Privacy Policy

Owner and Data Controller

Archil, Inc.
445 Bush Street, Suite 200
San Francisco, CA 94108

Contact: privacy@archil.com

Types of Data Collected

When you visit archil.com, we may collect the following types of data: usage data (page views, clicks, browsing history, session statistics), device and browser information, city-level location, and operating system information.

This data is collected automatically through analytics tools when you use the site.

How We Process Your Data

Methods of Processing

We implement appropriate security measures to prevent unauthorized access, disclosure, modification, or destruction of your data. Processing is carried out using computers and IT tools following organizational procedures strictly related to the purposes indicated.

Place of Processing

Data is processed at the Owner's offices and at the facilities of third-party service providers in the United States. For transfers of personal data from the European Economic Area (EEA) to the United States, we rely on Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework. We maintain Data Processing Agreements with our subprocessors, including PostHog and Vercel.

Retention

We retain personal data for the following periods:

• Analytics data (PostHog): 24 months
• Session replay data (PostHog): 30 days

Data may be retained longer where required by applicable legal obligations or your consent.

Purposes of Processing

We collect data to provide and improve our services, comply with legal obligations, protect our rights, and detect malicious activity. Specifically, we use your data for:

• Website analytics
• Session recording and heat mapping
• Security and fraud prevention

Services We Use

PostHog Product Analytics (PostHog, Inc.)

We use PostHog to understand how visitors use our site. PostHog acts as a data processor on our behalf and does not use your data for its own purposes.

Data processed: browser information, browsing history, clicks, device information, page views.
Retention: 24 months.
Processing location: United States.
PostHog Privacy Policy

PostHog Session Replay (PostHog, Inc.)

We use PostHog Session Replay to record and replay user sessions to identify usability issues.

Data processed: city-level location, clicks, device information, operating system, page views, usage data.
Retention: 30 days.
Processing location: United States.

Vercel Analytics (Vercel, Inc.)

We use Vercel Analytics for privacy-friendly, aggregated website performance metrics. Vercel Analytics does not use cookies and does not collect personal identifiers that can track users across applications.

Data processed: page URL, referrer, device type, operating system, browser, geolocation (country/region level).
Processing location: United States.
Vercel Analytics Privacy Policy

Fonts

We use the Inter and IBM Plex Mono typefaces. These fonts are self-hosted and served directly from our infrastructure — no data is transmitted to Google or any third party for font delivery.

Cookies

We use cookies for website analytics via PostHog. No cookies are set until you give explicit consent through our cookie banner. If you decline cookies or if your browser sends a Global Privacy Control (GPC) signal, no tracking cookies are set. PostHog will continue to collect anonymized, non-identifiable analytics data (such as page views and usage patterns) without cookies, but this data cannot be linked to you across sessions.

You can change your cookie preferences at any time using the "Cookie Preferences" link in our footer.

Legal Basis for Processing (GDPR)

If you are in the European Economic Area, we process your personal data under the following legal bases:

• Consent (Art. 6(1)(a)) — Website analytics and session replay. You provide consent via our cookie banner and may withdraw it at any time.
• Contract (Art. 6(1)(b)) — Processing necessary for the performance of a contract with you or to take pre-contractual steps at your request.
• Legal obligation (Art. 6(1)(c)) — Processing necessary for compliance with a legal obligation to which we are subject.
• Legitimate interest (Art. 6(1)(f)) — Security monitoring and fraud prevention, where our interest does not override your fundamental rights and freedoms.

Your Rights Under GDPR

If you are in the European Economic Area, you have the right to:

• Withdraw consent at any time
• Object to processing of your data
• Access your data and obtain copies
• Verify and rectify inaccurate data
• Restrict processing of your data
• Request erasure of your personal data
• Receive your data in a structured, machine-readable format
• Lodge a complaint with a data protection authority

We do not engage in automated decision-making or profiling that produces legal effects concerning you.

Your Rights Under CPRA (California)

If you are a California resident, the California Privacy Rights Act (CPRA) provides you with the following rights:

• Right to Know — request information about what personal data we collect, use, and disclose
• Right to Delete — request deletion of your personal data
• Right to Correct — request correction of inaccurate personal data
• Right to Opt-Out of Sale/Sharing — opt out of the sale or sharing of your personal data
• Right to Limit Use of Sensitive Personal Information — limit how we use sensitive personal data

We do not sell or share your personal information with third parties for cross-context behavioral advertising. We honor Global Privacy Control (GPC) signals. If your browser sends a GPC signal, we automatically opt you out of tracking.

Children's Privacy

Our site is not directed to children under the age of 13, and we do not knowingly collect personal data from children under 13. If we become aware that we have collected personal data from a child under 13, we will take steps to delete that information promptly.

Exercising Your Rights

To exercise any of the rights described above, contact us at privacy@archil.com. Requests are free of charge and will be addressed within the following timeframes:

• GDPR requests: within one month
• CPRA requests: within 45 days

Subprocessors

We use the following subprocessors to deliver our services. We maintain Data Processing Agreements with each subprocessor. This list may be updated with notice.

Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "last updated" date. We encourage you to review this page periodically.