Privacy Policy
Common privacy criteria applied to ARC Group's website (arcgroup.kr), products including ARC Workspace (workspace.arcgroup.kr), and partner portal operations.
Common privacy criteria applied to ARC Group's website (arcgroup.kr), products including ARC Workspace (workspace.arcgroup.kr), and partner portal operations.
This English version is provided for convenience. The Korean version prevails in case of any conflict.
ARC Group (the "Company") values the personal data of its Users and complies with the Personal Information Protection Act of Korea (PIPA) and other applicable laws. This Privacy Policy explains how the Company collects, uses, retains, and destroys personal data in operating its website (arcgroup.kr), products such as ARC Workspace (workspace.arcgroup.kr), accounts (accounts.arcgroup.kr, myaccount.arcgroup.kr), the partner portal, and inquiry/consultation/proposal/recruitment/subscription processes. ■ Roles of the Company and customer organizations • The Company is the controller of personal data for website visitors, inquirers and applicants, and for the account and billing data of account holders. • For content that a customer organization stores in ARC Workspace (documents, sheets, files, calendar events, work records, etc.) and for member data the organization adds, that customer organization is the controller, and the Company processes the data only as a processor entrusted by the organization, within the organization's instructions and the terms of service. Members of an organization may exercise their rights regarding this content by contacting their organization's administrator.
The Company may collect the following personal data in the course of providing its services. • Website inquiries/consultations: name, email address, company name, phone number, inquiry details, budget, services of interest • Product account sign-up/login: name, email address, password (stored with one-way encryption), country, time zone, and language settings, organization (workspace) membership, subscription status • Social login (if chosen by the User): the unique identifier, email address, and name of the Google or Kakao account • Account security: 2-Step Verification data (authenticator app enrollment, passkey public keys, backup codes), login time, IP address, device and browser information, failed login records, security activity records • Use of ARC Workspace: content Users create or upload, such as documents, sheets, files, calendar events, and work records, and the information contained in it; sharing and permission settings; records of administrators' management actions (audit logs) • Partner portal account requests/login: company name, contact person, email address, additional requests, approval history, account permission information • Payments and subscriptions: payment status, subscribed product, billing cycle, transaction identifiers, payment event records (payment method details such as card numbers are collected directly by the payment provider Paddle and are not stored by the Company) • Recruitment and proposals: name, email address, phone number, resume, portfolio, career information, application details • Automatically collected data: IP address, browser type, OS, device information, cookies, visit time, page usage records, error logs
The Company may collect personal data through the following methods. • Submission of website inquiry/consultation/quote/proposal/subscription forms • Product account sign-up, login (including Google and Kakao social login), payment, and subscription management • When a customer organization's administrator adds member accounts • When a customer organization connects an external service such as Slack and imports its data into ARC Workspace • Partner portal account requests, approval, login, and project operations • Email, customer support, contract and operational discussions • Logs and access records generated automatically during service use, cookies, and analytics tools
Collected personal data is used within the scope of the following purposes. • Responding to inquiries, conducting consultations, providing service proposals and quotes • Creating product accounts, login authentication, 2-Step Verification and unusual-login checks, linking workspaces, managing subscription status • Providing ARC Workspace features (storing and sharing documents and files, search, AI features such as the AI assistant, place search and travel-time calculation for calendar events, etc.) • Reviewing partner portal account requests, issuing accounts, supporting project/document/operational collaboration • Processing payments, operating subscriptions, checking billing errors, handling refunds and cancellations • Service notices such as trial-end, subscription-end, and organization-deletion notices, customer support, incident response, security checks, and service stability • Usage analytics, quality improvement, and operational policy development • Legal compliance, dispute handling, and protection of rights
The Company destroys personal data without delay once the purpose of collection is achieved. However, data may be retained for certain periods as follows. • Product account data: until the account is deleted. When you request account deletion, the account data is deleted after a grace period of 14 days (you can cancel the deletion and restore the account by signing in during this period); data that must be retained by law, as listed below, is stored separately for the relevant period. • Customer organization (workspace) data: retained during the period of use. If an organization is suspended because its trial ended or its subscription ended, the organization's data is automatically deleted 60 days after the suspension date. The organization's administrators are notified by email 7 days before deletion. • Payment and subscription records: 5 years under the Act on the Consumer Protection in Electronic Commerce (even after an organization is deleted, its payment records are kept in a separate archive for 5 years and then deleted) • Access records and security/audit logs (including login records): 3 years (this includes the 3-month retention of login records required by the Protection of Communications Secrets Act) • Files and calendar events moved to trash: permanently deleted automatically after 30 days • Inquiry/consultation data: 1 year after completion • Recruitment application data: 1 year after the recruitment process ends • Partner portal request/operation data: 3 years after account or business relationship termination • Contract, dispute, and complaint handling data: 3 years after resolution The database is automatically backed up for disaster recovery, and backups and point-in-time recovery logs are retained for 7 days. Deleted data may therefore remain in backups for up to 7 days before it expires, and backups are not used for any purpose other than recovery during that period.
