Privacy Policy

Last updated: [DATE]

This Privacy Policy explains how Arcyto ("Arcyto", "we", "us", "our") collects, uses, and shares personal data when you use the Arcyto website at arcyto.com, the Arcyto web app at app.arcyto.com, and our related services (together, the "Service"). The Service provides a personalised daily financial brief, a stock watchlist, and a macro/economic calendar.

We are based in Germany and established in the European Union, so this policy is written to comply with the EU General Data Protection Regulation (GDPR). If you are a California resident, please also read the dedicated California Privacy Rights section below.

Note on financial content. The briefs, headlines, audio, chat answers, prices, and calendar entries shown in the Service are for information only and are not financial, investment, or tax advice. This Privacy Policy concerns only how we handle your personal data.

1. Who is responsible for your data (Controller)

The controller responsible for processing your personal data under the GDPR is:

Mo Sharifi (operating as a sole trader, trading as "Arcyto") [POSTAL ADDRESS] Berlin, Germany

Privacy contact: hello@arcyto.com

Publication note (remove before publishing): The controller's full legal name and postal address above are legally mandatory under GDPR Art. 13(1)(a) — they are not optional drafting placeholders. An unidentifiable controller is itself a transparency breach. The legal name is filled in; replace [POSTAL ADDRESS] with the operator's full Berlin postal address (a ladungsfähige Anschrift — street + number, no PO box) before this policy goes live. The same address placeholder appears in Section 14 and must be filled there too.

We have not appointed a Data Protection Officer, as we are not legally required to do so. You can direct all privacy questions and rights requests to the contact address above.

For our full legal-disclosure details (Impressum), see our Imprint.

2. A note on our anonymous-first design (important)

Arcyto is designed to let you start using the Service before you create an account or provide an email address. When you first open the web app, our authentication provider (Supabase) issues an anonymous identity — a randomly generated user ID stored against your browser session — so that your onboarding choices (such as your watchlist, experience level, and topic preferences) can be saved as you go.

If you later choose to create a permanent account, this same anonymous user ID is kept and upgraded into your account. This means that personalisation data you provided while anonymous becomes associated with your account once you sign in.

We rely on this design to deliver the core onboarding experience you have requested. We explain each specific data category and its legal basis in Section 4.

Notice at the point of collection. Because the web app begins collecting data (for example, your watchlist and onboarding preferences) during this anonymous-first onboarding, this Privacy Policy also serves as our notice at or before the point of collection. The categories of data we collect and the purposes for which we use them are set out in Sections 4 and 11, and the onboarding screens link to this policy before your onboarding data is captured.

3. Where personal data comes from

We collect personal data from three sources:

• Directly from you — for example, the email address and (where applicable) password you provide when creating an account, your watchlist selections, your onboarding preferences, questions you type into the "Ask Arcyto" chat, and your details if you join the waitlist.
• Automatically — for example, anonymous/session identifiers, device and connection data, and limited diagnostic data, generated as you use the Service.
• From third parties — if you sign in with a third-party provider (such as Google or Apple), we receive certain profile information from that provider (see Section 4.A). [VERIFY before publication: third-party sign-in is referenced in our code but appears marked "coming soon" in places. Confirm which providers (Google, Apple) are live in production. If a provider is not yet enabled, remove its references from Sections 3, 4.A, 6, and 11 so we do not disclose processing that is not actually occurring.]

4. What personal data we process, why, and on what legal basis

The tables below describe every category of personal data we process, grouped by purpose. "Legal basis" refers to GDPR Article 6.

A. Account identity

B. Anonymous and session identifiers

C. Your watchlist and personalisation preferences

D. AI-generated brief and chat ("Ask Arcyto")

E. Authentication and transactional email

F. Waitlist (landing page)

G. Push notifications (if you opt in)

H. Technical, diagnostic, and security data

I. Analytics

5. Cookies and local storage

We use only strictly necessary cookies and browser storage. We do not use advertising cookies, third-party tracking cookies, or cross-site tracking.

Because our on-device storage is limited to what is strictly necessary or functional for features you request, we do not display a cookie consent banner. Our analytics (Section 4.I) is cookieless and stores nothing on your device.

For counsel (remove before publication): The no-banner position rests on the analytics being treated as consent-exempt under its cookieless design. As flagged in Section 4.I, this is defensible but not settled for a German-established controller; please confirm before publication.

Google Fonts

The web app loads one icon font (Material Symbols) from Google's Fonts CDN (fonts.googleapis.com). When your browser loads that font, your IP address is transmitted to Google (a recipient in the United States). We rely on our legitimate interest (Art. 6(1)(f)) in rendering the interface correctly; this is an international transfer covered by Section 7 (Google as recipient).

Action before publication (preferred fix): Self-host the Material Symbols font so no request is made to Google's CDN. German courts have treated dynamic Google Fonts embedding as a GDPR violation. If the font is self-hosted before launch, delete this "Google Fonts" subsection and remove Google Fonts as a recipient from Sections 6 and 7. If it is retained, keep this disclosure live.

6. Sub-processors and recipients of your data

We use the following service providers ("sub-processors") to operate the Service. We do not sell your personal data. We put in place data-processing agreements with our processors where required, so that they process your data only on our instructions.

Action before publication: Confirm that a signed data-processing agreement (and, for US recipients, the relevant transfer mechanism in Section 7) is actually in place for each processor listed below before stating it as fact.

DNS provider (not a recipient of your personal data): Our domain's DNS is managed by Cloudflare in a DNS-only configuration (no proxying of application traffic). Cloudflare resolves DNS queries but does not process the application data described in this policy, so it is not listed as a sub-processor.

Market-data sources (not recipients of your personal data): We obtain prices and company news from third-party market-data providers (currently Finnhub and CoinGecko). We send these providers only public ticker/coin identifiers — not your identity or your personal watchlist linked to you. [VERIFY before publication: confirm the exact set of live market-data providers (e.g. whether a Yahoo-based EU provider is also in use) and list them all.]

This list may change as our Service evolves; we will keep this section up to date.

7. International data transfers

Several of our sub-processors are located in, or transfer data to, the United States (see Section 6). When we transfer personal data outside the European Economic Area, we rely on appropriate safeguards under the GDPR — the EU–US Data Privacy Framework (DPF) where a provider is certified, and/or the European Commission's Standard Contractual Clauses (SCCs) with supplementary measures where appropriate.

The intended mechanism per recipient is set out below.

You can request more information about these safeguards using the contact details in Section 1.

Regions to verify before publication (each changes the transfer position): (1) Supabase project region — this is our primary datastore and an EU region is available, so confirming it is the single most important item here; (2) Sentry organisation region; (3) Google Cloud Storage bucket region for the generated audio. After verification, map each remaining US recipient to its actual mechanism (DPF-certified vs SCCs) and remove any recipient confirmed to be EU-hosted from this table and from Section 6.

8. How long we keep your data

When data is no longer needed, we delete or anonymise it.

Action before publication: The TODO/VERIFY items above are not optional drafting notes — Art. 13(2)(a) requires a stated retention period or the criteria used to determine it, and Art. 5(1)(e) (storage limitation) does not permit indefinite retention by default. Resolve each item with a concrete period or determination criterion.

9. How we protect your data

We apply technical and organisational measures appropriate to the risk, including:

• Encryption in transit (HTTPS/TLS) across the website, app, and backend.
• Row-level security in our database, so that user records are accessible only to the owning account; internal/system tables are restricted to service-level access.
• Stateless, token-based access control — our backend authorises every request against your signed identity token.
• Minimised diagnostics — error tracking is configured to exclude default personal data, and IP addresses for waitlist abuse-prevention are stored only as one-way hashes.

No method of transmission or storage is completely secure, but we work to protect your data and to address vulnerabilities responsibly. If a personal-data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify affected users without undue delay, as required by GDPR Art. 34, and will notify the competent supervisory authority where Art. 33 applies.

10. Your rights under the GDPR

Subject to the conditions in the GDPR, you have the right to:

• Access the personal data we hold about you (Art. 15);
• Rectify inaccurate or incomplete data (Art. 16);
• Erase your data ("right to be forgotten") (Art. 17);
• Restrict processing in certain circumstances (Art. 18);
• Data portability — receive your data in a structured, machine-readable format (Art. 20);
• Object to processing based on legitimate interests (Art. 21) — this includes our waitlist abuse-prevention (Section 4.F), our technical/diagnostic and security processing (Section 4.H), and our cookieless analytics (Section 4.I);
• Withdraw consent at any time where we rely on consent (e.g. notifications, waitlist email) — this does not affect processing carried out before withdrawal.

How to exercise your rights. Please email hello@arcyto.com. We will respond within one month, as required by Art. 12(3) (extendable by two further months for complex or numerous requests, with notice to you).

Please note: We do not yet offer a self-service account-deletion or data-export feature inside the Service. Until that is available, we handle access, deletion, and export requests manually when you contact us at the address above.

