Privacy Policy

Who we are

Arkyniq ("Arkyniq", "we", "us", "our") is a backend-operations and automation studio based in India. We audit the operational backends of D2C and B2B companies and build custom infrastructure — data pipelines, lead routing, inventory and reporting systems — that removes manual work from our clients' businesses.

For the purposes of applicable data-protection law, Arkyniq acts as a data fiduciary (also called a data controller) for information we collect directly about you through our website and our business communications. When we build and operate automations inside a client's own systems, we act as a data processor on that client's instructions, and the client remains the controller of the data those systems hold.

Our registered contact point for all privacy matters is hello@arkyniq.ai.

Scope of this policy

This policy applies to:

• The Arkyniq website at arkyniq.ai, including the enquiry form and the on-site chat widget;
• Email, scheduling and messaging exchanges with prospective and current clients;
• The Arkyniq automation platform — the applications, scripts and integrations we deploy that connect to third-party services, including Google Workspace via Google APIs, on your explicit authorisation.

This policy does not apply to third-party services you reach from our site or that you connect independently. Those services are governed by their own privacy policies, and we list the ones we rely on in Section 9.

Information we collect

3.1 Information you give us directly

When you submit our enquiry form or contact us, we collect:

• Identity and contact data — your full name, business name, email address and phone number;
• Engagement context — the service tier you select and your free-text description of the operational bottleneck you want solved;
• Correspondence — messages you send us by email, through the on-site chat widget, or during calls, including notes we take.

Every field in our enquiry form is information you choose to provide. If you would rather not submit a form, you can simply email us instead.

3.2 Information collected automatically

Our website is a static page and does not run advertising trackers, cross-site pixels or behavioural analytics. Our hosting provider records standard server logs — IP address, timestamp, requested URL, referring page, user-agent string — which exist to keep the site available and to detect abuse. The on-site chat widget runs entirely in your browser and stores its transcript in your browser's local storage only; clearing your browser data erases it.

3.3 Information from third parties

When you book a call, scheduling is handled by Cal.com. Details you enter on our form may be passed to the Cal.com booking page to pre-fill it, and Cal.com shares the resulting booking details with us. Cal.com processes that data under its own privacy policy.

3.4 Google user data

If — and only if — you authorise an Arkyniq integration through Google's OAuth consent screen, we access data from your Google account. Because this is the most sensitive category of data we handle, it is documented separately and in full in Section 4.

3.5 What we do not collect

• We never ask for, and never store, your Google account password. Authentication happens entirely through Google's OAuth flow.
• We do not collect payment card numbers on our website; invoicing is handled through bank transfer or a third-party payment processor that handles card data directly.
• We do not knowingly collect special-category data (health, biometric, religious, political, or sexual-orientation data). Please do not send us such data.

Google user data

Arkyniq builds automations that run inside the tools our clients already use. Where those tools are Google Workspace products, our application requests access through Google's OAuth 2.0 consent screen. Access is always initiated by you, is shown to you in full before you grant it, and can be withdrawn by you at any time.

4.1 Scopes we request and why

The table below lists every Google API scope our application may request, Google's sensitivity classification for it, and the specific product function it enables. We request scopes incrementally — an integration asks only for the scopes its configured workflows actually require, and we always prefer the narrowest scope that can do the job.

4.2 How Google user data is handled

• Processed in transit, minimally stored. Wherever a workflow can act on data in-flight, it does, and nothing is persisted. We store Google user data only where a feature cannot work without it.
• What we do store. OAuth access and refresh tokens (encrypted); the minimum identifiers needed to make a workflow idempotent — for example a Gmail message ID and thread ID so the same lead is not processed twice; derived metadata such as a classification label or timestamp; and the output artefacts a workflow produces, such as a report row.
• What we do not store. We do not keep copies of full mailboxes, message bodies, attachments or Drive file contents beyond the transient processing window required to act on them.
• Isolation. Each client's data is logically segregated. One client's credentials or data are never used to serve another.
• No onward sale. Google user data is never sold, rented, licensed, or shared for advertising or any other independent commercial purpose.

Limited Use commitment

Concretely, and with respect to data obtained through Google Workspace APIs, Arkyniq affirms that we:

1. Use the data only to provide or improve user-facing features that are prominent in our application's interface and that you have requested. We do not repurpose it for unrelated ends.
2. Do not transfer the data to third parties except (a) as necessary to provide or improve those user-facing features, in which case it goes only to the vetted infrastructure subprocessors listed in Section 9 under written confidentiality and data-processing terms; (b) for security purposes such as investigating abuse; (c) to comply with applicable law; or (d) as part of a merger, acquisition or sale of assets, after giving you notice and obtaining your consent.
3. Do not use the data for serving advertisements of any kind, including retargeting, personalised advertising, or interest-based advertising.
4. Do not allow humans to read the data, unless (a) we have obtained your specific affirmative consent — for example when you ask our support team to debug a named workflow; (b) it is necessary for security purposes such as investigating a suspected abuse or breach; (c) it is necessary to comply with applicable law; or (d) the data has been aggregated and de-identified such that it is no longer linkable to any individual, and is used only for internal operations reporting.