In principle, the Company does not provide Users' personal data to third parties, except in the following cases. • Where the User has given prior consent • Where disclosure is required by law • Paid subscription payments: the Company's paid subscriptions are processed by Paddle.com Market Limited (United Kingdom) as the Merchant of Record, which handles payment, tax calculation, and refunds. The email address, payment method, and billing details Users enter at checkout are collected directly by Paddle, and the Company passes the checkout session number, User account number, organization (workspace) number, and product/plan information to Paddle to link the payment. Paddle's processing of personal data is governed by Paddle's privacy policy. • External services connected by a customer organization: if a customer organization connects its own AI model key (OpenAI, Anthropic, Google AI Studio, etc.) or an external service (Slack, MCP servers, databases, etc.), the content needed for that feature is sent to that service when the feature is used. Such transfers follow the customer organization's choice and its own contract with that service, and the customer organization is responsible as the controller.
The Company entrusts personal data processing to the following processors for smooth service operation. When processing a customer organization's content, the Company sub-entrusts it to the processors below. • Google LLC (Google Cloud) — operation of servers (Compute Engine) and databases (Cloud SQL), storage of data and files / Storage location: Seoul region, Republic of Korea • Google LLC (Google Cloud Vertex AI) — generating AI assistant answers (when the customer organization has not connected its own AI key) and building document search indexes (embeddings) / Processing location: outside Korea (see Section 8) • Google LLC (Google Workspace Gmail) — sending service notices and notification emails / Processing location: outside Korea (see Section 8) • Google LLC (Google Analytics) — visit analytics / Processing location: outside Korea (see Section 8) • PostHog Inc. — visit analytics for the public website / Processing location: USA (see Section 8) • Kakao Corp. — Kakao login (if chosen by the User), place and address search for calendar events / Processing location: Republic of Korea • Kakao Mobility Corp. — travel-time (route) calculation for calendar events / Processing location: Republic of Korea Through entrustment contracts and similar means, the Company sets out data protection obligations, technical and administrative safeguards, restrictions on sub-entrustment, and incident response, and supervises whether processors handle personal data securely. Any change of processors or entrusted tasks will be announced through this Policy.
The Company transfers personal data overseas as follows to provide its services (performance of contract). Transfers take place over an encrypted network (HTTPS) each time the services are used. Privacy contact of each recipient: Google LLC — https://support.google.com/policies?p=privpol_privts / PostHog Inc. — privacy@posthog.com / Paddle.com Market Limited — privacy@paddle.com • Google LLC (Google Cloud Vertex AI) / Country: not fixed to a specific country (global processing location, including the USA) / Items: questions entered into the AI assistant and the content needed to answer them, text of documents to be indexed for search / Purpose: providing AI features / Retention: not retained after the request is processed and not used for model training (temporary cache for performance up to 24 hours; Google abuse-monitoring logs up to 30 days) • Google LLC (Google Workspace Gmail) / Country: the USA and other countries where Google data centers are located (no data region is designated) / Items: recipient name and email address, notice content / Purpose: sending service notices and notification emails / Retention: 1 year after sending • Google LLC (Google Analytics) / Country: USA / Items: pages visited, device and browser information, cookie identifiers / Purpose: visit analytics / Retention: up to 14 months (per the Google Analytics data retention setting) • PostHog Inc. / Country: USA / Items: public website visit data described in Section 10 / Purpose: visit analytics / Retention: 1 year • Paddle.com Market Limited / Country: United Kingdom, Ireland and the USA / Items: payment linking data described in Section 6 / Purpose: paid subscription payments / Retention: according to Paddle's privacy policy and applicable laws If you do not want your data transferred overseas, you can decline the analytics tools as described in Section 10 without any restriction on using the services. You can avoid transfer to Vertex AI by not using AI features or by having your customer organization connect its own AI key. Email delivery and payments are essential to providing the services; declining them limits receiving notice emails or using paid subscriptions.
