Archgram
    Archgram.io

    Privacy Policy

    Last updated: October 7, 2026

    1. Introduction

    Archgram.io ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered architecture diagramming platform.

    This policy complies with the General Data Protection Regulation (GDPR), the Personal Information Protection and Electronic Documents Act (PIPEDA), the California Consumer Privacy Act (CCPA), and other applicable privacy laws.

    2. Information We Collect

    Account Information: When you create an account, we collect your email address, display name, and optionally a profile photo (via OAuth providers like Google).

    Diagram Data: We store diagrams you create, including titles, code, and descriptions. This data is associated with your account.

    Usage Data: If you accept analytics in the cookie notice, we record which features are used (for example "diagram exported") together with a random session identifier and the page path. We never record diagram content or prompts in this data. If you decline, we record nothing. We also keep basic AI usage records (which feature, how many credits, whether it succeeded) to enforce plan limits.

    Error Reports: When the app crashes, it sends a short report (message, technical stack, page path, browser and app version) so we can fix the problem. These reports never include diagram content. We keep analytics events and error reports for 90 days.

    Page Views: Our hosting provider, Cloudflare, counts page views for the website using Cloudflare Web Analytics, which does not use cookies and does not track you across sites.

    Cookies and local storage: We store what is needed to keep you signed in and to remember your settings and your cookie choice in your browser. We do not use tracking or advertising cookies.

    3. How We Use Your Information

    • To provide and maintain our service
    • To authenticate your identity and manage your account
    • To store and retrieve your diagrams
    • To enable team collaboration features
    • To improve our AI diagram generation capabilities
    • To send service-related communications

    4. Legal Basis for Processing (GDPR)

    We process your personal data under the following legal bases:

    • Contractual necessity: Processing required to provide the service you signed up for
    • Legitimate interests: Improving our service, preventing fraud, and ensuring security
    • Consent: Where explicitly provided (e.g., marketing communications)

    5. Data Sharing & Third Parties

    We do not sell, trade, or rent your personal information. We may share data with:

    • Infrastructure providers: Cloudflare (website hosting and page-view statistics) and Supabase (database, sign-in and server functions). Our database is hosted in Seoul, South Korea (Supabase region ap-northeast-2), so your account and diagram data are stored and processed there.
    • AI providers: When you use an AI feature, the diagram or text you are working on is sent to the AI provider in use: ours, or your own if you added an AI key (we store such keys encrypted). Each provider handles that data under its own terms and retention.
    • Payment processors: Stripe, for subscription billing (we do not store credit card details)
    • Law enforcement: When required by law or to protect our legal rights

    6. Your Rights

    Depending on your jurisdiction, you have the following rights:

    • Access: Request a copy of your personal data
    • Rectification: Correct inaccurate personal data
    • Erasure: Request deletion of your personal data ("Right to be Forgotten")
    • Portability: Export your data in a machine-readable format
    • Restriction: Limit how we process your data
    • Objection: Object to data processing based on legitimate interests
    • Withdraw Consent: Withdraw consent at any time where processing is based on consent

    To exercise any of these rights, contact us at privacy@archgram.io.

    7. Data Retention

    We retain your data for as long as your account is active. Upon account deletion, we remove your personal data within 30 days. Anonymized usage data may be retained indefinitely for analytics purposes.

    8. Data Security

    We implement industry-standard security measures including:

    • Encryption in transit (TLS/HTTPS) and at rest
    • Row-level security policies on all database tables
    • Secure password hashing and leaked password protection
    • Regular security audits

    9. International Data Transfers

    Your data may be processed in jurisdictions outside your country of residence. We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) for transfers from the EU/EEA.

    10. Children's Privacy

    Our service is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us.

    11. CCPA/US State Law Disclosures

    California residents and residents of other US states with privacy laws have additional rights:

    • Right to Know: What personal information we collect and how it's used
    • Right to Delete: Request deletion of your personal information
    • Right to Opt-Out: We do not sell personal information
    • Non-Discrimination: We will not discriminate against you for exercising your rights

    12. PIPEDA (Canada) Disclosures

    Canadian users have the right to access, correct, and challenge the accuracy of their personal information. We obtain meaningful consent before collecting, using, or disclosing personal information. Contact our Privacy Officer at privacy@archgram.io.

    13. Changes to This Policy

    We may update this Privacy Policy periodically. We will notify you of material changes via email or an in-app notification. Your continued use of the service after changes constitutes acceptance.

    14. Contact Us

    For privacy-related inquiries: