Data Processing Agreement

1.Scope and how this agreement applies

This Data Processing Agreement (DPA) is part of the Terms of Service between the Customer and New Arc. It applies whenever New Arc processes personal data on the Customer’s behalf in providing Archetype, and meets the requirements of Article 28 of the GDPR (Regulation (EU) 2016/679).

You don’t need to sign it. Accepting the Terms accepts this DPA, with the same effect as signing it. If your organisation needs a signed copy for its records, print this page or save it as a PDF, or ask us at privacy@heyarchetype.com for a countersigned one.

Words such as controller, processor, data subject, personal data breach and processing mean what they mean in the GDPR. Customer Personal Data is personal data in Customer Content (as defined in the Terms) that New Arc processes for the Customer. Data New Arc handles as a controller, such as account and billing details, is covered by the Privacy Policy instead.

2.Roles

The Customer is the controller, or a processor acting for its own clients, and New Arc is the processor, or sub-processor, of Customer Personal Data. The Customer is responsible for having a lawful basis for the data it puts into Archetype and for giving data subjects the information the law requires. The subject matter, nature, purpose and duration of the processing, and the types of data and data subjects, are set out in Annex 1.

3.Processing only on instructions

New Arc processes Customer Personal Data only on the Customer’s documented instructions. The Terms, this DPA, and the Customer’s and its users’ use and configuration of Archetype (including the Agents they connect) are those instructions. Further instructions must be in writing and consistent with the Terms.

If the law requires New Arc to process the data otherwise, it will tell the Customer first, unless the law forbids it. New Arc will tell the Customer if it believes an instruction breaks data protection law.

New Arc does not sell Customer Personal Data, use it for its own purposes beyond running and securing the service, or use it, or let its subprocessors use it, to train AI models.

4.Confidentiality

New Arc ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality, by contract or by law, and has access only as far as their work needs it.

5.Security

New Arc takes the technical and organisational measures required by Article 32 of the GDPR, described in Annex 2. It may change them over time, provided the overall level of protection doesn’t fall.

6.Subprocessors

The Customer gives New Arc general authorisation to engage subprocessors. Those in use today are listed in Annex 3 and on Subprocessors.

• New Arc will give the Customer at least 30 days’ notice of a new or replacement subprocessor, by email to the owners of the Customer’s brands and on the Subprocessors page.
• The Customer may object on reasonable data protection grounds within that time. The parties will discuss it in good faith; if New Arc can’t reasonably avoid the change, the Customer may cancel the affected plan and receive a refund of fees paid for the period after the change.
• New Arc imposes data protection obligations on each subprocessor that are no less protective than this DPA, and remains responsible to the Customer for its subprocessors’ performance.

7.Transfers outside the EU/EEA

Customer Personal Data is stored in the EU. Where a subprocessor processes it in a country without an adequacy decision, New Arc ensures the transfer is covered by the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914), the EU-US Data Privacy Framework where the recipient is certified, or another safeguard under Chapter V of the GDPR. The Customer authorises the transfers listed in Annex 3.

8.Helping the Customer

Taking into account the nature of the processing, New Arc will help the Customer:

• answer requests from data subjects exercising their rights. Much of this can be done in Archetype itself; New Arc will pass on any request it receives directly and not answer it without the Customer’s permission, unless the law requires it;
• with data protection impact assessments and prior consultations where required;
• meet its security obligations under Article 32.

9.Personal data breaches

New Arc will notify the Customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as known, what happened, the data and data subjects affected, the likely consequences, and what New Arc is doing about it, and will be updated as more becomes known. New Arc will take reasonable steps to contain the breach and help the Customer meet its own duties to notify authorities and data subjects.

10.Deletion and return at the end

When the Customer deletes content, it is moved to a trash for 30 days, where it can be restored, and then deleted. When the Terms end, or a brand is cancelled or locked, New Arc keeps the brand’s Customer Personal Data for 90 days, during which the Customer can ask for a copy of it, and then deletes it, unless the law requires New Arc to keep it.

