Privacy Policy

1. Introduction

Welcome to ARKZ (“ARKZ,” “we,” “us,” “our”). ARKZ is operated by DotWin LLC (“DotWin Holdco”). We are committed to protecting your privacy and being transparent about how we collect, use, and share your information.

ARKZ is a platform where users create Assetized Repositories of Knowledge called ARKs, train them through a conversational interface called KNOA, and optionally license them on a marketplace. Our platform also enables users to connect supported third-party accounts and generate documents and content from their ARK.

This Privacy Policy describes our practices regarding information we collect through our website at arkz.ai, our applications, APIs, and all related services (collectively, the “Services”). By using our Services, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

2.1 Information You Provide Directly

Account Information: When you create an account, we collect your name, email address, and authentication credentials (or third-party login tokens from Google or other identity providers). We may also collect a profile photo, job title, bio, and areas of expertise if you choose to provide them.

ARK Training Data: When you train your ARK through KNOA, we collect the content of your training sessions. This includes your conversational responses, beliefs, values, experiences, preferences, decisions, journal entries, people you describe, habits, goals, and any other information you share during training. This is the core data that defines your ARK.

Documents and Files: You may upload documents (PDFs, Word documents, text files, and other formats) to train your ARK. We process these documents to extract insights, knowledge, and writing style patterns. The original files are stored in your account.

Vault Data: Certain information you provide is classified as “vault” data — meaning it is stored exclusively for your personal reference and is never shared with licensees, marketplace visitors, or used in any derivative products. Vault data includes items you explicitly mark as private, contact information for people in your network (email addresses, phone numbers), and any information categorized under the vault privacy mode.

Integration Data: If you connect a supported third-party platform such as Slack, Notion, GitHub, or an RSS feed, we import data according to the permissions you grant and the limits of your subscription tier. The connection screen identifies the specific data requested before you authorize access.

AI Conversation Exports: You may import data from other AI platforms (such as ChatGPT or Claude) by uploading export files or pasting content. This data is processed to extract insights about your identity and communication style.

Audio and Voice Data: You may provide voice recordings or audio samples to create a voice profile for your ARK. If you enable voice mode, our text-to-speech systems generate audio in your ARK’s voice using these samples. Audio data is processed to analyze vocal characteristics including pitch, cadence, tone, speaking pace, and speech patterns. Voice profiles derived from this data constitute biometric identifiers and are treated with heightened protection as described in Section 5.

Video and Visual Media: If you upload visual media for likeness features, we process that media to provide the requested output. Processing may include audio extraction, transcription, voice analysis, and visual analysis. We may also extract still frames for visual identity purposes. Video-derived data is used to enable the platform’s synthetic media features, including generated video content that replicates your likeness, as described in Section 5.

Payment Information: When you make purchases, our third-party payment processor (Stripe) collects your payment card details. We do not store your full credit card number. We maintain records of your transactions, wallet balance, and purchase history.

Communications: When you contact us for support, provide feedback, or communicate with us in any way, we collect the content of those communications.

2.2 Information Collected Automatically

Usage Data: We collect information about how you use our Services, including pages visited, features used, session duration, training session frequency, and interaction patterns.

Device and Network Data: We collect your device type, operating system, browser type, IP address, and general location (city/region level, not precise GPS coordinates).

Operational Telemetry: Our hosting and security providers may record request metadata, error diagnostics, and performance information needed to operate and protect the Services. We do not use ARK training content for advertising profiles.

AI-Extracted Information: Our AI systems extract structured information from your training sessions and imported data. This includes insights (beliefs, values, preferences), communication style patterns, behavioral signatures, and knowledge clusters. These extractions are stored within your ARK and subject to the privacy controls you set.

Conversation Memory: When others interact with your ARK (through the marketplace or licensed access), our system extracts and stores facts about those users to improve the ARK’s conversational continuity. These memories are associated with the ARK, not sold or shared externally.

