ArcWardyn Privacy Notice

Effective Date: July 25, 2026 Version: 2026-07-25.1 Last Updated: July 25, 2026

This Privacy Notice explains how MPU LLC, a Washington limited liability company and the operator of the ArcWardyn service (“MPU LLC,” “ArcWardyn,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information.

It applies to ArcWardyn websites, customer-account pages, browser extensions (including the Safari and Chrome extensions), add-ins, applications, application programming interfaces, hosted email-security service, support features, and related services (collectively, the “Service”).

This Notice does not govern the independent privacy practices of an email provider, browser or operating-system provider, application marketplace, payment processor, artificial-intelligence provider, or other third party. Their own privacy notices apply to information they process for their purposes.

1. Privacy Summary

• ArcWardyn connects supported mailboxes to a durable ArcWardyn customer account. Mailbox provider credentials stay in ArcWardyn’s server-side credential vault and are not stored in a Safari or Chrome extension.
• Gmail and Microsoft connections use read-only mailbox scopes. Supported Yahoo, iCloud, and legacy IMAP connections require an app-specific password, secure mail key, or equivalent scoped credential; ArcWardyn does not ask for or permit storage of a primary mailbox password.
• ArcWardyn automatically scans only Inbox and Spam/Junk messages in the rolling 14-day active scan window. An explicit manual scan may process an older opened message.
• In the normal processing path, ArcWardyn stores message summary and risk metadata, not raw full message bodies, raw HTML, or raw attachments. Legacy compatibility records may still contain encrypted or redacted content until they are deleted under ArcWardyn’s cleanup process.
• Some escalated classifications may send minimized email text and structured risk information to a configured cloud AI provider. ArcWardyn does not persist raw AI prompts or raw AI responses for customer-mail processing and does not use raw customer email bodies or raw attachments to train or fine-tune models under the current product design.
• Subscription purchase and payment management occur on the ArcWardyn account website. Stripe collects payment details. The Safari and Chrome extensions do not embed Checkout, collect card data, or create payment sessions.
• ArcWardyn does not sell personal information for money or share it for cross-context behavioral advertising.

2. Information We Collect

2.1 Account and identity information

When you create or use an ArcWardyn account, we may collect:

• your email address;
• your account and customer identifiers;
• your password in a one-way salted and versioned hash form;
• email-verification status and hashed, expiring verification challenges;
• account status, authentication timestamps, and session-security information;
• the version, URL, fingerprint, method, and time associated with your acceptance of legal terms; and
• communications, requests, and feedback you send to us.

Customer session tokens and cross-site request-forgery tokens are stored by ArcWardyn only as hashes. The customer-account website uses secure session cookies needed to authenticate you, protect requests, and keep the account page working.

2.2 Connected mailbox and provider information

When you connect a mailbox, we may collect:

• the provider, mailbox address, provider account identifier, display name, connection status, and connection timestamps;
• read-only OAuth tokens for Gmail or Microsoft;
• an app-specific password, secure mail key, or equivalent scoped credential for a supported IMAP provider;
• provider sync cursors, retry timing, and other connection metadata; and
• information needed to validate, reconnect, disconnect, or troubleshoot the mailbox.

Mailbox OAuth tokens and scoped IMAP credentials are encrypted in the server-side credential vault. They are not returned to paired browser extensions, add-ins, or other client installations. ArcWardyn does not store a user’s primary mailbox password.

2.3 Email and security-analysis information

To provide email risk analysis, ArcWardyn may process:

• sender, recipient, reply-to, subject, received time, folder, unread state, provider labels, and other message headers or summary metadata;
• account-scoped hashes of supported provider message identifiers;
• links, domains, redirects, authentication indicators, mailing-list signals, and other security features;
• attachment names, types, sizes, hashes, and risk findings;
• limited message text or HTML needed for an active analysis, manual scan, unsubscribe review, or authorized support investigation;
• classifications, confidence values, rule hits, reasons, risk indicators, model and routing metadata, scan state, and verdict history; and
• acknowledgements, manual-scan requests, optional mailbox-action outcomes, and related security events.

