Legal

Privacy Policy

How New Arc ApS collects, uses, and protects personal data across the Archetype website, our design sprints, and the Archetype OS platform.

Last updated 15 September 2026

1Who we are

Archetype is a product of New Arc ApS, a company registered in Denmark. We are the data controller for the personal data described in this policy, which means we decide why and how it is processed.

You can reach us about anything in this policy at lucas@newarc.io.

We have not appointed a Data Protection Officer — we are not required to — so privacy questions go straight to the team.

2What this policy covers

This policy applies to three things:

The website at archetypelab.io, including the order flows and the early-access signup.
Our services — the Agentic Brand sprint and the Product Sprint — from the first enquiry through delivery of your files.
Archetype OS, the platform where your brand lives and is served to your AI tools, including our MCP server and any APIs or integrations we provide with it.

It does not cover third-party services you connect to us or to your brand files. Once your files leave for another tool — a model provider, a design tool, a code editor — that tool’s own privacy terms apply to what happens there.

3The data we collect

Data you give us

Early access and enquiries: your email address, and anything you choose to write to us.
Orders: your name, work email, role, company name, company website, the brand materials and links you upload or share, which AI tools your team uses, what you plan to generate, your preferred kickoff date, and any comments you add.
Platform accounts: your name, email, workspace and team details, authentication data (a hashed password or an identifier from your single sign-on provider), your role and permissions, and your preferences.
Billing: the company name, billing address, VAT number, and contact details needed to invoice you. We do not see or store full card numbers — those go directly to our payment provider.
Support and correspondence: emails, call bookings, and the content of messages you send us.

Data we collect automatically

Server and security logs: IP address, browser and device type, pages or endpoints requested, referring page, and timestamps. We use these to serve the site, detect abuse, and debug.
Platform usage data: which brand resources were requested, by which account or API key, when, and whether the request succeeded. This is how we run rate limits, bill usage, and show you your own activity.
Cookies and local storage, as described in section 7.

Data we get from others

From your colleagues: if someone invites you to a workspace, we receive your name and email from them.
From our payment provider: confirmation that an invoice was paid, plus the last four digits and card brand for reconciliation.
From your identity provider: if you sign in with Google or another SSO provider, the basic profile fields they release to us.

We do not buy personal data, and we do not build advertising profiles.

4Why we use your data, and our legal basis

Under the GDPR we need a legal basis for every use of your personal data. Ours are set out below.

Purpose	Data used	Legal basis
Delivering a sprint and its files	Order details, brand materials, correspondence	Performance of a contract (Art. 6(1)(b))
Running your account and the platform, including MCP access	Account, workspace, usage and log data	Performance of a contract (Art. 6(1)(b))
Invoicing, payment, and bookkeeping	Billing and transaction data	Contract and legal obligation (Art. 6(1)(b) and (c))
Replying to enquiries and providing support	Contact details, message content	Legitimate interests — answering people who contact us (Art. 6(1)(f))
Early access list and product updates	Email address	Consent, which you can withdraw at any time (Art. 6(1)(a))
Keeping the service secure and preventing abuse	Log, device, and usage data	Legitimate interests — securing our systems (Art. 6(1)(f))
Improving the product and fixing bugs	Aggregated usage data, error reports	Legitimate interests — improving what we offer (Art. 6(1)(f))
Establishing or defending legal claims	Contract, correspondence, and transaction records	Legitimate interests and legal obligation (Art. 6(1)(f) and (c))

Where we rely on legitimate interests, we have weighed those interests against your rights and concluded that our use is proportionate and would be expected. You can object — see section 12.

5Your brand content on the platform

The brand files you hand over or create in Archetype OS — tokens, assets, components, voice and messaging documents, and everything else in your workspace — are yours. We call this your content, and we treat it as confidential.

Most of it is not personal data at all. Where it does contain personal data — a founder’s photo, a team bio, names in an example — we process it on your instructions as your processor, and you remain the controller. If you need a Data Processing Agreement with standard contractual clauses, ask us and we will put one in place.

We access the content in your workspace only to run the service, to resolve a support request you raise, or where the law requires it.

6AI models and your content

Archetype OS exists to serve your brand to AI tools, so it is worth being precise about what that means.

