ArcheVault Privacy Policy

1. Introduction

This Privacy Policy explains how Aurinko collects, uses, stores, discloses and otherwise processes information when you visit archevault.com, access the ArcheVault application, participate in a demonstration or evaluation, or communicate with us about our services.

ArcheVault is a data engineering platform that helps organisations ingest data from supported sources, profile and classify data, discover schemas, generate Data Vault 2.0 structures, process data and maintain associated processing information.

This Policy should be read with any applicable customer agreement, order form or data processing agreement (“DPA”). Where a signed agreement establishes specific data-handling terms for a customer, that agreement will govern to the extent stated in it.

2. Our role and customer responsibilities

Depending on the activity, Aurinko may process information about website visitors, prospective customers, account users and customer personnel for its own business purposes.

When a customer connects a data source or submits datasets for processing through ArcheVault, that customer generally determines the purposes for which the source data is processed. The customer is responsible for ensuring that it has the necessary rights, permissions and lawful basis to provide that data to ArcheVault and to authorise any associated processing.

Aurinko processes customer-provided data to deliver, operate, secure and support the service, subject to the applicable customer agreement. The precise legal roles of Aurinko and the customer depend on the relevant processing activity and applicable law.

3. Information we process

The categories of information may include:

A. Account and user information

• Name, work email address, organisation, username and authentication-related information.
• User roles, permissions, organisation identifiers and account administration records.
• Support requests and communications.

B. Source data and uploaded files

Depending on the connector and workflow used, customers may provide files or data from connected systems, including CSV, JSON, Parquet, Excel and supported database or object-storage sources. Such data may contain personal information, commercially confidential information or other regulated information.

C. Data-processing artefacts

ArcheVault may create or process:

• Column names, data types, schemas and data profiles.
• Classification labels, confidence scores and schema-discovery results.
• Source identifiers, filenames, processing-run identifiers and execution status.
• Temporary processing data and Parquet checkpoints used to support pipeline execution and resumability.
• Generated schema definitions, SQL/DDL and Data Vault structures.
• Processing, diagnostic and agent-decision information.

D. Technical and operational information

We may process information such as IP addresses, timestamps, request details, application errors, security events and service-usage records where generated or collected by the service.

E. Website and enquiry information

If you contact us, request a demonstration or submit a website form, we may process the details you provide and related enquiry information. Website forms and communication tools may be operated through third-party providers.

4. How ArcheVault processes customer data

To provide its data engineering functionality, ArcheVault may read source records, sample values, profile datasets, infer data types, classify columns, generate schemas and transform or load records into a configured destination.

Customers should not assume that source data is processed exclusively within their own infrastructure or that every source-data copy is automatically deleted within a fixed period unless that commitment is expressly documented in their signed agreement.

5. AI-assisted classification and third-party services

ArcheVault uses AWS Bedrock to access Anthropic Claude models for certain AI-assisted data-classification and related processing tasks.

As part of these tasks, the service may transmit column names, data types, dataset context and sampled source values to the AI service. Sampled values may contain personal information or confidential business data if those values exist in the source dataset. We do not represent that all sample values are automatically masked or anonymised before transmission.

Customers must ensure they are authorised to use this functionality with the data submitted. Until an applicable customer agreement or product setting confirms otherwise, customers should not assume that AI-assisted classification can be configured to exclude all raw sample values.

We also use third-party providers to support infrastructure, notifications and website enquiries. Based on the current implementation reviewed, these include Amazon Web Services (including Amazon S3, Amazon RDS, AWS Bedrock and Amazon SES) and Google services used for certain enquiry or form workflows. Other providers may be used as the service evolves. The providers actually used for a particular customer, the purposes for which they are used, and their relevant terms should be confirmed in the applicable subprocessor list or customer agreement.

6. Why we use information

We may process information to:

• Provide and operate ArcheVault and its features.
• Authenticate users and administer accounts and permissions.
• Ingest, profile, classify, model, transform and load customer data as configured.
• Maintain pipeline state, checkpoints, execution records, schema information and processing history.
• Respond to support requests and customer enquiries.
• Monitor, troubleshoot and improve service reliability and security.
• Detect, investigate and respond to misuse, unauthorised access, fraud and security incidents.
• Meet applicable legal obligations and enforce our agreements.

We will not describe information as being used only for a particular purpose if the actual processing or applicable agreement permits other uses.

7. Storage, retention and deletion

We retain information for as long as reasonably necessary for the relevant service, contractual, operational, security or legal purpose, subject to applicable agreements and law.

Retention can differ by information type. Source files, uploads, temporary processing artefacts, Parquet checkpoints, account records, classification results, execution metadata, diagnostic information and audit records may be stored in different locations and may follow different deletion processes.

When deletion is requested or an account or service is terminated, we will handle the request in accordance with the applicable customer agreement, available service functionality and applicable law. Deletion may require separate handling for source files, checkpoints, database records, exports, backups and records that must be retained for legitimate legal or security purposes. We will not claim that every copy has been deleted until the relevant deletion process has been verified.

Customers should contact [email protected] for data access, correction or deletion requests, or for questions about the retention arrangements applicable to their deployment.

8. Security

We use technical and organisational measures intended to protect information processed through our services. The controls applicable to a particular deployment depend on its architecture, configuration and service agreement.

No online service or storage system can be represented as risk-free. Customers should review the security information and deployment arrangements applicable to their use of ArcheVault before submitting sensitive data.

We do not claim in this Policy that every deployment has per-customer encryption keys, immutable write-once audit logs, SAML/OIDC single sign-on, a fixed security certification, or a particular uptime guarantee unless that control or commitment is confirmed in the applicable agreement.

9. Disclosure and sharing

We may disclose information:

• To infrastructure and service providers that support the service.
• To personnel and authorised contractors who require access for their assigned duties.
• At a customer's direction or as necessary to deliver a configured integration or destination.
• When required by law, court order or a competent authority.
• Where reasonably necessary to investigate misuse, protect users or the service, or establish, exercise or defend legal claims.
• In connection with a corporate restructuring or transaction, subject to applicable confidentiality and legal requirements.

We do not sell personal information to third parties in exchange for money. This statement does not prevent the service providers described in this Policy from processing information on our behalf to deliver the service.

10. International processing

Aurinko and its service providers may process information in more than one country, depending on the service, region, configuration and applicable provider routing.

The current codebase investigation identified AWS Bedrock model identifiers configured for global inference. Accordingly, we do not promise that AI-assisted processing is confined to India or to the AWS region in which the application is deployed.

Customers with data-localisation, sector-specific or cross-border transfer requirements should not submit affected data until the applicable processing locations and transfer arrangements have been confirmed in writing.

11. Your rights and choices

Depending on applicable law and the nature of our role, individuals may have rights relating to access, correction, erasure, grievance redressal, consent withdrawal or other personal-data matters.

Where Aurinko processes information on behalf of a customer, requests relating to the customer's source data may need to be directed to that customer. We will provide reasonable assistance as required by the applicable agreement and law.

To raise a privacy request or complaint, contact [email protected]. Please include sufficient information for us to understand and route your request without sending unnecessary sensitive data.

12. Children's information

ArcheVault is intended for organisational and professional use, not for children. Customers must not submit children's personal data unless the processing is authorised, appropriate safeguards are in place and the applicable agreement permits it.

13. Changes to this Policy

We may update this Policy as our services, practices or legal obligations change. We will post the updated version with a revised “Last updated” date. Where required by law or contract, we will provide additional notice.

14. Contact