ArchGenerator Privacy Policy

1. Scope and responsible company

DSTRATEGY LLC, located at 13809 Research Blvd. Suite 500 Room 575 Austin, TX 78750 - USA, operates ArchGenerator and is responsible for the personal information described in this Policy. “We” and “us” mean DSTRATEGY LLC.

This global notice covers the DSTRATEGY LLC offering outside Brazil. In relation to the Brazilian offering, DSTRATEGY LLC acts solely as a technology licensor. That licensing role does not include operational services or receipt of or access to Brazilian customers' data. The dedicated Brazilian Privacy Policy covers that offering and identifies its responsible entity. Language choice does not change the company identified in your order or remove protections under applicable law.

We determine the purposes of account administration, billing, and security. For personal information processed solely on a business customer's analysis instructions, we may act as its processor, depending on the activity and applicable law. This notice does not replace a required data-processing agreement.

Privacy questions and requests: [email protected].

2. Source code is processed without retention

Source code is processed exclusively in isolated, volatile memory within an ephemeral analysis environment. Code is never written to persistent disks, databases, object storage, persistent caches, backups, snapshots, system logs, support tickets, or other persistent repositories. When processing finishes, is canceled, or fails, the code is immediately discarded and the environment destroyed. There is no additional code-retention period following interruption.

Reports contain findings, paths, line references, dependencies, and metrics, never literal code snippets. Reports, structural metadata, and other retained information must not contain literal source code or representations that permit its reconstruction. Outputs can still contain confidential or personal information and are protected accordingly.

We never use your source code to train or improve AI or machine-learning models. We do not give third parties, partners, or subprocessors access to it. The training prohibition also covers all other information received from customers or generated from it, as described in Sections 2 and 5. Providers receive only the limited non-code information needed for their services.

For the requested analysis, we may submit limited non-code information to AI models and their providers, such as necessary technical context, structural metadata, and findings. Inputs must exclude literal code, representations that permit code reconstruction, access credentials, and unnecessary secrets. This processing is exclusively for the requested service. We will not use, or permit our providers to use, information received from customers or generated from it, including personal information, technical context, reports, metadata, and intermediate results, for training, fine-tuning, or improving AI or machine-learning models or for independent exploitation. Using a model to produce the requested analysis does not authorize training. Retention of non-code information follows Section 6.

Non-code information is not necessarily anonymous. Depending on its content, it may include personal or confidential information and must receive the applicable confidentiality, security, and data-protection safeguards, including an appropriate legal basis where required.

Temporary repository tokens expire or are revoked after authorized processing. An ongoing integration may require credentials to remain securely available only for its authorized duration and scope, as described in the connection settings or contracted service. These credentials are not retained code. You may directly revoke the authorization with immediate effect for the access concerned, as detailed in Section 6.

Reports, metrics, and structural metadata made available to a customer are kept in the database instance associated with that customer for consultation and use of the service, under Section 6's criteria. They do not contain literal code or representations that permit its reconstruction. Retaining results is distinct from temporary code processing and from retention of account details and administrative records.

3. Information, sources, and purposes

Sources are you, your account administrator, authorized repository integrations, payment providers, and Platform interactions. Collection is limited to the relevant purpose.

We also use aggregated, effectively anonymized metrics for statistical assessment and improvement of the service. They must not identify an individual, customer, organization, or a customer's code; allow code reconstruction; or reveal confidential information or trade secrets. We will not attempt to reidentify individuals from these metrics. Replacing a name with an identifier alone does not make information anonymous: where identification remains reasonably possible, data-protection rules apply. Statistical assessment and service improvement do not authorize training or fine-tuning AI models with information received from customers or generated from it. We will not use identifiable data or confidential information to compare customers.

We do not sell or rent personal information, use it for targeted advertising, share it for cross-context behavioral advertising, or conduct profiling to make decisions producing legal or similarly significant effects concerning individuals.

4. Legal grounds where required

The following grounds concern processing for which we act as controller. When we act as a processor or subprocessor, we follow lawful, documented instructions. A customer that is the controller determines the relevant purposes and legal basis; a customer that is itself a processor must convey the responsible controller's authorized instructions.

Under the GDPR or UK GDPR, where applicable, account operation and requested services rely on a contract with the individual or requested precontractual steps. Required records may rely on legal obligations recognized by the applicable framework: EU or Member State law under the GDPR, and UK law under the UK GDPR.

Security, fraud prevention, and administration for business representatives may rely on legitimate interests, after considering individuals' rights and reasonable expectations. Consent is used where required and can be withdrawn without affecting previously lawful processing. Accepting the Terms is not consent for unrelated uses.

We do not request sensitive personal information for ordinary accounts. Avoid unnecessary personal information in submitted material. If present in code, the zero-retention rules apply, and additional legal requirements must be addressed before processing.

5. Limited disclosure of non-code information

We disclose non-code information only as needed for the purposes described here, including to service providers supporting the following functions:

DSTRATEGY LLC is responsible for selecting the providers it uses and fulfilling its own obligations in providing the service. Providers are subject to the purpose limitations, confidentiality, security, data-protection, and training prohibitions applicable to their activities. Their obligations and roles depend on the processing performed; not every recipient necessarily acts as a processor. Engaging providers does not remove individuals' rights or each party's responsibilities under applicable law. No provider receives code access. We identify additional relevant provider categories if actual processing changes.

