Legal
Privacy Policy
Effective October 27, 2026
This policy explains what personal data we process when you use Archon, why, and the choices and rights you have.
1. Who we are and our role
Archon, Startups Valley TBI, Kanjirappally, Kerala, India ("we") runs joinarchon.com, app.joinarchon.com and the Archon apps, APIs and hosting (the "Service").
- Controller. We decide how and why we process data about account holders, website visitors, people who contact us and billing contacts. This policy describes that processing.
- Processor. For content a customer puts into a workspace (code, prompts, session messages, files, app data, and personal data in them) we act on the customer's behalf under our Data Processing Agreement. The customer is the controller; please contact them first about that data.
- Paddle. Paddle.com Market Ltd is our reseller and merchant of record. Paddle is an independent controller of the payment, tax and address data it collects at checkout; see the Paddle Privacy Notice.
2. What we collect, why and our legal basis
| Data | Why | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Account: name, email, password hash, two-factor settings, sign-in provider id, profile picture, time zone, terms acceptance time and version | Create and secure your account, sign you in | Contract (art. 6(1)(b)); legitimate interest in security (art. 6(1)(f)) |
| Workspace and session content: messages, agent output, code, files, tasks, approvals | Provide the Service you asked for | Contract; as processor for customer content |
| Usage and billing records: compute, storage and model usage, plan, spend limit, invoices (no card numbers; Paddle holds those) | Bill you correctly, enforce limits | Contract; legal obligation (art. 6(1)(c)) for tax records |
| Security and audit records: IP address, browser, sign-in times, the country and region our network reports, actions taken | Protect accounts, investigate abuse, keep an audit trail customers rely on, comply with sanctions law | Legitimate interest; legal obligation |
| Support, abuse and legal requests: what you send us | Answer you, act on reports, keep a record of decisions | Legitimate interest; legal obligation (EU Digital Services Act) |
| Product email: notices about your account, usage warnings, changes to terms or prices | Run the Service | Contract; legitimate interest |
3. AI processing
Agents and Archon's assistant send the parts of a session they need (for example your request, relevant code and tool results) to an AI model to produce a reply. Messages written by AI are labelled as AI in the product.
- When Archon pays for the model, requests go through OpenRouter, Inc., which routes them to a model provider. We instruct OpenRouter to use only providers that do not store or train on prompts (
data_collection: deny). Model providers may keep data briefly for abuse monitoring under their own terms. - When you connect your own model key or provider, data goes to that provider under your agreement with it.
- Agents that run on your own device or in your cloud account process data there; we receive only what they post to the session.
- We do not use your content to train AI models, and we do not make decisions with legal or similarly significant effects about you solely by automated means.
4. Google user data
If you connect Google Drive under Connections, Archon asks Google for one permission: drive.file, which lets Archon create and edit files that Archon creates, or that you open with Archon. It does not give Archon access to the rest of your Drive. You choose to connect, and you can disconnect at any time.
- Use. When you or an agent in your workspace asks, Archon reads, creates or edits only those files, through Google's Drive API, to answer that request. Archon does not use Drive data for anything else.
- Storage. We store the Google access and refresh tokens, encrypted, so the connection keeps working. File content that an agent reads becomes part of that session, under the retention in section 7.
- Sharing. File content is sent to the AI model you or your workspace use for the session (section 3) only to produce the reply you asked for. We do not sell Google user data or use it for advertising, and we do not train AI models on it.
- Revoking. Disconnect Google Drive under Connections, which asks Google to revoke the token and deletes it from Archon, or remove Archon at myaccount.google.com/permissions.
Archon's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Who we share data with
We use service providers (sub-processors) to host and run the Service, listed with their purpose and location on our Subprocessors page. They may use the data only to provide their service to us. We also share data when you ask us to (integrations you connect), with Paddle for billing, with professional advisers, when required by law or to protect rights and safety, and with a buyer if our business is sold (with notice to you). We do not sell personal data and we do not share it for cross-context behavioural advertising.
6. International transfers
Our hosting runs in Australia (AWS Sydney) today, with India (Mumbai) planned; our web app is served by Vercel and Cloudflare from many countries; some providers are in the United States. When personal data from the EEA, the UK or Switzerland goes to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), the UK International Data Transfer Addendum, or a provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards at privacy@joinarchon.com.
7. How long we keep data
| Data | Kept for |
|---|---|
| Account data | While the account exists; deleted when you delete the account, except as below |
| Workspace and session content | Until the workspace or content is deleted by the customer |
| Audit log | At least 365 days (a workspace can choose longer), then deleted |
| Service and security logs | 180 days |
| Data of apps paused for non-payment | 30 days after the apps are paused, then deleted |
| Billing and tax records | As long as tax and accounting law requires (typically 6 to 10 years) |
| Backups | Overwritten on a rolling schedule; deleted data leaves backups within 1 day |
| Abuse reports and decisions | As long as needed to handle the report and any appeal, and at least as long as the audit log |
8. Your rights
Depending on where you live, you can ask to access, correct, delete or port your data, to restrict or object to processing, and to withdraw consent. You can export your data yourself in account settings → Danger zone → Export my data, and delete your account there. Otherwise email privacy@joinarchon.com. We answer within one month (GDPR), 45 days (California) or the time your law sets, and will not discriminate against you for using your rights. We may need to verify your identity. An authorised agent may act for you with proof of authority.
- EEA and UK. You can complain to your data protection authority, in the UK the Information Commissioner's Office.
- California (CCPA / CPRA). You have the rights to know, delete, correct, and opt out of sale or sharing, and to limit use of sensitive personal information. We do not sell or share personal information and use sensitive information (account credentials) only to provide the Service. The categories we collect are those in section 2, from you, your workspace and our providers.
- India (Digital Personal Data Protection Act, 2023). You can access, correct and erase your data, nominate someone to act for you, and raise a grievance by emailing privacy@joinarchon.com. We respond within the time the law sets. If unresolved, you may complain to the Data Protection Board of India.
- Australia (Privacy Act 1988). You can access and correct your data and complain to us; if unresolved, to the Office of the Australian Information Commissioner.
9. Cookies
We use only cookies and local storage that are strictly necessary: to keep you signed in, protect sign-in against forgery, and remember display preferences such as theme. We do not use advertising or cross-site tracking cookies, so we do not show a consent banner. If we add optional analytics, we will ask first where the law requires it. Paddle's checkout sets its own cookies when you pay.
10. Children
The Service is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us data, email privacy@joinarchon.com and we will delete it.
11. Security and breach notice
We use encryption in transit, hashed passwords and tokens, encrypted secrets, access controls, two-factor sign-in and an audit log. See our Security page. If a breach affects your personal data, we will notify you and the authorities as the law requires, for example within 72 hours to the supervisory authority under GDPR art. 33, and to affected customers without undue delay.
12. Changes
We will post changes here with a new effective date and email account owners about material changes before they take effect.
13. Contact
Archon, Startups Valley TBI, Kanjirappally, Kerala, India. Privacy questions and requests: privacy@joinarchon.com.