Arconite Works Privacy Notice

1. Who is responsible

Arconite Intelligence Ltda, CNPJ (Brazilian corporate taxpayer number) 61.586.611/0001-58, referred to in this notice as Arconite, is responsible for decisions about Works data processing. The privacy contact is dpo@arconite.co. For help using Works, contact help@arconite.co.

2. Data we process

Works may process:

• your Google account identifier, verified email, name, and profile picture received at sign-in;
• your internal Works identifier, tier, session records, and security records;
• for commercial operations, billing identity and contact, CPF/CNPJ tax identifier and address only when needed, contract and payment references, amounts, status, receipts and tax documents, refunds, disputes, credit lots, measurements and authorizations; the ledger and accounting records use references and the minimum technical data needed, without full card numbers;
• prompts, responses, titles, drafts, files, and metadata needed for conversation history;
• limited technical data, such as time, IP address, browser agent, failures, and request identifiers;
• Talks, Library and Memory data after the single acceptance in Accounts, subject to current capability grants and account, Space and resource permissions;
• the selected response, reason, and note you voluntarily submit when reporting content, for safety review by Works; other messages and files are not automatically included.
• on your device, the browser or app stores conversation history, drafts, and preferences locally to work and synchronize; this data stays on the device until the app or you remove it.

3. Purposes and legal grounds

We process data to authenticate users, provide and maintain the service, generate responses, synchronize history, prevent abuse, secure accounts, diagnose failures, manage payments, refunds, disputes and tax invoicing, comply with law, and answer requests.

Depending on context and applicable law, processing may rely on performance of a contract, requested pre-contract steps, legitimate interests with safeguards, legal compliance, the exercise of rights, or consent where required.

4. Providers and sharing

We use Arconite Accounts and its providers, including Google when you sign in with Google, for authentication; Supabase for the Works database; Vercel for hosting and compute and the Vercel AI Gateway to route response requests, with OpenRouter as an alternative route; AI model providers such as Google, OpenAI, and Anthropic, reached through these gateways to generate responses; and Arconite Cloud for Talks, Library, Memory, and authorized Spaces. Memory receives text messages to evaluate and save useful information and personalize future answers.

Library files are stored in Google Cloud Storage. When Web search is on, Arconite Cloud sends queries derived from the conversation to the Exa search provider. If you connect a GitHub integration in Creations, the data that integration needs is exchanged with GitHub.

When contracted and needed for the operation, Stripe processes payments and Contabilizei provides Brazilian service tax invoicing (NFS-e), bookkeeping and tax services. We send these providers only necessary billing/fiscal data, never prompts, responses, audio, file contents or personal memory.

We share only the data needed for each purpose under applicable contracts and controls. We do not sell personal data. Content sent to models may be processed under the applicable provider configuration and terms.

5. International transfers

The Works database is in Brazil (Supabase, São Paulo region, sa-east-1) and Works server functions run in São Paulo. AI model providers, gateways, Web search, file storage, and other providers may process data outside Brazil.

Where an international transfer occurs, we seek the mechanisms and safeguards required by applicable law and limit data to the service purpose.

6. Retention and deletion

We keep profile, tier, and history according to their purpose, applicable content-retention periods and valid deletion requests. Security records and residual data may be kept longer as necessary for fraud prevention, legal obligations, the exercise of rights, and technical recovery.

Request deletion of your Works account and data in Settings → Account or at /account-deletion, on the web and Android. The request blocks access and starts removal of private Works data. Your Arconite Accounts identity and content shared with other people are preserved; local display-name copies are minimized.

The receipt separately shows Works data, processing by the Talks, Library and Memory providers, session revocation and retention review. Operator evidence is not Cloud verification. Pending work is never reported as complete deletion. Preserve this browser cookie or the app’s protected storage to recover the receipt; without that proof, contact the privacy channel for separate verification.

Deletion requests are evaluated and carried out as required by law. Protected backups may be deleted in later cycles and are not used for ordinary operations while awaiting expiration.

Report evidence has restricted access and encrypted storage, with a defined expiry for review. Minimal receipt and handling records may remain for security and accountability. The privacy contact provides the applicable periods and accepts requests about this information.

Minimal tax and financial records are kept separately from content, with restricted access. Operational retention is five complete fiscal years after the reference year, with additional retention while outstanding obligations or documented fiscal, accounting or judicial holds require it. Deletion or minimization is assessed when retention is no longer needed. This does not extend content retention or permit response personalization.

When these offers are available and contracted, content reading/export, archival and deletion periods for trial, paid coverage and the prepaid operational envelope follow the v4 commercial conditions at https://works.arconite.co/billing-terms. They are separate from financial retention.

Periods the service already applies: the temporary copy used to run a response generation is deleted from the server 24 hours after it finishes; report evidence and response feedback notes expire after the configured review period, between 7 and 365 days; deleted Creations apps are permanently removed 30 days after deletion.

7. Your rights

You may request confirmation of processing, access, correction, portability where applicable, sharing information, review of automated decisions in legally protected cases, objection, restriction, anonymization or deletion where available, and withdrawal of consent.

Send requests to dpo@arconite.co. We may request proportionate information to verify identity and protect the account before fulfilling a request.

8. Security

We apply technical and organizational controls proportionate to risk, including protected sessions, server-only credentials, account partitioning, and blocking Cloud features without a linked identity. No system is completely secure; report suspected issues through the contact channel.

9. Children and teenagers

Works is not directed to children. If a minor's use requires guardian consent or supervision under applicable law, that requirement must be met before use.

10. Changes

We may update this notice to reflect service or legal changes. Material changes will be communicated appropriately. The displayed version identifies the current text.