Internal action (remove before publication): This is a product gap, not just a drafting note. The GDPR requires that these rights are actually deliverable, not merely promised, and the one-month Art. 12(3) deadline must be met. Implement in-product data export and erasure to fully satisfy Arts. 15, 17, and 20; until then, maintain an operational runbook so manual requests can be fulfilled within the deadline at the volumes expected.

Right to complain. If you believe we have mishandled your data, you may lodge a complaint with a supervisory authority. Our lead supervisory authority is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information) Alt-Moabit 59–61, 10555 Berlin, Germany https://www.datenschutz-berlin.de

You may also complain to the supervisory authority in your own EU country of residence.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act, as amended by the CPRA. This section, read together with Sections 4 and 6, also serves as our notice at collection under Cal. Civ. Code § 1798.100(b): we disclose below the categories of personal information we collect and the purposes for which we use them at or before the point we collect that information, and our onboarding screens link to this policy before collecting onboarding data.

Categories of personal information we collect

We collect the following statutory categories of personal information (described in more detail in Section 4):

Categories of sources. We collect this information (a) directly from you (account details, watchlist, onboarding preferences, chat questions, waitlist details); (b) automatically from your device and use of the Service (identifiers, network activity, diagnostic data, analytics); and (c) from a third-party sign-in provider (Google or Apple), if you choose to use one (profile information).

Business and commercial purposes. We collect and use this information for the purposes described throughout this policy — providing and securing your account, personalising your brief/watchlist, generating AI content, sending transactional email, operating the waitlist, ensuring security and reliability, and measuring and improving the Service.

Categories of third parties to whom we disclose personal information for a business purpose. We disclose personal information to our service providers as described in Section 6: Supabase (auth/database), Google Cloud / Gemini (hosting, logging, storage, AI generation), Resend (email delivery), Apple (inbound support email), Vercel (hosting and analytics), and Sentry (error monitoring). In the preceding 12 months we disclosed the categories of personal information listed above to these service providers for the business purposes described in this policy.

We do not sell or share your personal information

We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising, as those terms are defined under the CPRA. We have not done so in the preceding 12 months.

Sensitive personal information (SPI)

We collect limited sensitive personal information — your account log-in credentials, held only in hashed form by our authentication provider. We use SPI solely to authenticate you and provide the Service; we do not use it to infer characteristics about you and we do not use or disclose it beyond the purposes permitted under the CPRA. Because of this, the CPRA right to limit the use of sensitive personal information does not apply.

Your California rights

Subject to the law, you have the right to:

• Know / access the personal information we have collected about you, including the categories of sources, the business/commercial purposes for collecting it, and the categories of third parties to whom we disclose it;
• Delete personal information we hold about you;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information — not applicable, because we do not sell or share it; and
• Non-discrimination — we will not discriminate against you for exercising your CCPA rights. We will not deny you the Service, charge you a different price, or provide you a different level or quality of service for exercising your rights. We do not offer financial incentives in exchange for the collection, sale, or sharing of personal information.

How to exercise your California rights

To exercise any of these rights, email hello@arcyto.com. We will acknowledge your request within 10 business days and respond within 45 calendar days, extendable by a further 45 days where reasonably necessary, with notice to you.

Verification. We will verify your request using a method reasonable and proportionate to the sensitivity of the data. For account holders, we verify by reference to information associated with your account. For non-account holders (for example, waitlist subscribers, whose data we hold without an account), we verify by reference to the email address on file. For deletion requests, we may ask you to confirm the request before we act on it.

Authorised agents. You may use an authorised agent to submit a request on your behalf. We may require the agent to provide proof of written authorisation signed by you, and we may require you to verify your own identity directly with us or to confirm that you authorised the agent.

California minors

The Service requires a minimum age of 18 (see Section 12), so we do not knowingly collect personal information from minors. In any event, because we do not sell or share personal information, the CCPA opt-in requirement for consumers under 16 (Cal. Civ. Code § 1798.120(c)) is not triggered. If we ever begin to sell or share personal information, we will obtain the affirmative opt-in consent required by law before doing so.

12. Children

The Service is not directed to children. You must be at least 18 years old to use the Service (see the Terms of Service). We apply this single minimum age of 18 to all users worldwide. We do not knowingly collect personal data from anyone below this age. If you believe someone under 18 has provided us personal data, contact hello@arcyto.com and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top and, where appropriate, notify you through the Service. Your continued use of the Service after an update means you accept the revised policy.

14. How to contact us

For any privacy question or to exercise your rights:

Email: hello@arcyto.com Post: Mo Sharifi, [POSTAL ADDRESS], Berlin, Germany

Publication note (remove before publishing): Fill in [POSTAL ADDRESS] here with the same legally mandatory controller address required in Section 1.

See also our Imprint and Terms of Service.