Entwurf / Draft – legal review pending
Privacy policy
Controller
Sole proprietorship «Arkhue», Owner Joel Lopez
Strassburgstrasse 10, 8004 Zürich, Switzerland
Email: question@arkhue.com
UID: — (not subject to VAT)
Effective / version: 2026-10-19
Legal bases
We process personal data under the revised Swiss Federal Act on Data Protection (revFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).
Data we process
Account data: email, authentication data (password hash or magic link via Supabase Auth), profile and role information.
Content: uploaded plans, elevations, sketches, AI-generated renders, and related metadata (projects, scenes, credits).
Payments: processed by Stripe Checkout. We do not store full card numbers; Stripe handles payment instruments. We receive transaction IDs, amounts, and invoice data.
Technical data: server logs, IP address, browser/device information from hosting (Vercel) and app usage.
Purposes
Providing the service (account, uploads, render pipeline, credit ledger), billing, support, security, troubleshooting, and legal compliance.
Processors & international transfers
Supabase (database, auth, storage) — EU (Frankfurt).
Vercel (hosting) — US/EU depending on region and configuration.
Stripe (payments) — US/EU; PCI-DSS compliant processing.
fal.ai (image generation) — US; render jobs and image data transferred under Standard Contractual Clauses (SCC) and contractual safeguards.
Data processing agreements are in place with processors where required.
Retention
We retain account data and content while the account is active or as needed to perform the contract. Statutory retention (e.g. accounting) may apply. You may request deletion where no legal obligations prevent it.
Your rights
Access, rectification, erasure, restriction, portability (GDPR), and objection where applicable.
You may lodge a complaint with a supervisory authority (Switzerland: FDPIC; EU: your local authority).
Contact: question@arkhue.com
Cookies
We currently use only essential cookies or equivalent storage (session, authentication). No marketing tracking without separate consent.