1.Who we are
Archetype is run by New Arc ApS, a company registered in Denmark with CVR number [CVR] and its registered address at [Address] (New Arc, we, us). This policy explains how we handle personal data when you visit heyarchetype.com, join the waitlist, use Archetype, or connect an AI tool to it.
Write to privacy@heyarchetype.com about anything in this policy. We don’t have a data protection officer, and aren’t required to; this address reaches the people responsible.
2.Our role: controller or processor
We are the controller for the data we need to run our own business: accounts, sign-in, the waitlist, billing, support, emails we send you, and security logs.
We are a processor for the content our customers put into Archetype, such as brand files, photos, designs, comments, AI conversations and the history of who changed what in a brand. The business that owns the brand is the controller of that content, and we process it on its instructions under our Data Processing Agreement. If you are a member of a brand and have questions about that content, ask the business that invited you first.
3.What we collect
What you give us
- Account details: your email address, password (stored only as a hash by our authentication provider), display name and profile photo.
- Sign in with Google: if you choose it, Google tells us your name, email address and profile photo.
- Waitlist: your email address, and whether you asked for product updates.
- Team details: the email addresses you invite, the roles you give people, and the email domains you let join a brand.
- Billing details: the company name, billing address, VAT number and email for invoices. Card details go straight to Stripe and never reach us.
- Messages and feedback: what you write to us, in the app or by email, and the page you sent it from.
- Connections: if you connect Figma, your Figma user id, handle, email and avatar, and access tokens, which we store encrypted.
What we record as you use Archetype
- Activity in a brand: who created, changed, deleted or restored an item, when, and from which tool; comments and when you read them; and the versions of a brand you save.
- AI use: the instructions you give the AI features, their replies and a summary of their reasoning, the checks you run, and the credits each task used.
- Agent use: which AI tool read or changed a brand, what it asked for (such as a search, cut to 120 characters), whether it found it, and when. The tokens that let agents in are stored only as hashes.
- Security records: to stop abuse we count attempts by IP address and by email address, for example on the waitlist and on invite emails.
- Public brand links: when someone views a brand’s public link, we count the visit with a one-way code made from the day, the brand, the IP address and the browser. We don’t store the IP address or the browser.
- Technical logs: our hosting provider keeps short-lived request logs, which include IP addresses, for running and securing the service.
What we read for you
When you ask Archetype to read a website, a Figma file, a .fig file, a PDF or a code repository, we fetch and process it to build your brand. If that material contains personal data, such as names or photos of people on a website, it becomes part of your brand content, for which your business is the controller.
4.Why we use it, and on what legal basis
The GDPR asks us to name a legal basis for each purpose. Ours are:
| Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Creating and running your account, signing you in, and providing the features you use | Contract (b) with you or your business; for people invited by a business, our and that business's legitimate interest (f) in providing the service it signed up for |
| Running AI features on your instructions | Contract (b), and the customer's instructions under the DPA |
| Sending account emails: invitations, role changes, waitlist invites | Contract (b) and legitimate interest (f) |
| Sending product updates and announcements | Consent (a), which you can withdraw at any time |
| Running the waitlist | Steps before a contract (b), at your request |
| Billing, invoices and bookkeeping | Contract (b) and legal obligation (c) under the Danish Bookkeeping Act |
| Security, preventing abuse and fraud, rate limits | Legitimate interest (f) in keeping the service and its users safe |
| Understanding how the product is used, to fix and improve it, and measuring AI costs | Legitimate interest (f) in improving the service |
| Support and replying to feedback | Legitimate interest (f) and contract (b) |
| Meeting legal duties and handling legal claims | Legal obligation (c) and legitimate interest (f) |
Where we rely on legitimate interest, we have weighed it against your rights, and you can object (see Your rights). We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.
5.AI and your content
Archetype’s AI features send the content they work on to an AI model provider to get an answer back. Depending on the feature, that is the instruction you typed, brand text such as voice documents and tokens, component code, images of logos, photos, screenshots and PDFs, and text read from websites.
- Anthropic (Claude) runs most AI features. Under Anthropic’s commercial terms it may not train models on this content, and it deletes API inputs and outputs within 30 days, unless it must keep them longer to enforce its usage policy or the law.
