Privacy Policy.

1. Who We Are

ArcQubit Inc. is a Delaware corporation that develops and provides SecBox, a developer-focused software platform and related services for identifying and managing security risk across software, dependencies, and delivery pipelines. When you use SecBox or related services, ArcQubit is the controller of your personal information (except where we process data on behalf of a business customer, in which case we act as a processor). Our processing activities are documented in our Record of Processing Activities (ROPA) as required under GDPR Article 30.

2. Information We Collect

2.1 Information You Provide

When you create an account, use our services, contact us, or subscribe to communications, we may collect your name, email address, phone number, organization, job title, billing information, and the content you provide to ArcQubit platforms or services (your “Content”).

2.2 Information Collected Automatically

When you visit our websites or use our services, we automatically collect technical information such as your IP address, browser type, device information, operating system, and usage data (pages visited, features used, session duration, and referral sources). We use cookies and similar technologies as described in our Cookie Policy (OPS-009).

2.3 Information from Third Parties

We may receive information about you from third parties, such as social media platforms, business data providers, or your employer.

3. Lawful Basis for Processing

Under the GDPR and similar data protection laws, we rely on one or more of the following legal bases when we process your personal information:

• Your consent, for example, when you subscribe to marketing communications or enable optional cookies.
• Performance of a contract, for example, to provide ArcQubit platforms or services and process transactions.
• Compliance with a legal obligation, for example, tax, accounting, or regulatory requirements.
• Legitimate interests, for example, improving our services, ensuring security, and preventing fraud, where those interests are not overridden by your rights and freedoms.

ArcQubit conducts a legitimate interest assessment before relying on legitimate interests as a legal basis. Where consent is relied upon, it must be freely given, specific, informed, and unambiguous. You may withdraw your consent at any time, and withdrawal will not affect the lawfulness of processing that occurred before your withdrawal.

4. How We Use Your Information

We use your information to:

• Provide, operate, and improve our services.
• Process transactions and manage your account.
• Communicate with you about our services, features, and updates.
• Respond to your inquiries and provide support.
• Ensure security, detect threats, and prevent fraud.
• Comply with legal obligations.
• Where you have not opted out, improve our AI models. See Section 5 below and PUB-007 for details on model training and opt-out.

We do not sell your personal information. We do not use your information to create advertising profiles. ArcQubit recognizes and honors Global Privacy Control (GPC) signals as a valid opt-out mechanism.

5. AI Model Training and Your Data

5.1 Default for Business Customers

For business customers governed by a Data Processing Addendum (AGR-002), ArcQubit does not use Customer Content (including Customer Personal Data) to train our AI/ML models or third-party AI models, unless the customer explicitly authorizes such use in writing. Any such authorization is separate from the DPA and the underlying services agreement.

5.2 Default for Other Users

For individual users and website visitors, we may use data to improve our models where you have not opted out. You may opt out at any time. For full details on our model training practices, anonymization methods, and opt-out mechanisms, please see PUB-007: How Your Data Is Used to Improve Model Performance.

6. How We Share Your Information

We may share your information in the following circumstances:

• Our group companies. We may share your information with ArcQubit subsidiaries and affiliates to the extent necessary to provide our services and for internal administrative purposes.
• Service providers and sub-processors. We share information with third parties who assist us in operating our business, subject to contractual data protection obligations. A current Sub-Processor List is available upon request.
• Professional advisors. We may share information with our lawyers, auditors, accountants, and insurers where necessary.
• With your consent or at your direction.
• Legal compliance and safety. To comply with legal obligations, court orders, or regulatory requirements, or to protect the rights, safety, or property of ArcQubit, our users, or the public.
• Regulators and law enforcement. Where required by applicable law or in response to valid legal process.
• Corporate transactions. In connection with a merger, acquisition, or sale of assets.

For business customers, data sharing is governed by the Data Processing Addendum (AGR-002). ArcQubit provides at least thirty (30) calendar days’ prior written notice before authorizing a new sub-processor. Customers may object on reasonable data protection grounds during the notice period.