2.3 Biometric Data Notice

ARKZ processes certain data that may constitute biometric identifiers under applicable state and federal laws, including voiceprints derived from audio recordings and facial geometry data derived from video content. We collect and process biometric data only with your explicit, informed consent. Before any biometric processing occurs, you will be presented with a clear consent prompt explaining what data will be collected, how it will be used, and how long it will be retained. You may withdraw consent at any time, at which point biometric data and all derived profiles will be permanently deleted. For more detail, see Section 5.

2.4 Information We Do Not Collect

We do not collect precise geolocation data (GPS). We do not passively collect biometric data — all biometric processing requires your explicit opt-in action (such as uploading a voice sample or connecting a video platform). We do not scan or read the content of emails or messages sent TO you through connected platforms — only content you authored. We do not sell personal information to data brokers or third parties.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 To Provide and Operate the Services

• Create and maintain your account and ARK
• Process your training data to build and refine your ARK’s knowledge, personality, and communication style
• Extract insights, connections, and patterns from your training sessions and imported data
• Generate responses, documents, and content in your ARK’s voice when requested by you or authorized users
• Process payments, manage wallet balances, and handle marketplace transactions
• Sync data from connected third-party platforms according to your integration settings
• Process audio and video content to build voice profiles, visual identity profiles, and transcribe spoken content into text for ARK training
• Generate synthetic audio (text-to-speech in your voice) and synthetic video (AI-generated content replicating your likeness) when you or authorized parties request it
• Provide customer support and respond to your inquiries

3.2 To Improve the Platform

• Analyze aggregate usage patterns to improve features and user experience
• Monitor system performance, detect errors, and maintain security
• Develop new features based on anonymized, aggregated usage data

3.3 What We Do NOT Use Your Data For

We do not use your personal training data to train general-purpose AI models. Your ARK training data is used exclusively to build YOUR ARK. It is not pooled with other users’ data to train a shared model.

We do not sell your personal information. Your ARK data, training content, insights, and personal information are never sold to, shared with, or made accessible to advertisers, data brokers, or any third party for their commercial purposes.

We do not serve third-party advertisements. ARKZ is an ad-free product experience. We use conversion tracking to measure our own advertising campaigns (see Section 14), but we do not display third-party ads within the platform.

Your ARK works for you. The intelligence your ARK builds about you is used to serve you — to respond in your voice, generate content you request, and help you manage your life. As we develop new capabilities, any new features will be optional, transparent, and under your control. Your ARK data stays within the ARKZ platform and is never exposed to outside parties.

We do not use vault-level data for any purpose other than displaying it to you. Vault data is never included in marketplace responses, derivative products, or any context accessible to anyone other than you.

4. Your ARK’s Privacy Architecture

ARKZ uses a structural privacy model — meaning privacy isn’t just a policy promise, it’s enforced by the technical architecture of the platform. Your data is organized into three privacy levels that you control:

4.1 Vault (Private)

Data marked as “vault” is visible only to you. It is structurally isolated in the database — there is no code path through which a licensee, marketplace visitor, or any external party can access vault data. This includes contact information (emails, phone numbers), personal journal entries, mood and energy data, habit logs, and any insights you explicitly mark as private. Certain tables (such as people intelligence and relationship analytics) have no privacy mode column at all — they are architecturally private by design.

4.2 Training (Shared with Licensed Users)

Data marked as “training” is used to build your ARK’s responses and is visible to users who hold an active license to your ARK. This includes insights about your beliefs, values, expertise, and communication style. Training data powers the core ARK experience — when someone asks your ARK a question, it draws on training-level data to respond authentically.

4.3 Licensable (Public-Facing)

Data marked as “licensable” is visible to anyone interacting with your ARK, including marketplace visitors, preview users, and wallet-based interactions. This is your public-facing identity. You control exactly what reaches this level.

You can change the privacy level of any piece of data at any time. Moving data from licensable to vault immediately removes it from all external-facing contexts. Privacy changes take effect on the next API call — there is no delay.

