Privacy Policy
Version 0.2, effective 22 October 2026.
This policy explains how Arcscribe Ltd collects and uses personal data through Arcela and our website, arcela.co.uk, and the rights you have.
1. Who we are
Arcela is provided by Arcscribe Ltd, registered in England and Wales, company number 16921982, registered office 18 Colegate, Norwich, NR3 1BQ, United Kingdom. We're registered with the Information Commissioner's Office (ICO), registration number ZC072411.
For any privacy question or request, email contact@arcscribe.co.uk or write to us at our registered office.
2. Two different roles
How we handle personal data depends on whose data it is.
-
We're the controller for data about the businesses that use Arcela and their users, people who contact us, and visitors to our website. This policy covers that data.
-
We're a processor for data that businesses keep in Arcela about their customers. That includes:
- people who call, text or email a business that uses Arcela;
- people who fill in a business's booking page or enquiry form;
- the client records, recordings, transcripts, messages, bookings, quotes and invoices a business keeps.
The business is the controller of that data. We process it only on their instructions, under our Data Processing Agreement.
If you contacted a business that uses Arcela, please ask that business about your data. We'll help them respond.
3. What we collect, and why
| What | Examples | Why we use it | Lawful basis |
|---|---|---|---|
| Account details | Name, email, mobile number, role, password (stored only as a secure hash) | To create and run your account, sign you in and send alerts | Contract |
| Business details | Trading and legal name, structure, company number, VAT number, addresses, industry, team size, opening hours | To set up your workspace, show correct details on invoices, and meet tax and legal duties | Contract; legal obligation |
| Sole trader addresses | A business address that may be your home | As above. We never show it publicly. | Contract; legal obligation |
| Billing details | What you subscribe to, invoices, payment status, usage. Card details are held by Stripe, not us. | To bill you and keep financial records | Contract; legal obligation |
| Payments module details | Your Stripe account ID, payment amounts and statuses, our fees. Stripe carries out identity checks and holds that data itself. | To show payments in Arcela and charge our fee | Contract |
| Agreement records | Which documents you accepted, the version, the time, your IP address and browser details | To prove what was agreed and by whom | Legitimate interests (keeping reliable records) |
| Usage, device and security data | Sign-ins, features used, IP address, browser, error logs | To keep Arcela secure, prevent abuse, fix problems and improve the service | Legitimate interests |
| Support and abuse reports | Emails and messages you send us | To help you and investigate misuse | Contract; legitimate interests |
| Marketing preferences | Whether you've agreed to product emails, and when | To send product updates if you opt in | Consent (withdraw any time) |
| Onboarding answers | What you want help with, how you heard about us | To set up Arcela for you and understand what works | Legitimate interests |
| Website contact form | Name, email, business, message | To reply to you | Legitimate interests |
| "Tell me when it's ready" sign-ups | Email address, the module you're interested in | To tell you when it launches | Consent |
| Website analytics | Pages visited, approximate location from IP (not stored), device type, referring site | To understand how our website is used and improve it | Consent (see our Cookie Policy) |
| Advertising measurement | Whether a visit from an advert led to a sign-up | To measure our adverts | Consent (see our Cookie Policy) |
Public sources:
- Companies House: when you look up your company, we get your company details from Companies House.
- HMRC: when you give a VAT number, we may check it with HMRC.
We don't sell personal data. We don't make automated decisions that have legal or similarly significant effects on you.
4. AI and your data
Arcela uses AI providers to transcribe calls, understand what callers need and produce speech. We don't use your data, or your customers' data, to train AI models. We configure our AI providers so that they don't use it to train theirs. They process it only to provide their service to us.
5. Who we share data with
We use trusted providers to run Arcela and our website. They may only use the data to provide their service to us.
| Provider | What they do | Where |
|---|---|---|
| Hetzner Online GmbH | Data centre hosting our servers: application, database, file storage, email, website analytics | Germany |
| Cloudflare, Inc. | DNS, network security, bot protection on forms | UK, EU and US |
| Twilio Inc. | Phone numbers, calls and texts | US, UK and EU |
| Deepgram, Inc. | Speech to text and text to speech | US |
| Anthropic, PBC | AI language model for the receptionist | US |
| Stripe Payments UK Ltd | Subscription billing, and the Payments module | UK, EU and US |
| Mapbox, Inc. | Map images for addresses | US |
| Google, Meta, TikTok | Advertising measurement, only if you accept marketing cookies on our website | US and elsewhere |
We send email from our own mail server, which we run on the same servers in Germany, so no outside email company sees it. Address and business checks send only postcodes to postcodes.io, company numbers to Companies House, and VAT numbers to HMRC.
If you allow notifications in your browser, alerts pass in encrypted form through your browser maker's push service (for example Google, Apple or Mozilla).
Other sharing:
- Advisers: we may share data with professional advisers, such as accountants and lawyers.
- When required: we'll share data if the law requires it, or to protect our rights, our users or the public. This includes our telecoms and payments partners when they investigate misuse.
- If the business changes hands: if our business is sold or reorganised, data may transfer to the new owner under this policy.
6. International transfers
Our servers are in Germany, which the UK recognises as giving adequate protection. Some providers process data outside the UK, mainly in the United States. When they do, we use the protections UK law requires:
- the UK Extension to the EU-US Data Privacy Framework, where the provider is certified; or
- the UK International Data Transfer Agreement or Addendum, together with an assessment of the risks.
7. How long we keep data
| Data | How long |
|---|---|
| Account and business details | While your account is open, then 30 days to let you export, then deleted |
| Billing and financial records | 6 years after the end of the financial year they relate to, as tax law requires |
| Agreement records | 6 years after your account closes, in case of a legal claim |
| Security and usage logs | Up to 12 months |
| Support messages and abuse reports | Up to 2 years after the issue is resolved |
| Marketing consent records | While you're subscribed, plus 2 years as proof of consent |
| Website contact form messages | Up to 2 years |
| "Tell me when it's ready" sign-ups | Until we've told you, or you unsubscribe |
| Website analytics | Up to 25 months, without IP addresses |
Backups are overwritten within 35 days of data being deleted.
Data we process for businesses is kept according to that business's settings and our Data Processing Agreement. Unless the business chooses otherwise, our defaults are:
| Data | Default |
|---|---|
| Call recordings and transcripts | 90 days |
| Call details and summaries | 12 months |
| Texts | 12 months |
| Client records and bookings | While the business's account is open |
| Photos and files | Deleted with the record they belong to |
8. Keeping data safe
We protect data in several ways:
- encryption in transit;
- access controls and multi-factor authentication for our staff;
- separation of each business's data;
- encrypted backups;
- monitoring and audit logs.
Only people who need access have it. No system is perfectly secure. If a breach puts you at risk, we'll tell you and the ICO as the law requires.
9. Your rights
You have the right to:
- access the personal data we hold about you;
- correct data that's wrong or incomplete;
- ask us to delete your data;
- restrict or object to how we use it, including objecting to direct marketing at any time;
- move data you gave us to another service (data portability); and
- withdraw consent where we rely on it, without affecting what we did before.
To use any of these rights, email contact@arcscribe.co.uk. We'll respond within one month. Some rights are limited where we must keep data by law.
If you're unhappy with how we've handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
10. Children
Arcela is for businesses and isn't intended for anyone under 18. We don't knowingly collect personal data from children through sign-up.
11. Changes to this policy
We may update this policy. The date of the latest version is shown at the top, and we'll tell you about significant changes by email or in Arcela.