Privacy Policy

Arkrel is a product of Conecta Media LLC, an Illinois limited liability company ("Arkrel", "we", "us"). This Privacy Policy explains what information we collect when you use the Arkrel website, dashboard, and API (the "Service"), why we collect it, who we share it with, and the controls you have over it, including deleting your account and exporting your data yourself, at any time, described in full below.

1. Information We Collect

Account information. When you sign up, we collect your email address, organization name, and the way you chose to sign in: a password (stored only as a salted, irreversible hash we cannot read), a passkey's public key, or an identifier from Google if you sign in that way when the provider is configured. Accounts with a password must enable an authenticator app (TOTP) before checkout, exports, sharing, connections, or account changes. The free first statement is available after email verification. Accounts without a password keep their existing protection rules. For authenticator setup, we store a TOTP secret and encrypted backup codes.

Documents you send us. The files you upload or send to the API, and the data we extract from them, are processed to provide the Service. See Section 4 below for how this is treated differently from other data.

Usage and billing data. We record how many pages you process, which endpoints you call, and timestamps, for the purpose of enforcing plan limits, showing you usage in the dashboard, and billing overage. Payment details (card numbers, etc.) are collected and stored by Stripe, our payment processor; we do not store full card numbers ourselves.

Technical data. Standard web server logs (IP address, browser type, pages visited) for the marketing site and dashboard, used for security and troubleshooting.

2. How We Use Information

We use the information above to: provide and operate the Service; verify and process the documents you send us; enforce plan quotas and bill for usage; send you service emails (email verification, password reset, security notices, receipts, webhook failure notices, and similar); respond to support requests; and detect and prevent abuse of the Service.

We do not use your documents or extracted data to train machine learning models. We do not sell your personal information.

3. How We Share Information

We never sell your personal information or your documents, to anyone, for any reason.

We share information with the subprocessors listed on our Subprocessors page, each of which is bound by a written agreement to protect it and to use it only to provide services to us. As of this policy's date, those are Cloudflare, Inc. (application hosting, the database, file storage, and, only as an automated fallback when our own extraction service is briefly unavailable, Workers AI extraction), Stripe, Inc. (payment processing), and Resend (transactional email delivery). Document extraction itself is performed on Conecta Media LLC's own GPU servers, not by a third-party AI vendor, except for that fallback path. For optional bank connections, Plaid, Inc. processes the connection and provides account details, transaction activity and statement PDFs you authorize us to receive. Bank sign-in takes place through Plaid or your bank. We store an encrypted access token, account names and masks, transaction dates, descriptions and amounts, and statement identifiers and dates. We do not receive or store your bank password.

Cloudflare Workers AI does not use data sent to it to train models (see developers.cloudflare.com/workers-ai/platform/data-usage/), and neither do we: your documents and extracted data are never used to train machine learning models, ours or anyone else's.

We may also disclose information if required by law, or to protect the rights, property, or safety of Conecta Media LLC, our customers, or others.

4. Documents and Extracted Data

Every organization's documents and results are isolated from every other organization at the database level; one customer's data is never visible to another. Documents and results are deleted automatically 30 days after processing by default. Paid plans can configure a retention window from 1 to 90 days. You can delete any document immediately from the dashboard or API at any time.

Bank-imported statement PDFs and their extracted results follow the same document retention window. Account details and transaction activity remain while the connection is saved. Disconnect stops access through Plaid and removes the connection, recent activity and imported statement documents. Only a statement receipt remains, containing the statement identity, dates, import and removal record, so the same statement is not downloaded or charged again. Connections retired when a plan or entitlement ends have no Disconnect control. For these retired connections, imported statements stay in Documents under the same retention setting as uploads after bank access ends. You can delete them from Documents. Statement receipts are kept until account deletion. Historical page usage remains in billing records. If Plaid is temporarily unavailable, removal stays pending and retries automatically. Account deletion also removes connected Items at Plaid before local cleanup completes. Plaid's own handling of data is described in its privacy policy.