The normal sync path stores message summaries, normalized link findings, sanitized attachment risk metadata, verdicts, analysis-job state, and a content hash. It does not store raw full body text, raw HTML, raw attachments, or extracted attachment text by default. Analysis may temporarily hold message content in memory or re-fetch it from the mailbox provider when needed.

ArcWardyn still has compatibility paths for legacy encrypted message-body or attachment-preview records. Those records may remain until a specific cleanup or account-deletion process removes them. A legacy preview should not be treated as fully anonymous even when best-effort redaction has been applied.

2.4 Browser extension, application, device, and usage information

ArcWardyn client software may collect or store:

• an installation type, platform, application version, capabilities, display name, creation time, and last-used time;
• an opaque pairing or client credential, with only a hash and short hash-derived preview stored on the ArcWardyn server;
• settings and disposable local cache data needed to display scan status and warnings;
• pseudonymous local hashes used to correlate a webmail row with the correct server result;
• supported webmail page information needed to identify the selected or opened message and display ArcWardyn’s interface; and
• technical events such as feature usage, requests, errors, availability codes, and performance information.

The Safari and Chrome extensions request access to the supported webmail sites and ArcWardyn service endpoints needed to provide their features. They are not intended to read unrelated browsing history or unrelated websites.

ArcWardyn’s use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.

2.5 Billing and subscription information

ArcWardyn may receive and store:

• billing email address;
• Stripe customer, subscription, price, Checkout, portal, and event identifiers;
• selected plan, subscription or trial status, service period, cancellation status, entitlement, mailbox-seat usage, and payment-recovery state; and
• limited billing audit and fraud-prevention metadata.

Stripe collects and processes payment-card and other payment details through Stripe-hosted Checkout and Customer Portal pages opened from the ArcWardyn account website. ArcWardyn does not receive or store a full payment-card number or card security code.

The Safari and Chrome extensions do not embed Stripe Checkout, collect payment details, or call ArcWardyn billing or payment-session endpoints. The Chrome extension may display plan and entitlement status received from ArcWardyn. Account purchase and payment management remain on the ArcWardyn account website.

2.6 Support, security, and operational information

We may collect:

• support-case title, summary, status, priority, notes, and timestamps;
• the purpose, scope, duration, status, and audit history of a customer-approved support grant;
• sanitized audit events, access decisions, error categories, request and rate-limit events, and incident-response records;
• AI provider, model, token, cost, latency, routing, and success or failure metadata; and
• aggregate service-health, queue, usage, and performance statistics.

Routine administration is designed to use aggregate or metadata-only views. A support worker may retrieve the content of a specific message only through an active, scoped, time-limited support case and grant. Those reads are audited and do not create a new raw-message storage path.

3. Where Information Comes From

We receive information:

• directly from you when you create an account, configure the Service, make a purchase, request support, or communicate with us;
• from a mailbox provider after you authorize a supported connection;
• from an ArcWardyn browser extension, add-in, application, or paired installation;
• from Stripe about a website-based payment or subscription;
• from service providers that operate infrastructure, transactional email, security, or AI processing for us; and
• automatically from operation of the Service, including security, audit, usage, and diagnostic events.

4. How We Use Information

We use personal information to:

• create, authenticate, secure, and administer customer accounts;
• connect authorized mailboxes and maintain server-side scanning while clients are offline;
• analyze messages, links, attachments, sender patterns, and related signals for phishing, scam, malware, and other security risks;
• display scan status, warnings, explanations, and account information in supported clients;
• provide manual scans, optional unsubscribe review, and other requested features;
• manage subscriptions, trials, entitlements, billing recovery, and fraud prevention;
• deliver verification, service, security, and legal notices;
• respond to support requests and investigate incidents under scoped access controls;
• measure, debug, secure, maintain, and improve the Service;
• create and use structured risk signals, aggregated statistics, deidentified information, and derived security learnings;
• enforce our terms and protect users, ArcWardyn, and others; and
• comply with law, valid legal process, and recordkeeping requirements.