5. Voice, Visual Identity, and Synthetic Media

5.1 Voice Profile

If you provide voice recordings (either through direct recording or imported video/audio), we process them to create a voice profile — a mathematical model of your vocal characteristics. This profile enables text-to-speech synthesis that sounds like you. Your voice profile:

• Is created only with your explicit consent (you must opt in to voice features)
• Is stored as a derived mathematical representation, not as a library of raw audio clips
• May be used to generate audio responses when you or authorized licensees interact with your ARK in voice mode
• May be used in the marketplace production pipeline if you opt in to brand endorsement features
• Is never shared with third parties in its raw or derived form
• Can be permanently deleted at any time by disabling voice features in your account settings, which destroys both the source recordings and the derived profile

5.2 Visual Identity Profile

If you import video content from social media platforms, we may extract visual identity data including your facial characteristics, expressions, gestures, and presentation style. This data may be used to generate synthetic media — AI-generated images or video that replicate your visual likeness. Your visual identity profile:

• Is created only from content you have previously published on your own social media accounts
• Is created only after you explicitly consent to visual identity processing (separate from general social media import consent)
• Is used to enable AI-generated video content featuring your likeness (such as brand endorsement videos in the marketplace production pipeline)
• Is never used to generate content without your authorization — you approve every use case
• Can be permanently deleted at any time, which destroys all derived visual data and prevents future synthetic media generation

5.3 Biometric Data Protections

Voice profiles and visual identity data may constitute biometric identifiers under laws such as the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), and similar state and international regulations. ARKZ provides the following protections:

• Written consent before collection: Before any biometric data is collected or processed, you are presented with a clear disclosure explaining the specific data to be collected, the purpose of collection, and the duration of storage. You must affirmatively opt in.
• No sale or disclosure: We do not sell, lease, trade, or otherwise profit from your biometric data. We do not disclose your biometric data to third parties except as required to process it (for example, sending audio to a speech synthesis provider) under binding data processing agreements.
• Retention limit: Biometric data is retained only for as long as the purpose for which it was collected remains active — meaning as long as your voice or visual identity features are enabled. When you disable these features or delete your account, biometric data is permanently destroyed within 30 days.
• Reasonable security: Biometric data is encrypted at rest and in transit and is subject to the same structural privacy protections as vault-level data.
• Right to revoke: You may withdraw your consent to biometric data processing at any time through your account settings. Withdrawal triggers permanent deletion of all biometric data and derived profiles.

5.4 Synthetic Media and Right of Publicity

ARKZ may generate synthetic media (AI-generated audio or video) that replicates your voice and/or visual likeness. This capability is designed to serve you — enabling your ARK to speak in your voice or appear in video content that you authorize.

Your likeness belongs to you. ARKZ does not claim any ownership interest in your voice, face, likeness, or identity. We generate synthetic media only at your direction or with your explicit authorization. Specifically:

• Synthetic audio (your ARK speaking in your voice) is generated only when voice mode is enabled and a conversation occurs
• Synthetic video (AI-generated video featuring your likeness) is generated only when you participate in the marketplace production pipeline and explicitly approve the content
• All synthetic media generated through the platform is clearly attributable to you as the creator and subject
• ARKZ does not generate synthetic media of any person who has not created an account, provided biometric data, and explicitly consented to synthetic media generation

If you participate in the brand endorsement marketplace, you will separately agree to specific terms governing how brands may use synthetic media featuring your likeness, including compensation, usage duration, and distribution channels.

5.5 Third-Party Media Processors

Voice synthesis and video generation may involve third-party AI providers (such as text-to-speech services or video generation models). These providers process your data under binding agreements that prohibit them from retaining, repurposing, or using your biometric data for any purpose other than fulfilling our specific request. We evaluate the privacy practices of all media processing partners before engagement.

6. How We Share Information

6.1 With Licensees and Marketplace Users

When someone interacts with your ARK through the marketplace or a licensed subscription, they receive responses generated from your training-level and licensable-level data. They do not receive access to your raw data, your vault data, or your original training transcripts. They interact with an AI-generated representation — not a database export.

6.2 With Service Providers

We share information with third-party service providers who help us operate the platform:

• AI Model Providers (Anthropic, OpenAI): Your training data and prompts are sent to AI model providers to generate responses. These providers process data according to their own privacy policies and data processing agreements. Under our agreements, they do not use your data to train their general models.
• Supabase: Our database and authentication provider. Your data is stored in Supabase’s infrastructure with encryption at rest and in transit.
• Stripe: Our payment processor. Stripe collects and processes payment information subject to Stripe’s privacy policy.
• Vercel: Our hosting provider. Vercel processes web requests and may log IP addresses and request metadata.
• Cloudflare: Our DNS and security provider. Cloudflare processes web traffic for performance and security purposes.