Where a human review is authorised under one of those exceptions, it is performed by a named engineer under confidentiality obligations, limited to the minimum data required, and recorded in an audit log that we will disclose to you on request.

AI and automated processing

Some Arkyniq workflows use machine-learning models — for example, to classify whether an inbound email is a sales lead, a supplier notice or spam. Where that happens, the following rules apply without exception:

How we use information

We do not use your information for any purpose materially different from those listed above without first telling you and, where the law requires it, obtaining your consent.

Legal bases

Under India's Digital Personal Data Protection Act, 2023, we process personal data on the basis of your consent, given through the notice presented at the point of collection, or for the legitimate uses the Act specifically permits — such as performing a service you requested or complying with a legal obligation.

For individuals in the European Economic Area or the United Kingdom, our legal bases under the GDPR are:

• Consent (Art. 6(1)(a)) — for granting an integration access to your Google account, and for any optional communications. You may withdraw consent at any time.
• Performance of a contract (Art. 6(1)(b)) — to deliver the services you have engaged us for.
• Legitimate interests (Art. 6(1)(f)) — to secure our systems, prevent abuse and respond to your enquiry. We have assessed that these interests do not override your rights.
• Legal obligation (Art. 6(1)(c)) — to keep tax and accounting records.

Sharing and disclosure

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We disclose data only in these circumstances:

9.1 Service providers (subprocessors)

We rely on a short list of vetted providers to run our business. Each is bound by a written agreement requiring confidentiality, appropriate security, and use of the data only for the service they supply to us.

We will provide the current, named list of subprocessors — including entity names and hosting regions — to any client on request at hello@arkyniq.ai, and we notify clients before adding a subprocessor that processes their Google user data.

9.2 Legal and safety disclosures

We may disclose information where we reasonably believe it is required by law, court order, or a valid request from a public authority, or where disclosure is necessary to investigate fraud or a security incident, enforce our Terms of Service, or protect the rights and safety of any person. Where we are legally permitted to do so, we will notify you before disclosing.

9.3 Business transfers

If Arkyniq is involved in a merger, acquisition, reorganisation or sale of assets, personal data may be transferred as part of that transaction. Consistent with our Limited Use commitment, any transfer of Google user data in such a transaction will only occur after we give you prior notice and obtain your consent.

International transfers

Arkyniq operates from India, and our service providers may process data in India, the United States, the European Union or other jurisdictions. Where we transfer personal data across borders, we rely on appropriate safeguards — Standard Contractual Clauses approved by the European Commission for transfers out of the EEA/UK, together with our providers' own transfer frameworks, and we transfer data only to jurisdictions not restricted by the Government of India under the DPDP Act.

You can request a copy of the safeguards applicable to a specific transfer by writing to us.

Data retention

We keep personal data only as long as it serves the purpose it was collected for, then delete or irreversibly anonymise it. Our standard periods are:

When you submit a deletion request, we honour it as described in Section 13, except for the narrow records we are legally obliged to retain.

How we protect data

We maintain technical and organisational measures appropriate to the sensitivity of the data we handle. Because our application requests restricted Gmail scopes, our security posture is also independently assessed.

12.1 Technical measures

• Encryption in transit — all traffic uses TLS 1.2 or higher; our website is served over HTTPS with HSTS.
• Encryption at rest — stored data is encrypted using AES-256. OAuth refresh tokens receive an additional application-layer encryption pass, with keys held in a managed secret store and rotated on a defined schedule.
• Least privilege — access to production systems is role-based, granted on a need-to-know basis, protected by multi-factor authentication, and reviewed quarterly.
• Secret hygiene — credentials are never committed to source control; secrets live only in a managed vault.
• Segregation — client environments are logically isolated; production data is never copied into development or test environments.
• Monitoring and logging — authentication events and access to sensitive data are logged, with alerting on anomalous patterns.
• Dependency management — automated vulnerability scanning of dependencies, with prioritised patching.

12.2 Organisational measures

• Every person with access is bound by a written confidentiality agreement and receives data-handling training.
• Access is revoked immediately when a person's role ends.
• We maintain a documented incident-response plan and conduct periodic reviews against it.
• We complete an annual CASA (Cloud Application Security Assessment) through a Google-designated assessor, as required for applications using restricted Google API scopes.