5. Deleting Your Account and Exporting Your Data

You can delete your account yourself, at any time, from Settings in the dashboard, with no need to contact us. If you are the only member of your organization, deletion removes: your documents, extraction results, transactions, categorization data, rules, tax-year data, share links, API keys, and webhooks. Any active subscription is canceled immediately. Access ends immediately. If a refund for that business is still being processed, we finish it first and then delete everything, automatically. If you are part of a team, an owner alongside other members must transfer ownership or delete the organization first; a member can leave and delete their own account without affecting the rest of the team's data. We keep a minimal record that a deletion happened (a one-way fingerprint of the organization's id, a document count, and the date), without your name or email. We retain the AppSumo redemption ledger. For any historical accounting postings, we retain provider object identifiers to prevent duplicates. Live QuickBooks and Xero connections are not currently offered. We retain a Stripe card fingerprint and its trial-use record for historical Autopilot trial records across accounts. This record contains no card number, name or email. We keep payment and refund identifiers, card fingerprints, refund-request history, and final outcomes to apply the automatic refund rule across purchases. Stripe retains its own payment records. Deleted data is removed from our live system as cleanup completes, and from every backup copy within 30 days.

You can also download all of your data yourself, at any time, from Settings: a file containing your original uploaded documents, extraction results, transactions with their categories, your rules, and your tax reports.

6. Data Location and Security

Data is stored using Cloudflare's global infrastructure (D1 for structured data, R2 for file storage) and processed on Conecta Media LLC's own GPU servers. See our Security Overview for more detail on how we protect data in transit and at rest.

7. Cookies

The dashboard sets a session cookie, strictly necessary to sign you in and keep you signed in; it is not used for advertising or cross-site tracking, and we do not use any third-party analytics or advertising cookies.

We also save first-visit source information in the first-party `arkrel_first_touch` cookie for up to 30 days: the referring website's origin (without its path or query), and the `utm_source`, `utm_medium`, and `utm_campaign` campaign labels on the landing URL. We attach this information to your account and organization when you sign up so we can understand which channels bring customers to Arkrel. It is visible only in our authenticated owner operations report, is not shared with advertising networks, and is deleted with your account and organization. Your browser's cookie controls can prevent storage.

• The session cookie (`__Host-arkrel_session` when you're on

`arkrel.com`): proves you're signed in. HttpOnly (not readable by page scripts), Secure, SameSite=Lax, and lasts up to 30 days, refreshed while you're active.

If you turn on "trust this device," a second cookie remembers that choice for up to 30 days so we don't ask for a two-factor code again on that device in the meantime.

Email sign-up and the free tools at arkrel.com/tools use the Cloudflare Turnstile widget to tell a real visitor from a bot before creating an account or processing a document; Turnstile may set its own cookies in your browser under Cloudflare's own privacy policy. We do not control what Turnstile stores.

8. Your Rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information. You can do all of this yourself, at any time, from the dashboard, as described in Section 5 above, or email support@arkrel.com if you'd rather we handle a request for you. If you are located in the European Economic Area, the United Kingdom, or Switzerland, see our Data Processing Addendum for how we handle personal data you submit to us as a processor.

9. Data Retention

Account and billing records are kept for as long as your account is active and for a reasonable period after closure to comply with tax, accounting, and legal obligations. Document content and extraction results follow the retention window described in Section 4; deleting your account follows Section 5.

10. Children's Privacy

The Service is intended for business use and is not directed to children. We do not knowingly collect personal information from anyone under 16.

11. Changes to This Policy

If we make a material change to this policy, we will notify account owners by email and update the "Last updated" date above.

12. Contact

Questions about this policy, or requests relating to your personal information, can be sent to support@arkrel.com.

Multiple Businesses

One login can create and belong to multiple businesses. Each business has its own books, reports, billing, email-in address, API keys, share links and bank connections. The free statement allowance is per person across all businesses.

In Settings, you can delete a business where you are its sole owner and member, or leave a business if another owner remains. Your login and other businesses stay available. To remove your only business, use account deletion. Whole-account deletion covers every business where you are the sole member and removes your memberships in other businesses, subject to the ownership requirements above.

Data export creates a separate archive for every business you belong to. You receive one email when every export has finished. The email reports each outcome: ready, failed, expired or deleted. Downloads require current membership in the relevant business and expire seven days after each archive is ready.