6.3 With Connected Platforms (Two-Way Integrations)

If you enable two-way integrations (available to Pro and Enterprise subscribers), your ARK may draft emails, Slack messages, or social media posts on your behalf. These drafts are sent to the connected platform’s API only when you explicitly approve them (Pro tier) or when you have enabled auto-respond mode (Enterprise tier only, with explicit opt-in per channel).

6.4 Cross-ARK Insight Extraction

When a user interacts with someone else’s ARK, they may reveal information about themselves during the conversation. With the user’s consent, these insights may be extracted and added to the user’s own ARK — making every conversation on the platform a potential training opportunity. This feature is opt-in and can be disabled at any time.

6.5 Legal Requirements

We may disclose information if required by law, regulation, legal process, or governmental request. We may also disclose information if we believe it is necessary to protect the rights, property, or safety of ARKZ, our users, or the public.

6.6 Business Transfers

If ARKZ is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on our website before your information becomes subject to a different privacy policy.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide you the Services. Specifically:

• Account and ARK Data: Retained for the life of your account. When you delete your account, all associated data (insights, training sessions, people, events, documents, conversation history, and your ARK itself) is permanently deleted within 30 days.
• Integration Data: Imported data from connected platforms is retained until you disconnect the integration or delete your account. Disconnecting an integration deletes all imported data from that platform, including extracted insights sourced from it.
• Voice and Visual Identity Data: Voice profiles and visual identity profiles are retained for as long as the corresponding feature is enabled in your account. Disabling voice features permanently deletes your voice profile and all source audio within 30 days. Disabling visual identity permanently deletes your visual profile and all derived visual data within 30 days. Original video files imported from social platforms are subject to the integration data retention rules above. Biometric data is never retained after the purpose for which it was collected ceases.
• Synthetic Media Outputs: AI-generated audio and video content is retained in your account until you delete it. If you delete your account, all synthetic media is permanently deleted.
• Payment Records: Transaction records are retained for 7 years for accounting and legal compliance purposes, even after account deletion.
• Conversation Logs with Your ARK: Conversations that others have with your ARK are retained as part of the ARK’s conversation memory system. If you delete your ARK, all associated conversation data is deleted.
• Anonymized Analytics: Aggregate, anonymized usage data (such as total platform-wide message counts, average session lengths, and feature adoption rates) may be retained indefinitely. This data cannot be linked back to any individual user.

8. Your Rights and Choices

8.1 Access and Portability

You can access your data at any time through your ARKZ dashboard. This includes your ARK’s insights, people, events, connections, documents, training history, and conversation logs. We are developing a portable export format (.arkz) that will allow you to download a complete copy of your ARK and its associated data.

8.2 Correction

You can edit, correct, or update any data in your ARK at any time through the dashboard, training interface, synthesis page, or any CRUD interface on the platform. Privacy levels can be changed on any individual item.

8.3 Deletion

You may delete individual items (insights, people, events, documents, conversation threads) at any time. You may delete your entire account and all associated data by contacting us at privacy@arkz.ai. Account deletion is permanent and irreversible. All data, including your ARK, is permanently removed within 30 days. Deletion cascades through all related data — disconnecting integrations, removing extracted insights, and purging conversation memories.

8.4 Integration Controls

You can connect and disconnect third-party integrations at any time. Disconnecting an integration revokes our access tokens and deletes all data imported from that platform. You can review and approve or reject individual insights extracted from imported data before they are added to your ARK.

8.5 Opt-Out of Cross-ARK Training

If you do not want insights from your conversations with other people’s ARKs to be fed back into your own ARK, you can disable cross-ARK training in your account settings.

8.6 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, the right to delete your personal information, the right to opt out of the sale or sharing of your personal information (ARKZ does not sell personal information), and the right to non-discrimination for exercising your privacy rights. To exercise these rights, contact privacy@arkz.ai.

