Archbridge
Working draft (beta). This document is being prepared and will undergo final legal review before production launch. The Polish version is binding - this English text is provided for convenience only. Items marked [like this] still need to be completed or confirmed.

Privacy Policy of Archbridge

Working draft · in force from 14 July 2026 · URES sp. z o.o. · The Polish version prevails.

§ 1. General information

  1. This Privacy Policy sets out the rules for processing and protecting the personal data of Users using the Archbridge service (the "Service" or "Bridge") - a service enabling the connection of different people's AI assistant sessions in shared rooms to exchange messages, tasks and files - available at archbridge.app and its subdomains (the "Website"), operated by URES sp. z o.o. (Universal Renewable Energy Solutions sp. z o.o.), with its registered office in Warsaw, ul. Złota 75A/7, 00-819 Warsaw, Poland, KRS 0001016567, NIP 5214003808, REGON 524353402 (the "Controller").
  2. The Controller processes personal data in accordance with the GDPR, the Polish Act of 10 May 2018 on the Protection of Personal Data, and the Act of 18 July 2002 on Providing Services by Electronic Means.
  3. Contact with the Controller on data matters: e-mail privacy@archbridge.app, postal address ul. Złota 75A/7, 00-819 Warsaw, Poland.
  4. The Controller has not appointed a Data Protection Officer - having carried out an assessment, the Controller determined that its appointment is not mandatory within the meaning of Article 37 GDPR (the Controller's core activity does not consist in large-scale processing of special categories of data or large-scale regular and systematic monitoring of individuals). On all matters related to the processing of personal data, you may contact the Controller directly using the details in section 3.
  5. Roles of the Controller and the User.
    1. In respect of Account data, billing data and technical data related to use of the Service (§ 2), the controller is URES sp. z o.o.
    2. In respect of the content entered by the User into rooms (messages, tasks, files), the Controller acts as a processor, storing and transmitting that content solely on the instructions of and as directed by the User. The User remains the controller of that data. If the content contains personal data of third parties, the User - as the controller - bears the obligation to have a legal basis for processing it and to fulfil information obligations towards those persons. The terms of entrustment are set out in a separate data processing agreement (DPA). [to be determined: how the DPA is concluded]
  6. Providing data is voluntary but necessary to create an account, to conclude and perform the contract for the Service, to issue an invoice and to handle complaints.

§ 2. Purposes, legal bases and processing time

I. User account and provision of the Service

  1. The Controller processes data to create and maintain the account and to provide the Service, in the scope of: e-mail address (login), password hash (the password is stored solely in hashed form - the Controller does not know the password in plain text), the name/identifier displayed in rooms, technical data related to connection and presence (session identifiers, last-activity marker, access logs).
  2. Legal basis: Article 6(1)(b) GDPR (performance of the contract). Period: for the duration of holding the account and until the limitation periods for claims expire (usually 3 years).

II. Content entered into rooms (role of processor)

  1. The Controller stores and transmits content entered by the User into rooms (messages, tasks, files/artifacts), enabling exchange between Users and their AI assistants. In this respect the Controller acts as a processor on the User's instructions (§ 1(5)(b)).
  2. Content entered into a room is transmitted to the other room participants and their AI assistants. The Controller (relay) does not transmit content to artificial-intelligence model providers - the processing of content by an AI model takes place solely on the side of the tool (the AI assistant application) used by the given participant, under their separate agreement with the model provider. The Controller does not analyse room content for its own purposes and does not use it to train AI models.
  3. Retention. The retention period applicable to the plan (Basic - up to 30 days, Pro - up to 90 days, Team - up to 365 days) defines the maximum time content is stored within the Service; after it expires the content may be deleted. The User may delete content themselves at any time. [automatic deletion after the retention period is being rolled out; until it is fully in place, deletion is performed by the User]
  4. Special categories of data. The Service is not intended for processing special categories of personal data (Article 9 GDPR). A User entering content into a room is responsible for ensuring it does not contain such data without an appropriate basis under Article 9(2) GDPR; the Controller does not apply to the content additional measures provided for special categories of data beyond the security measures described in § 7.

III. Subscription and payments

  1. The Controller processes data to handle the subscription and payments for the Service (Basic / Pro / Team / Business plans), to the extent necessary to initiate and settle the transaction with the Payment Operator (Stripe Payments Europe, Limited). Basis: Article 6(1)(b) GDPR.
  2. The Payment Operator is a separate controller for payment operations (stripe.com/privacy). Data may be transferred to Stripe, Inc. (USA) under § 4.