Deleted data may remain in database backups until they are overwritten on the backup provider’s cycle. It is kept secure there and not otherwise processed.

11.Information and audits

New Arc will make available the information needed to show compliance with Article 28, starting with this DPA, its annexes and its subprocessors’ own certifications and reports. If that isn’t enough, the Customer may audit New Arc, itself or through an independent auditor bound by confidentiality, once a year and after an actual breach, with 30 days’ written notice, during business hours and without disrupting the service. The Customer bears its own costs of an audit.

12.Liability, precedence and term

Each party’s liability under this DPA is subject to the limits in the Terms, as far as the GDPR allows. If this DPA and the Terms conflict on the protection of personal data, this DPA wins. This DPA lasts as long as New Arc processes Customer Personal Data and is governed by the same law and courts as the Terms.

13.Annex 1: Details of the processing

• Subject matter and purpose: providing Archetype to the Customer: storing a brand system, letting its users and their AI agents read, edit and generate with it, running AI features, imports and checks on it, and publishing it where the Customer chooses.
• Nature of the processing: collection, storage, organisation, retrieval, rendering, analysis by AI models, transmission to the users, agents and links the Customer chooses, and deletion.
• Duration: for the term of the Terms, and the retention period in section 10.
• Data subjects: the Customer’s users (employees, contractors and invited people); people who appear in Customer Content, such as in photos, documents, designs, websites, Figma files or repositories the Customer brings in; and visitors to a brand’s public link.
• Types of personal data: names, email addresses and profile photos of users as shown inside a brand; comments; records of who changed what, when and with which tool; AI instructions and conversations; records of agent use; any personal data inside files, images, text and code in Customer Content; and a one-way visit code for public link views (no IP address is stored).
• Special categories: none are intended. The Customer should not put special categories of personal data, or data about criminal convictions, into Archetype.
• Frequency: continuous, while the Customer uses Archetype.

14.Annex 2: Technical and organisational measures

Where the data lives

• The database, file storage and backups are hosted by Supabase in the EU (AWS Frankfurt, Germany). Server functions run with Vercel in Frankfurt.

Encryption

• All traffic to Archetype, and between its parts, is encrypted with TLS (HTTPS).
• Data is encrypted at rest by Supabase and Vercel.
• Tokens that let agents and tools into a brand (API, OAuth and share tokens) are stored only as SHA-256 hashes, never in readable form. Access tokens for connected Figma accounts are encrypted with AES-256-GCM.
• Passwords are stored only as hashes by Supabase Auth.

Access control

• Row-level security is enabled on every database table, so a member can reach only the brands they belong to.
• Five roles (Viewer, Creator, Editor, Admin, Owner) decide what each member can do, and server actions check the member’s role before writing.
• Agents act with the role of the person who connected them, and can change a brand only if that person allowed edits when connecting. OAuth access tokens last an hour, refresh tokens 30 days, and any connection can be revoked.
• Brand files are kept in a private storage bucket and served through links that expire.
• The keys that bypass row-level security are held only on the server, never sent to a browser. Access to production systems is limited to New Arc’s founders.

Protecting the service

• Server-side fetches of websites refuse private and internal network addresses, at every redirect. The headless browser that renders pages has no network of its own.
• Code and previews from brand content run in sandboxed frames with their own content security policy.
• Rate limits on the waitlist, invitation emails and other abuse-prone actions.

Integrity and recovery

• Every change to a brand is logged with who made it and from which tool, and most can be undone. Named versions can be compared and restored.
• Deleted files are kept in a trash for 30 days before they are removed.
• The database is backed up by Supabase.

Organisation

• Data processing agreements with every subprocessor (Annex 3).

15.Annex 3: Subprocessors

The subprocessors authorised at the date of this DPA. The current list is always on Subprocessors.

SCCs: the European Commission’s Standard Contractual Clauses. EU-US DPF: the EU-US Data Privacy Framework, for companies certified under it.