7. Your Rights

Depending on where you live, you may have the right to:

• Access your personal information.
• Correct inaccurate information.
• Delete your personal information.
• Restrict or object to processing.
• Port your data to another service.
• Opt out of the sale or sharing of your personal information.
• Withdraw consent at any time.
• Opt out of automated decision-making technology (ADMT) that produces legal or similarly significant effects, including the right to request human review of such decisions.
• Under the CCPA, limit the use of your Sensitive Personal Information to the purposes specified in CCPA Regulations Section 7027(m).
• Appeal a denied request, where provided by applicable state law.

To exercise your rights, please contact us at compliance@arcqubit.ai or visit our Privacy Portal on the ArcQubit website.

7.1 Response Timelines

We respond to verified requests within the timeframes required by applicable law:

• GDPR: Within thirty (30) calendar days of receipt, extendable by up to sixty (60) additional days for complex requests.
• CCPA/CPRA: Within forty-five (45) calendar days of receipt, extendable by up to forty-five (45) additional days.
• VCDPA (Virginia): Within forty-five (45) calendar days, extendable by up to forty-five (45) additional days.
• CPA (Colorado): Within forty-five (45) calendar days, extendable by up to forty-five (45) additional days.
• TDPSA (Texas): Within forty-five (45) calendar days, extendable by up to forty-five (45) additional days.

We will not discriminate against you for exercising your rights.

7.2 Identity Verification and Authorized Agents

To protect your personal data, ArcQubit verifies the identity of individuals submitting rights requests. Verification may require that the request be sent from the email address associated with your account, or that you provide information sufficient to verify your identity (such as name, email address, and account details). If you use an authorized agent, we may require written permission and a copy of the authorization or power of attorney.

8. International Transfers

Your information may be transferred to and processed in the United States or other countries that may have data protection laws different from those in your country. We protect international transfers using the following mechanisms:

• EU-US Data Privacy Framework (DPF), UK Extension, and Swiss-US DPF. ArcQubit and its key sub-processors, including Microsoft and Stripe, maintain certifications under these frameworks.
• Standard Contractual Clauses (SCCs). Where DPF certification is not applicable, ArcQubit uses the European Commission’s Standard Contractual Clauses to govern cross-border transfers.
• UK International Data Transfer Agreement (IDTA). For transfers from the United Kingdom, ArcQubit may use the UK IDTA.
• Binding Corporate Rules (BCRs). Where approved by the relevant supervisory authority.
• Transfer Impact Assessments. ArcQubit conducts transfer impact assessments to evaluate the legal framework of the recipient country and determine whether supplementary measures are necessary.
• Explicit consent. Where other safeguards are not available, the data subject’s explicit consent.

ArcQubit monitors the adequacy status of the Data Privacy Framework on an ongoing basis. In the event that the DPF is invalidated, suspended, or materially modified, ArcQubit will ensure continuity of lawful data transfers by relying on alternative transfer mechanisms, including SCCs, the UK IDTA, or other legally recognized safeguards.

For more information, see our full Data Privacy Policy or contact us at compliance@arcqubit.ai.

9. Data Retention

We retain your information only as long as necessary to fulfill the purposes described in this Privacy Policy or as required by law. Key retention periods include:

• Website usage data and cookies: Thirteen (13) months from collection, after which the data is anonymized or deleted.
• Marketing preferences: Until you opt out, plus thirty (30) days for processing. Suppression records are maintained indefinitely to honor your opt-out.
• Customer data upon termination: Deleted within ninety (90) days of contract termination, unless retention is required by law.

For the complete Data Retention Schedule, see our full Data Privacy Policy (POL-001) and OPS-001. To request more information, contact compliance@arcqubit.ai.

10. Security

We protect your information using industry-standard technical and organizational measures, including:

• Encryption at rest (AES-256) and in transit (TLS 1.2 or higher), with encryption keys managed through Azure Key Vault.
• Role-based access controls through Microsoft Entra ID with multi-factor authentication and least-privilege access.
• Regular vulnerability assessments and penetration testing.
• Continuous monitoring and audit logging.
• Employee security awareness training.
• Physical security controls for data center infrastructure, delegated to Microsoft Azure (which maintains SOC 1/2 Type II, ISO 27001, and FedRAMP High certifications).