We do not use raw customer email bodies or raw attachments to train or fine-tune models under the current product design. We may use structured risk signals and aggregated or deidentified information to improve ArcWardyn’s rules, classifiers, threat patterns, and other security features.

5. Artificial Intelligence Processing

ArcWardyn uses deterministic rules first. When configured criteria call for escalation, ArcWardyn may send a minimized classification payload to a configured AI service. Depending on ArcWardyn’s active configuration, cloud processing may be provided by OpenAI, Google, or Anthropic. ArcWardyn may also use a locally operated model that does not send the payload to a cloud AI provider.

Before a cloud AI submission, ArcWardyn’s relay is designed to mask sender local-parts, truncate subject, snippet, body, reasons, and other fields, and exclude raw attachments. AI is used as an advisory classifier and cannot independently browse, change mailbox policy, or create provider actions.

ArcWardyn’s application database does not retain raw prompts or raw responses for customer-mail AI processing. It may retain metadata such as provider, model, token counts, estimated cost, latency, status, structured decision signals, and related audit events. OpenAI response storage is disabled by default in ArcWardyn’s configuration. Retention and training controls at other AI providers may also depend on ArcWardyn’s account-level provider settings and contracts.

6. How We Disclose Information

We may disclose personal information:

• to infrastructure, database, content-delivery, security, and transactional-email providers, including Amazon Web Services, to operate and protect the Service;
• to Stripe for website-based Checkout, payment processing, subscription administration, fraud prevention, and Customer Portal services;
• to a configured cloud AI provider, such as OpenAI, Google, or Anthropic, for a minimized classification request;
• to the mailbox provider you connect, when needed to authenticate, retrieve, re-fetch, or otherwise perform a feature you request;
• to contractors and support providers that need the information to perform services for ArcWardyn under confidentiality and access restrictions;
• when you direct or authorize the disclosure, including through a scoped support grant;
• to comply with applicable law, a valid subpoena, court order, or other legal process, or to protect rights, safety, and security; or
• in connection with a financing, acquisition, merger, reorganization, sale of assets, or similar transaction, subject to appropriate confidentiality and legal requirements.

ArcWardyn does not sell personal information for money. ArcWardyn does not share personal information for cross-context behavioral advertising and does not use customer email content to serve advertising.

7. Retention

We retain information for the time reasonably necessary to provide and secure the Service, meet the purposes described in this Notice, resolve disputes, enforce agreements, and comply with legal, tax, accounting, and security obligations.

Current product-specific practices include:

• Active automatic scan data: Automatic scanning and the normal server/client feed are limited to Inbox and Spam/Junk messages in a rolling 14-day window. Messages that leave scope are removed from active local scan state through normal cleanup. An explicit older-message manual scan may retain its result briefly so it can be displayed before normal cleanup resumes.
• Raw message content: Raw full bodies, raw HTML, raw attachments, and extracted attachment text are not stored in the normal path. Content may exist temporarily in memory during processing. Legacy encrypted or redacted compatibility rows may remain until cleanup or account deletion.
• Mailbox credentials: Encrypted OAuth tokens or scoped IMAP credentials are retained while needed to maintain the authorized mailbox connection. Removing local ArcWardyn data does not necessarily revoke a provider-side OAuth grant or app-specific password; those may also need to be revoked with the provider.
• Client data: Installation records and their server-side credential hashes remain while the installation is authorized. Revoking an installation deletes its active installation and compatibility credential rows while preserving redacted security audit history.
• Account, legal, billing, and security records: Account identity, legal-acceptance evidence, billing history, fraud-prevention records, support-case history, and sanitized audit records may be retained longer when reasonably necessary for the account, legal obligations, security investigations, or dispute resolution.
• Backups: Information in backups may remain until it is overwritten under ArcWardyn’s backup schedule or must be retained for security, legal, or disaster-recovery purposes.
• Aggregated and deidentified information: Information that is no longer reasonably linked to an individual may be retained and used for security, analytics, and product-improvement purposes as permitted by law.