This Policy describes providers by category and function. You may obtain information about the entities with which your personal information has been shared, their purposes, and the countries of processing at [email protected]. Protection of trade secrets or internal architecture details will not be used to prevent the exercise of those rights. Information that must be disclosed publicly or directly under applicable law will be provided as required, independently of a request.

We may disclose necessary non-code records to comply with a binding legal obligation or protect rights through a legally permitted process. Such disclosure is limited to what is required or justified. This provision does not establish a right to retain source code.

6. Retention, revocation, and deletion

Technical content and results retained for the customer's consultation and use are kept in the database instance associated with that customer. They include information the customer views and uses in the service, such as reports, findings, metrics, and metadata. The customer may delete them using the Platform's available controls. Permanent deletion of that data from the associated database instance is completed within 24 consecutive hours after the customer deletes it. Account closure by the customer starts the same period for content and results still present in that instance. During that interval, deleted content will not be reused for new analyses or purposes.

The 24-hour period concerns non-code content in the database instance associated with the customer. It does not change immediate code disposal when processing ends or is interrupted. Administrative, tax, security, and legally necessary records follow the specific criteria below and may not be used to improperly retain deleted technical content.

Technical context, summaries, and other intermediate artifacts do not receive independent authorization for retention merely because they derive from an analysis. Their retention by ArchGenerator must correspond to the content or result made available to the customer and the disclosed purpose. Providers' retention of received information must comply with service necessity, applicable instructions, Section 5's restrictions, and legal obligations. The training prohibition does not by itself mean zero retention in providers' systems. Information about the manner and duration of processing will be provided under Sections 5, 8, and 9.

The customer may directly revoke integration authorizations, with immediate effect for the access concerned, preventing new reads and analyses within that scope. Ongoing processing depending on revoked authorization will end without unjustified delay, with immediate code disposal when it ends. The connection identifies the means of revocation. Persistent credentials will be disabled when revoked; temporary tokens will be revoked or expire according to the connection method. Revocation does not delete completed reports or cancel the subscription; the customer may use the separate controls to request those actions as well.

Individuals' requests concerning personal information will be handled under the applicable legal conditions and deadlines, following proportionate identity and authority checks where necessary. The operational deadline for customer-initiated deletion does not reduce individuals' rights. Where retention is mandatory or necessary for a specific legal purpose, we will explain the justification when permitted and restrict use to what is strictly necessary. Those records will be deleted when the requirement ends. This does not authorize retention of source code.

After deletion from active systems, residual backup copies follow the scheduled expiration or replacement cycle of the relevant copy. The 24-hour deadline for the customer-associated database instance does not itself set the expiration deadline for those copies. Backups remain access-restricted and dedicated exclusively to disaster recovery and the integrity of restoration operations. Deleted content will not return to ordinary use; any restoration must reapply deletions before ordinary processing resumes. Individuals may request information about the cycle applicable to their data through the privacy contact. No backup contains source code.

Deletion rules for environments administered by ArchGenerator do not erase copies that customers have exported and maintain independently.

Use the available controls or our privacy email for report deletion or account closure. Subscription cancellation stops renewal and does not automatically delete the account, results, or integrations. Customer deletion through Platform controls starts the operational period described above; other personal-information requests follow the applicable legal rules.

7. Security

We use TLS 1.3 for data in transit and AES-256 for retained data at rest, together with isolated analysis environments, role-based access controls, continuous intrusion monitoring, and periodic security reviews. Retained-data encryption applies to permitted non-code information; it does not imply that encrypted source code is stored. Access is limited according to assigned responsibilities. No technical measure eliminates every security risk.

We maintain event records relevant to security and evidence of operations, including access, authorizations, revocations, and the ending of processing runs. These records contain no source code, representations permitting its reconstruction, or plaintext credentials, and follow this Policy's necessity and retention criteria. Security measures do not remove our legal protection and response obligations.

8. International processing

Non-code information may be processed outside your country, under different privacy laws. We commit to establishing a valid legal mechanism before making any international transfer for which applicable law requires one.

For transfers subject to the GDPR, we must use a mechanism recognized by its international-transfer rules. For transfers subject to the UK GDPR, we must meet the corresponding UK requirements. Other regulated transfers must satisfy the requirements of the jurisdiction that governs them. Where required, we must assess the transfer and implement additional safeguards before it occurs.

The mechanism must be valid for the actual destination, recipient, information, and purpose. A provider's location or general security measures alone do not establish a lawful transfer mechanism.

You may request information about processing destinations, recipients, and the mechanisms that apply to your information, including access to the relevant safeguards where required by law, at [email protected]. We will also make any directly required or public disclosures in the manner prescribed by applicable law.

9. Requesting privacy rights

Email [email protected] to exercise applicable rights. No account creation is required. We may seek proportionate identity or authority verification, but never source code.