ARKZ does not use automated decision-making technology (ADMT) to make decisions that produce legal or similarly significant effects on users. AI-generated responses from ARKs are informational and do not constitute legal, financial, medical, or professional advice.

8.7 European Economic Area, UK, and Switzerland (GDPR)

If you are located in the EEA, UK, or Switzerland, your legal bases for processing include: consent (for optional features like integrations and cross-ARK training), contractual necessity (for providing the Services you signed up for), legitimate interests (for platform security, fraud prevention, and service improvement), and legal obligations (for tax and financial record-keeping).

You have the right to access, rectify, erase, restrict processing, object to processing, and port your data. You also have the right to lodge a complaint with your local data protection authority. To exercise any of these rights, contact privacy@arkz.ai.

9. Data Security

We implement industry-standard security measures to protect your data:

• Encryption: All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). OAuth tokens for connected integrations are encrypted at the database level.
• Access Control: Row-level security (RLS) policies enforce that users can only access their own data. Administrative access is restricted to essential personnel and logged.
• Authentication: We support secure authentication via email/password and third-party identity providers (Google). Sessions are managed with JWT tokens.
• Infrastructure: Our infrastructure is hosted by Supabase (PostgreSQL with pgvector) and Vercel, both of which maintain SOC 2 compliance.
• Structural Privacy: Vault-level data is isolated by database architecture, not just application logic. Certain sensitive tables have no privacy mode column — they are structurally unreachable from external code paths.

No system is perfectly secure. While we take reasonable measures to protect your data, we cannot guarantee absolute security. In the event of a data breach, we will notify affected users in accordance with applicable law.

10. Third-Party AI Providers

ARKZ uses third-party AI model providers to power ARK training, response generation, and data extraction. Currently, we use models from Anthropic (Claude) and OpenAI (GPT, embeddings). When your data is processed by these providers:

• Your prompts and training data are sent to the provider’s API for processing.
• Under our data processing agreements, these providers do not use your data to train their general-purpose models.
• Responses are returned to ARKZ and stored in our database — the provider does not retain your data beyond the duration of the API call (subject to their standard data retention policies, typically 30 days or less for abuse monitoring).
• We may change or add AI providers in the future. Any new provider will be subject to equivalent data processing agreements.

For more information, refer to Anthropic’s privacy policy at anthropic.com/privacy and OpenAI’s privacy policy at openai.com/privacy.

11. Children’s Privacy

ARKZ is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at privacy@arkz.ai.

12. International Data Transfers

ARKZ is operated from the United States. If you are accessing our Services from outside the United States, your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate. We rely on standard contractual clauses, adequacy decisions, and other legally recognized transfer mechanisms to ensure your data is protected in accordance with applicable law.

13. Marketplace and Creator Responsibilities

If you list your ARK on the ARKZ marketplace, you are responsible for ensuring that the data you make licensable does not include information about third parties without their consent, confidential business information you are not authorized to share, or any content that violates applicable laws.

ARKZ is a platform that facilitates interactions between creators and licensees. We are not responsible for the accuracy, completeness, or suitability of any ARK’s responses. ARK responses are AI-generated and should not be relied upon as professional, legal, medical, or financial advice.

14. Cookies, Tracking, and Analytics

14.1 Essential Cookies

We use essential cookies for authentication, session management, and security. These cookies are required for the platform to function and cannot be disabled.

14.2 Operational Logs and Local Preferences

We use operational logs to diagnose errors, maintain security, and measure service reliability. The application may store local interface preferences, such as theme selection, in your browser. ARKZ does not currently load third-party advertising pixels or non-essential analytics cookies.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (using the email address associated with your account) and by posting a prominent notice on our website at least 30 days before the changes take effect. Your continued use of the Services after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

16. Contact Us

If you have questions about this Privacy Policy, want to exercise your privacy rights, or have concerns about how your data is handled, please contact us:

• Email: privacy@arkz.ai
• Mail: DotWin LLC, Attn: Privacy, [Address to be added]
• Website: arkz.ai/privacy