8. Security

ArcWardyn uses administrative, technical, and organizational safeguards designed to protect personal information. Current safeguards include encryption in transit, encrypted server-side credential storage, hashed customer and client credentials, read-only OAuth scopes where available, access controls, scoped support grants, audit logging, data minimization, and redaction of sensitive logging fields.

No system is perfectly secure. You are responsible for protecting your devices, ArcWardyn account, mailbox-provider account, recovery methods, and any app-specific password or secure mail key. Please contact hello@arcwardyn.ai promptly if you believe an ArcWardyn account or installation has been compromised.

9. Your Choices and Privacy Rights

You may:

• disconnect or reauthorize a mailbox through the available ArcWardyn and provider controls;
• revoke an individual client installation without disconnecting the account-owned mailbox or other installations;
• revoke a provider OAuth grant or app-specific password through the provider;
• manage or cancel a paid subscription through the Stripe Customer Portal reached from the ArcWardyn account website;
• control browser-extension permissions through Safari, Chrome, or the applicable platform;
• opt out of non-essential promotional email by using its unsubscribe method; and
• request access, correction, deletion, restriction, objection, portability, or other privacy rights that apply where you live.

To make a privacy request, email legal@arcwardyn.ai with the subject “Privacy Request.” We may need to verify your identity and authority before acting. Some information may be retained when required or permitted for legal compliance, security, fraud prevention, billing records, dispute resolution, or protection of other people’s rights.

ArcWardyn currently does not respond to browser “Do Not Track” signals because the Service does not use personal information for cross-context behavioral advertising. Where legally required, ArcWardyn will honor applicable opt-out preference signals for covered processing.

10. Notice for Residents of Certain U.S. States

Depending on where you live and subject to legal exceptions, you may have rights to know or access the personal information we collect, obtain a portable copy, correct inaccurate information, delete information, and opt out of certain sale, sharing, targeted-advertising, or profiling practices.

In the preceding 12 months, the categories described in Section 2 may include identifiers; customer records; commercial and subscription information; Internet or other electronic-network activity; geolocation inferred from network information at a general level; audio, electronic, or communications information contained in submitted email; professional information if you provide it; inferences and security classifications; and account credentials or email content that may be considered sensitive personal information under some laws.

We collect and disclose these categories for the business and commercial purposes described in Sections 4 and 6. We do not sell personal information for money or share it for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics for advertising.

We will not discriminate against you for exercising an applicable privacy right. An authorized agent may submit a request where permitted by law, but we will require appropriate proof of authority and may still verify your identity directly.

11. International Processing

ArcWardyn and its service providers may process information in the United States and other countries where privacy laws may differ from those in your location. Where required, ArcWardyn will use an approved transfer mechanism or other lawful safeguard for an international transfer.

12. Children

The Service is intended to be acquired, configured, and managed by adults. It is not directed to children under 13, and a child under 13 may not create an ArcWardyn account or independently accept ArcWardyn’s terms.

If ArcWardyn permits a parent or legal guardian to connect a minor’s mailbox, that adult must have authority to do so and is responsible for the required consent and supervision. If you believe a child provided personal information without appropriate authorization, contact legal@arcwardyn.ai.

13. Changes to This Notice

We may update this Notice as the Service, our practices, or legal requirements change. We will post the current version at https://arcwardyn.ai/legal/privacy/ and identify its effective date. If a change is material, we will provide any additional notice or consent required by law.

14. Contact Us

• Operator: MPU LLC, operator of ArcWardyn
• Washington UBI: 605 809 558
• Privacy requests and legal questions: legal@arcwardyn.ai
• Security or support questions: hello@arcwardyn.ai
• Privacy Notice: https://arcwardyn.ai/legal/privacy/

Document fingerprint: sha256:23b4a5fe5682485f0acb18d44aadeecc1701a191423bc6f2fb9cfb9ef663c384