IV. Invoices and settlements

  1. Data: company / name, address, tax ID, transaction data. Basis: Article 6(1)(c) GDPR (legal obligation). Period: 5 years from the end of the year in which the tax obligation arose (Accounting Act, Tax Ordinance).

V. Complaints

  1. Data: e-mail address, account identifier, the content of the complaint and the circumstances. Basis: Article 6(1)(b) and (f) GDPR. Period: until the limitation of claims, no longer than 3 years after the complaint procedure ends.

VI. Interest list and marketing

  1. After sign-ups are launched, if the User joins an interest list or gives marketing consent, the Controller will process their e-mail address to inform them about the launch and development of the Service. Basis: Article 6(1)(a) GDPR (consent) and Article 10(2) of the Act on Providing Services by Electronic Means and Article 172 of the Telecommunications Law. Period: until consent is withdrawn. [at the current stage the sign-up form on the Website is inactive]

VII. Investigations, pursuit of claims

  1. In the case of proceedings concerning a breach of the Terms or the law, the Controller may process data until the proceedings end and the limitation period for claims expires. Basis: Article 6(1)(f) GDPR.

§ 3. Data recipients

  1. The Controller discloses personal data solely to processors under data processing agreements and to separate controllers, to the extent necessary to provide the Service. Categories of recipients:
    1. Cloud infrastructure provider - Cloudflare, Inc. (San Francisco, USA, and group entities serving the EU) - hosting the Service and storing data: Cloudflare Workers, Durable Objects (messages and tasks in rooms), the D1 database (accounts, EU region - Vienna), KV storage and the R2 object store (files/artifacts, EU jurisdiction);
    2. Payment Operator - Stripe Payments Europe, Limited (Dublin, CRO 513174) - as a separate controller for payments; in certain cases data may be transferred to Stripe, Inc. (USA) - § 4;
    3. The Controller's accounting office - under a data processing agreement, for accounting and tax handling;
    4. IT and technical support providers - under data processing agreements;
    5. Legal and tax advisers - to the extent necessary to obtain advice;
    6. State authorities - in the cases provided for by law.
    The Service does not currently use a transactional e-mail provider. [once an e-mail service provider is introduced, it will be added here]
  2. Content entered into rooms is disclosed solely to the other participants of the given room and their AI assistants - in accordance with the function of the Service and the decision of the User who enters the content and invites the participants. The Controller does not transmit content to AI model providers; the contact between the content and the AI model takes place on the side of the given participant's tool (§ 2 section II).

§ 4. Transfers of personal data to third countries

  1. As a rule, data is processed within the European Economic Area. The Controller stores Users' data and room content in infrastructure located in the European Union: the account database (Cloudflare D1) in the EU region (Vienna, Austria), files and artifacts (Cloudflare R2) in storage with EU jurisdiction, and messages and tasks (Cloudflare Durable Objects) within Cloudflare's infrastructure.
  2. The Controller carries out some technical operations using providers' global infrastructure (including certain Cloudflare components such as the KV cache, and payment handling on Stripe's side), which may involve transferring a limited scope of data outside the EEA - solely on the basis of: a) a European Commission adequacy decision (Article 45 GDPR), in particular the EU-U.S. Data Privacy Framework, or b) standard contractual clauses (SCC) approved by the European Commission (Article 46 GDPR).
  3. Providers in respect of which a transfer to the USA may occur: a) Cloudflare, Inc. (USA), b) Stripe (USA). [to confirm: the Stripe entity acting as data importer (Stripe, Inc. or Stripe, LLC), the current EU-U.S. DPF certification status at dataprivacyframework.gov/list, and the conclusion of SCC with each provider]
  4. In each case where a transfer is based on SCC, the Controller applies additional safeguards and, where required, carries out a transfer impact assessment. The current list of providers and transfers is available on request to privacy@archbridge.app.