Legal conditions and exceptions may apply. We explain refusals and available appeals without unlawful discrimination. Requests involving your organization's controlled information may require its involvement.

9.1. Texas residents

Where the Texas Data Privacy and Security Act applies to our processing, a Texas resident acting in an individual or household capacity may confirm processing, access personal data, correct inaccuracies, delete covered personal data, and obtain a portable copy where required. The Act's definition of consumer excludes individuals acting in a commercial or employment context.

Covered consumers may opt out of sale, targeted advertising, and profiling for decisions producing legal or similarly significant effects. We do not conduct those activities. An authorized agent may submit an opt-out request through a legally recognized method, subject to the Act's authorization and verification rules.

We respond without undue delay and within 45 calendar days. When reasonably necessary, we may extend that period once by 45 additional calendar days, notifying you of the extension and its reason within the initial period. Requests are handled without charge to the extent the Act requires.

You may appeal a refusal by emailing our privacy address with the subject “Privacy appeal.” We provide a written decision and explanation within 60 days after receiving the appeal. If it is denied, you may submit a complaint to the Texas Attorney General.

9.2. European Economic Area and United Kingdom

Where the GDPR or UK GDPR applies, rights include access, rectification, erasure, restriction, portability, withdrawal of consent, objection including to legitimate-interest processing and direct marketing, and applicable protections concerning automated decisions. Legal conditions and exceptions apply. You may complain to the competent EEA supervisory authority or the UK Information Commissioner's Office.

We respond without undue delay and generally within one calendar month. Where permitted because of complexity or the number of requests, that period may be extended by two further months; we notify you and explain the reason within the initial month. Information about the applicable international-transfer safeguards can be requested at our privacy address.

Where applicable law requires a representative in the EEA or the UK, we must appoint that representative in writing and disclose their identity and contact details as required. We must fulfill those obligations before carrying out processing for which representation is required. Our privacy email does not replace a legally required local representative.

9.3. Other applicable jurisdictions

Other jurisdictions may provide additional or different rights, response periods, or complaint procedures. We apply the requirements that govern the particular processing and individual; listing Texas rights does not make that statute the sole privacy law. Where applicable California privacy law covers our processing, its rights to know, access, correct, delete, obtain portability, use an authorized agent, and exercise applicable sale, sharing, or sensitive-information choices remain available.

Where Brazil's LGPD applies, you may seek confirmation, access, correction, legally available portability, anonymization, blocking or deletion of unnecessary or unlawful data, and information about sharing and consent choices. You may withdraw consent, request deletion of consent-based data subject to legal exceptions, object to noncompliant processing, seek review of covered automated decisions, and petition the ANPD. Confirmation and access are provided immediately in simplified form or through a complete statement within 15 days of the request. That deadline does not automatically govern every other right.

10. Cookies

Session cookies maintain authentication and last for the browser session. Preference cookies retain language and settings for up to 12 months. We do not use advertising or tracking cookies or third-party analytics cookies that individually identify users. Where local law requires consent for a preference cookie, we obtain it before setting that cookie. Browser controls may limit cookies, although disabling necessary session cookies can prevent sign-in.

11. Minors and incidents

The Platform is not intended for people under 18. We do not knowingly collect their personal information. If identified, it will be promptly deleted; a parent or guardian may contact our privacy address.

We will notify the customer without unjustified delay and within 24 consecutive hours after becoming aware of security incidents affecting its data or confidential information, including information that is not personal data. When acting as a processor or subprocessor, we will notify the customer that provided processing instructions and cooperate with the responsible controller. The initial notice will use available information and may be supplemented without waiting for the investigation to conclude.

We investigate incidents, take containment measures, and provide legally required notices when acting as controller. In the United States, applicable state breach-notification rules determine duties and deadlines. Where Brazilian rules apply to a qualifying personal-data incident, the ANPD rule requires communication to the authority and affected individuals within three business days of the controller's knowledge that the incident affected personal data, subject to the rule's conditions and any specific statutory period. A jurisdiction's deadline does not replace another applicable requirement. Any different regulatory deadline does not extend the contractual commitment to notify the customer within 24 hours.

Notices will describe the known facts, affected data categories, possible impacts, containment measures, and appropriate contact channels. We will take necessary measures to contain the incident, mitigate its effects, and prevent recurrence, providing relevant updates to recipients. We will preserve records needed for investigation and legal compliance, without retaining source code.

12. Changes and contact

Material changes are communicated by email or a Platform notice at least 15 days before taking effect, subject to any longer legally required period. We obtain consent where a new use requires it. The publication date identifies the version made available; material changes follow the notice periods described above.

DSTRATEGY LLC 13809 Research Blvd. Suite 500 Room 575 Austin, TX 78750 - USA Privacy contact: [email protected].

DSTRATEGY LLC is responsible for the privacy channel. Through it, we receive individuals' requests, provide explanations, arrange appropriate action, and respond to communications from authorities. The channel may be used whether or not a data protection officer has been appointed. Where applicable law requires such an appointment, the officer's identity and contact details will be publicly and accessibly disclosed; identifying the company as responsible for this channel does not replace that appointment. Any legally required local representative remains subject to Section 9.2.