For more details, see our Information Security Policy (POL-002).

11. Children

Our services are not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child, please contact us immediately at compliance@arcqubit.ai.

12. Educational Institutions and FERPA

ArcQubit may provide educational access to ArcQubit platforms for educators, professors, and institutional administrators under applicable education access terms. In connection with this access:

• ArcQubit does not collect, access, process, or store student education records as defined under the Family Educational Rights and Privacy Act (FERPA), unless expressly agreed in writing. ArcQubit platforms made available for educational use are designed for educators, professors, and institutional administrators, not for direct student use unless a separate agreement permits it.
• Personal data collected from educational institution users is limited to educator and administrator account information, platform usage data, and technical data.
• ArcQubit does not use Educator User data for interest-based advertising, does not sell Educator User data, and does not use Educator User Content to train or improve models without the institution’s prior written consent.
• Educational institutions are responsible for ensuring that their use of ArcQubit platforms complies with FERPA and other applicable educational privacy laws.

For complete terms governing educational use, see the applicable education access terms for the relevant ArcQubit platform or service.

13. Cookies

We use cookies and similar technologies as described in our Cookie Policy (OPS-009), available on our website.

Analytics cookies. We use Google Analytics (GA4), a web analytics service provided by Google LLC, to understand how visitors use our website. These are optional analytics cookies, and they are not loaded until you provide consent. When you first visit, a banner lets you accept or reject them; if you reject, no analytics cookies are set and Google Analytics is not loaded. You may change or withdraw your choice at any time using the “Cookie settings” link in the footer of any page. For more information, see Google’s Privacy Policy.

14. Automated Decision-Making Technology (ADMT)

ArcQubit may use automated decision-making technology in connection with certain features of ArcQubit platforms or services. Where ADMT produces legal or similarly significant effects concerning you, you have the right to:

• Be informed that ADMT is being used and receive meaningful information about the logic involved.
• Obtain human review of a decision made by ADMT.
• Contest a decision made by ADMT.
• Opt out of ADMT processing. California consumers may exercise this right under the CCPA.

ArcQubit does not engage in profiling that produces legal or similarly significant effects without the safeguards described above. To exercise your ADMT rights, contact compliance@arcqubit.ai.

15. State-Specific Notices

California residents: You have additional rights under the CCPA/CPRA, including the right to know, delete, correct, opt out of the sale or sharing of your personal information, and limit the use of your Sensitive Personal Information. See our California Privacy Notice, available on our website or upon request.

Virginia residents: You have rights under the VCDPA, including access, correction, deletion, portability, and the right to opt out of targeted advertising and profiling. You may appeal a denied request. See our Virginia Privacy Notice, available on our website or upon request.

Colorado residents: You have rights under the CPA, including access, correction, deletion, portability, and the right to opt out of targeted advertising and sale. You may appeal a denied request. See our Colorado Privacy Notice, available on our website or upon request.

Texas residents: You have rights under the TDPSA, including access, correction, deletion, and portability. See our Texas Privacy Notice, available on our website or upon request.

EU/UK residents: You have additional rights under the GDPR, including rights of access, rectification, erasure, restriction, portability, and objection. You have the right to lodge a complaint with your local supervisory authority. See our EU/UK Privacy Notice, available on our website or upon request.

16. Health Data

If you use a health-related feature within an ArcQubit platform or service, please see our Health Privacy Notice (PUB-002) for information about the heightened safeguards that apply to health-related personal data. This notice is available on our website or upon request.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated policy on our website and, where required by law, by email or other notification. The effective date at the top of this policy indicates when it was last revised.

18. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:

You may also submit requests through our Privacy Portal, accessible from the ArcQubit website.

If you are located in the EU, EEA, Switzerland, or UK, you have the right to lodge a complaint with your local supervisory authority. We would appreciate the opportunity to address your concerns first.

For CCPA/CPRA complaints, consumers may contact the California Privacy Protection Agency or the California Attorney General’s office.