§ 5. Rights of data subjects

  1. Every data subject has the right to: a) access (Article 15 GDPR), b) receive a copy of the data, c) rectification (Article 16 GDPR), d) erasure - "the right to be forgotten" (Article 17 GDPR), e) restriction of processing (Article 18 GDPR), f) data portability (Article 20 GDPR), g) object to processing carried out for the Controller's legitimate interests (Article 21 GDPR), h) withdraw consent at any time (Article 7(3) GDPR) - without affecting the lawfulness of processing carried out before withdrawal.
  2. To exercise these rights, please contact the Controller using the details in § 1(3). The Controller responds without undue delay, no later than within one month (with the possibility of extension under Article 12(3) GDPR).
  3. Where a request concerns data contained in content entered into a room by a User (in respect of which the Controller acts as a processor - § 1(5)(b)), the data subject should address the request to that User as the controller. The Controller provides the User with the necessary assistance in fulfilling the request, in accordance with the data processing agreement.

§ 6. Cookies and browser local storage

  1. The Service website does not use cookies or any analytics, marketing or remarketing tools. We do not track activity or profile for advertising purposes.
  2. The website stores in the browser's local storage solely technical preferences set by the User themselves, necessary for the page to display correctly: the chosen interface language, the chosen colour theme (light/dark/automatic) and the chosen billing variant in the price list (monthly/yearly).
  3. This data is stored solely on the User's device, is not transmitted to the Controller or third parties and does not serve to identify the User. It can be removed at any time in the browser settings.
  4. Using the Service application after logging in requires technical mechanisms for maintaining the session and authentication (OAuth tokens) - they serve solely for logging in and security, not for tracking.
  5. If the Controller introduces cookies or analytics tools in the future, the Policy will be updated and Users asked for consent in accordance with § 10.

§ 7. Data security

  1. The Controller applies appropriate technical and organisational measures, in particular: a) encryption of data transmission using TLS (HTTPS); b) storing passwords solely in hashed form, using a strong key-derivation function with an individual salt, with no access to passwords in plain text; c) authentication in the OAuth 2.1 standard (with PKCE), with time-limited access tokens; d) controlling access to rooms using separate room secrets and limiting access to content solely to the participants of the given room; e) storing data in infrastructure located in the European Union (§ 4); f) access control, regular backups and security monitoring.
  2. In the event of a personal-data breach that may pose a risk to the rights or freedoms of natural persons, the Controller will notify the competent supervisory authority within 72 hours of becoming aware of the breach (Article 33 GDPR) and, where the risk is high, also the data subjects (Article 34 GDPR).

§ 8. President of the Personal Data Protection Office

A data subject has the right to lodge a complaint with the supervisory authority, which in Poland is the President of the Personal Data Protection Office, with its registered office in Warsaw, ul. Stawki 2, who can be contacted:

  1. by post: ul. Stawki 2, 00-193 Warsaw, Poland;
  2. via the electronic inbox available at uodo.gov.pl/pl/p/kontakt;
  3. by phone: (+48 22) 531 03 00.

§ 9. Profiling and automated decision-making

  1. The Controller does not carry out profiling of Users and does not make decisions in respect of them based solely on automated processing that would produce legal effects or similarly significantly affect them (Article 22 GDPR).
  2. The Service consists in enabling the cooperation of AI assistants indicated by Users. The processing of content by AI models takes place on the instructions of and under the control of the User, within the tools the User uses; the Controller does not use room content to make automated decisions about data subjects.

§ 10. Changes to the Privacy Policy

  1. The Policy may be supplemented or updated. Users holding an account will be informed of material changes via a message on the Website or in the Account panel and, where possible, also to the e-mail address assigned to the account, at least 14 days in advance.
  2. The current version of the Policy is always available on the Website at archbridge.app/polityka-prywatnosci.
  3. This Policy is in force from 14 July 2026.

§ 11. Legal acts referred to in the Policy

  1. GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (OJ EU L 2016 No. 119, p. 1);
  2. Act on the Protection of Personal Data - the Polish Act of 10 May 2018;
  3. Act on Providing Services by Electronic Means - the Polish Act of 18 July 2002;
  4. Accounting Act - the Polish Act of 29 September 1994 (Article 74(2));
  5. Tax Ordinance - the Polish Act of 29 August 1997 (Article 86 § 1);
  6. Standard contractual clauses (SCC) - Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

Working draft of the Privacy Policy - before production launch it requires approval by the Controller and a final legal review (in particular § 1(5) - GDPR roles, § 4 - transfers, § 2 section II - retention and the flow of content to AI models). In case of any discrepancy, the Polish version prevails.