changes. Material changes will be notified by email where appropriate.