We do not use your content or your personal data to train AI models — ours or anyone else’s.
When you or your team connect a tool to your workspace, that tool reads the brand context you have made available to it. Whatever it does with that data afterwards is governed by that tool’s terms, not ours.
Where a platform feature calls a model provider on our behalf, we send only what that feature needs, and we use providers that are contractually barred from training on our customers’ data.

7Cookies and similar technologies

We keep this deliberately small. The marketing site sets only strictly necessary cookies — the ones needed to serve pages, keep the site secure, and remember your choices. Those do not require consent.

Signing in to the platform or to our content studio sets a session cookie so you stay logged in, and we use local storage in your browser for interface preferences.

We do not use advertising cookies and we do not track you across other websites. If we ever add product analytics, we will ask for your consent first and update this policy before we do.

8Who we share data with

We do not sell personal data. We share it with service providers who process it on our behalf under a written agreement, and only for the purposes below.

Provider	What it handles	Where
Vercel	Website and platform hosting, CDN, logs	EU / US
Sanity	Website content management	EU
Notion	Early-access signups, enquiries, call bookings	US
Google Workspace	Email and shared documents	EU / US
Payment and invoicing provider	Card payments, invoices, bookkeeping records	EU
Model and infrastructure providers	Features that call an AI model on our behalf	EU / US

Beyond those providers, we share personal data only:

with professional advisors — accountants, lawyers, auditors — under a duty of confidentiality;
where we are legally required to, for example in response to a valid order from a public authority;
to establish, exercise, or defend legal claims; and
with an acquirer, if we are ever involved in a merger or sale of the business — in which case we will tell you before your data becomes subject to a different policy.

9International transfers

We keep data in the EU/EEA where we reasonably can. Some of our providers are based in, or have infrastructure in, the United States.

When personal data leaves the EEA we rely on a valid transfer mechanism: an adequacy decision, the EU-US Data Privacy Framework where the provider is certified, or the European Commission’s Standard Contractual Clauses together with supplementary safeguards. Write to us if you want a copy of the safeguards for a specific transfer.

10How long we keep data

Data	Retention
Early-access and marketing emails	Until you unsubscribe or ask us to delete, and up to 24 months of inactivity
Enquiries that do not become projects	12 months from our last exchange
Project files and order submissions	For the project, then 24 months after delivery so we can re-issue your files
Platform accounts and workspace content	While your account is active, then deleted within 30 days of closure (backups are purged within 90 days)
Invoices and accounting records	5 years from the end of the financial year, as required by the Danish Bookkeeping Act
Server and security logs	Up to 90 days

Where we need to keep something longer to defend a legal claim, we keep only what is necessary for that purpose and delete it once the claim is resolved or time-barred.

11How we protect your data

Everything is encrypted in transit (TLS) and at rest with our hosting providers.
Access is limited to the people who need it, protected by strong authentication and multi-factor sign-in.
Platform API keys and MCP credentials are scoped to a workspace, stored hashed, and can be revoked by you at any time.
We review the providers we use and keep a written agreement with each one.
We restore from backups regularly enough to know they work.

No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify the Danish Data Protection Agency within 72 hours and tell you directly where the law requires it.

12Your rights

Under the GDPR you have the right to:

access the personal data we hold about you and get a copy;
have inaccurate data corrected;
have your data deleted, where we have no continuing basis to keep it;
restrict how we process your data while a dispute is resolved;
receive data you gave us in a portable, machine-readable format, or have it sent to another provider;
object to processing based on our legitimate interests, including profiling; and
withdraw consent at any time, without affecting what we did before you withdrew it.

To exercise any of these, email lucas@newarc.io. We reply within one month and will tell you if we need longer. There is no charge unless a request is clearly unfounded or excessive.

You also have the right to complain to a supervisory authority. In Denmark that is Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby — datatilsynet.dk. We would appreciate the chance to sort it out with you first.

If your request concerns content inside a customer’s workspace, we will pass it to that customer, who is the controller for it, and support them in responding.

13Children

Our services are sold to businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.

14Changes to this policy

We update this policy when what we do with data changes. The date at the top always reflects the current version.

If a change materially affects you — a new purpose, a new category of recipient — we will tell you by email or in the product before it takes effect.

15Contact us

Questions, requests, or concerns about privacy: lucas@newarc.io.