Users may at any time request access to, correction or deletion of, suspension of processing of, or withdrawal of consent for their personal data. ■ Do it yourself — My Account (myaccount.arcgroup.kr) • Access and correction: view and edit your profile, such as name, country, time zone, and language, in My Account. • Security activity: review recent logins and security activity under My Account › Security. • Data export: download your data under My Account › Data & privacy › Export your data. • Account deletion: request it in My Account › Data & privacy › Delete your ARC Account (the grace period in Section 5 applies). Accounts managed by an organization are deleted by that organization's administrator. ■ Request by email You may send a request by email to the Privacy Officer in Section 14. Requests may also be made through an agent, in which case a power of attorney must be submitted. The Company will act on the request and notify you of the result within 10 days of receipt. ■ Members of an organization Content and member data of organization accounts are managed by the customer organization. Please direct requests to access or delete organization data to your organization's administrator. If such a request reaches the Company, it will be forwarded to the organization. However, deletion may be restricted for data that must be retained under other laws (such as the payment records and access records in Section 5), and requests may be restricted in cases specified by law, such as where they may harm the life, body, property, or interests of others.
The Company uses cookies and similar technologies (browser storage) to operate the services and improve User convenience. • Maintaining login state and security (essential) • Usage analytics • Service quality improvements ■ Google Analytics The Company uses Google Analytics (GA4) by Google LLC for visit analytics on the website and service screens. Page views, device and browser information, and cookie identifiers are collected. Page views on the partner portal and operations screens are not sent. ■ PostHog The Company uses an analytics tool from PostHog Inc. (USA) to analyze visits to the public website (arcgroup.kr) and the Workspace introduction and pricing pages (workspace.arcgroup.kr). It collects page views, referrer, device and browser information, clicks and scrolling (heatmaps), page performance, on-page errors, recordings of on-screen interactions (session replay), and an anonymous identifier stored in cookies or browser storage. Values typed into input fields are masked in recordings, and the data is not linked to information that directly identifies Users, such as name or email. It is not used on screens after login. ■ How to decline • You can block or delete cookies in your browser settings (Chrome: Settings › Privacy and security › Third-party cookies / Safari: Settings › Privacy / Edge: Settings › Cookies and site permissions). Blocking essential cookies may prevent some features, such as login, from working. • You can also opt out of Google Analytics with the browser add-on provided by Google (tools.google.com/dlpage/gaoptout). • Declining analytics tools does not restrict your use of the services.
Personal data is destroyed without delay when the retention period expires or the purpose of processing is achieved. • Electronic files: deleted from databases and storage so that they cannot be recovered. Data remaining in automatic backups expires within up to 7 days, as described in Section 5. • Printed materials/documents: shredded or incinerated Data that must be retained by law (such as payment records) is stored in a separate archive kept apart from other personal data and is automatically deleted when the retention period ends.
The Company takes the following administrative, technical, and physical measures to protect personal data. • Encryption in transit: all services are provided only over HTTPS (TLS). • Encryption at rest: databases and file storage are covered by Google Cloud's encryption of data at rest; passwords are stored as one-way hashes (bcrypt), and 2-Step Verification secrets and external service keys and tokens are encrypted with AES-256-GCM. • Access control: the database cannot be accessed directly from outside, operator access must go through an IAM-authenticated path, and a read-only account is used by default. Administrative privileges are granted minimally according to role and scope. • Account security: 2-Step Verification is mandatory for users with administrator roles, and customer organizations can enforce 2-Step Verification for their members. Repeated failed logins are limited, and unusual logins require identity verification. • Log management: login and security activity and administrator actions are recorded in audit logs retained for 3 years; abnormal access is monitored and malicious IPs are blocked. • Web security: security headers are applied, and Content Security Policy (CSP) violations are collected and reviewed. • Physical security: servers and data are operated in Google Cloud data centers in the Seoul region, with physical access control handled by Google Cloud. • Backup and incident response: the database is backed up automatically, and incident response procedures are in place.
The Company's services are, in principle, provided for general business operations and adult Users. The Company does not intentionally collect personal data of children under the age of 14 for which separate consent is required by law.
For inquiries regarding personal data processing, requests for access, correction, or deletion, or complaints, please contact: • Company: ARC Group • Contact: Minsoo Joo • Title: CEO • Email: business@arcgroup.kr
To seek remedies for infringement of personal data, you may apply for dispute mediation or consultation with the following institutions in Korea. • Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr) • Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr) • Supreme Prosecutors' Office: 1301 (www.spo.go.kr) • Korean National Police Agency: 182 (ecrm.police.go.kr)
This Privacy Policy may be amended in line with changes in laws, service structure, or operational policies. If it changes, the Company will announce the changes and their effective date on the website before they take effect. • Effective date: November 10, 2026 • Previous policy: in effect from April 13, 2026 to November 9, 2026 (the previous policy is available on request from the Privacy Officer)