- TypeSafe answers short questions about text, such as ranking search results for agents and checking copy against a brand’s voice. Its terms say it does not train models on what it is sent.
We don’t use your content to train AI models, and we don’t let our providers do so. AI providers are listed with our other subprocessors.
6.Who we share it with
We don’t sell personal data or share it for advertising. We share it only with:
- Our subprocessors, the companies that host, store, email and run AI for us, under contracts that let them use it only to serve us. The current list, with what each does and where, is on Subprocessors: Supabase (database, files and sign-in), Vercel (hosting), Anthropic and TypeSafe (AI), Loops (email) and Stripe (payments).
- The people and tools you share a brand with: its members, the AI agents they connect, and anyone with its public link if you turn it on. Your name and photo are shown to the other members of the brands you are in, beside your comments and changes.
- Services you connect, such as Figma and Google, which act under their own terms.
- Authorities, advisers and buyers, when the law requires it, to protect our rights or someone’s safety, with our accountants and lawyers, or as part of a sale or merger of our business, under the same protections.
Some files in the app are loaded by your browser from public content networks: Google Fonts, when a brand uses one of its typefaces; Iconify, for icon sets; jsDelivr, for the PDF viewer; and Google, for profile photos of people who signed in with it. Those networks see your IP address, as with any web request. See the list.
7.Transfers outside the EU
Your account, brand content and backups are stored in the EU, with Supabase in Frankfurt, Germany, and our server functions run in Frankfurt with Vercel. Some providers process data in the United States or elsewhere: Anthropic and TypeSafe for AI features, Loops for email, Stripe for payments, and Supabase and Vercel for support and parts of their networks.
When personal data leaves the EU/EEA, we rely on the European Commission’s Standard Contractual Clauses, and, for providers certified under it, the EU-US Data Privacy Framework. You can ask us for a copy of the relevant safeguards at privacy@heyarchetype.com.
8.How long we keep it
| Data | How long |
|---|---|
| Account details | While you have an account. When you delete it, within 30 days, except where we must keep something by law |
| Brand content, its history, AI conversations and checks | While the brand exists. Deleted files wait 30 days in the trash first. After a brand is cancelled or locked, 90 days (see the Terms), then deleted |
| Backups | Overwritten on our database provider's backup cycle after the data is deleted |
| Waitlist | Until you get access or ask to be removed. Product-update consent until you unsubscribe |
| Invoices and bookkeeping records | 5 years after the end of the financial year, as Danish law requires |
| Security records by IP address and email | Up to 30 days |
| Support emails and feedback | Up to 3 years after the conversation ends |
| Hosting request logs | A few days, as set by our hosting provider |
Anonymous or aggregated figures that no longer identify anyone may be kept longer.
9.Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you, and get a copy;
- correct it if it is wrong;
- delete it, where we have no reason to keep it;
- restrict how we use it, or object to uses based on legitimate interest, including any direct marketing;
- take it with you in a machine-readable format (data portability);
- withdraw consent at any time, for example to product updates, without affecting what happened before.
How to use them
- You can change your name, photo and password in the app, and delete your account or download your data in Settings → Profile.
- Every product-update email has an unsubscribe link.
- For anything else, write to privacy@heyarchetype.com. We answer within one month, and may ask you to confirm who you are first.
For brand content, where we are a processor, we pass your request to the business that controls the brand, and help it answer.
You can also complain to a data protection authority. Ours is the Danish Data Protection Agency, Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk. You may also go to the authority where you live or work. We’d be glad to hear from you first.
11.Security
Data is encrypted in transit and at rest by our hosting providers. Access is limited by row-level security in the database, so each member reaches only the brands they belong to and only what their role allows. Agent and API tokens are stored only as hashes, and connection tokens for Figma are encrypted. Servers that fetch websites for you refuse private network addresses. No system is perfectly secure; if a breach affects your personal data, we’ll tell you and the authorities as the law requires.
12.Children
Archetype is a business tool and not meant for anyone under 16. We don’t knowingly collect their personal data.
13.Changes to this policy
When we change this policy, we update the date at the top. If the change is significant, we’ll also tell you by email or in the app before it applies.