12.3 Breach notification

If a personal-data breach occurs, we will notify the Data Protection Board of India and every affected individual without undue delay, as required by the DPDP Act — and within 72 hours of becoming aware, where GDPR applies. Our notice will describe what happened, the data involved, the steps we have taken, and what you should do.

No system is perfectly secure. If you believe you have found a vulnerability in anything we operate, please report it to hello@arkyniq.ai. We will acknowledge within three business days and will not pursue action against good-faith researchers.

Revoking access and deleting your data

You are in control of the access you granted, and you can withdraw it without contacting us first.

13.1 Revoke access yourself

1. Go to myaccount.google.com/permissions while signed in to the Google account you connected.
2. Find Arkyniq in the list of apps with access to your account.
3. Select it, then choose Remove access.

Revocation takes effect immediately: our tokens for your account stop working, and every workflow depending on them halts. We delete the revoked tokens and the identifiers associated with them within 7 days.

13.2 Request deletion of everything we hold

To have all of your data erased, email hello@arkyniq.ai with the subject line "Data deletion request" and tell us the email address or Google account the request concerns. You do not need an account with us to make this request, and it is free.

• We acknowledge every request within 3 business days.
• We verify the request comes from you or someone authorised to act for you.
• We complete deletion within 30 days and confirm in writing what was deleted.
• Data in encrypted backups is purged on the normal backup-rotation cycle, within 90 days.
• We will tell you if we must retain anything to meet a legal obligation, and specify exactly what and why.

13.3 If the engagement ends

On termination of a client engagement, we decommission the integration, revoke our own credentials, return or transfer the artefacts you own, and delete the client's data from our systems within 30 days unless the client asks us in writing to retain it longer.

Your rights

Depending on where you live, you hold some or all of the following rights. Exercise any of them by emailing hello@arkyniq.ai. We will not discriminate against you for doing so, and we respond within 30 days.

14.1 Everyone

• Access — ask what personal data we hold about you and get a copy.
• Correction — have inaccurate or incomplete data fixed.
• Erasure — have your data deleted, as described in Section 13.
• Withdraw consent — revoke a permission you gave, at any time, as easily as you gave it.
• Grievance redressal — raise a complaint with us and receive a substantive response.

14.2 Additional rights under the DPDP Act, 2023 (India)

• The right to nominate another individual to exercise your rights in the event of your death or incapacity.
• The right to escalate an unresolved grievance to the Data Protection Board of India after first raising it with us.

14.3 Additional rights under the GDPR (EEA/UK)

• Data portability — receive your data in a structured, machine-readable format.
• Restriction — ask us to pause processing while a dispute is resolved.
• Objection — object to processing based on legitimate interests.
• Complaint — lodge a complaint with your national supervisory authority.

14.4 Additional rights under the CCPA/CPRA (California)

• The right to know the categories and specific pieces of personal information collected, the sources, the purposes, and the categories of third parties it is disclosed to.
• The right to delete, and the right to correct.
• The right to opt out of sale or sharing — we do not sell or share personal information, so there is nothing to opt out of.
• The right to limit use of sensitive personal information. We use it only to deliver the service you requested, which is already within the permitted purposes.

Cookies and tracking

The Arkyniq website sets no advertising or analytics cookies. We do not operate cross-site trackers, and there is no behavioural profiling of visitors.

• Local storage — the on-site chat widget keeps your conversation in your own browser so it survives a page reload. It never leaves your device unless you send us a message.
• Google Fonts — typefaces load from Google's font CDN, which means Google receives your IP address as part of that request.
• Cal.com embed — the booking calendar is an iframe served by Cal.com, which may set its own cookies within that frame under its policy.
• Authenticated sessions — where you sign in to an Arkyniq dashboard, we set a strictly necessary, HttpOnly, Secure session cookie. It exists only to keep you signed in.

Because we set no non-essential cookies, no consent banner is required. We honour Global Privacy Control signals where applicable.

Children's privacy

Arkyniq provides services to businesses. Our website and applications are not directed at children, and we do not knowingly collect personal data from anyone under 18. Consistent with the DPDP Act's protections for children, we do not undertake tracking, behavioural monitoring or targeted advertising directed at children under any circumstances. If you believe a child has provided us data, write to hello@arkyniq.ai and we will delete it promptly.

Changes to this policy

We may update this policy as our services, our subprocessors or the law change. When we do, we revise the "Last updated" date and the version number at the top of the page, and keep the previous version available on request.

If a change materially affects how we handle your personal data — a new category of data, a new purpose, a new Google API scope, or a new class of recipient — we will notify you by email before it takes effect and, where the change relies on consent, obtain your fresh consent. Requesting a new Google API scope always requires a new consent screen, which you are free to decline.

Contact and grievances

For any question, request or complaint about privacy — including access and deletion requests — contact us. We read every message and respond substantively.

As required by India's DPDP Act, 2023, our Grievance Officer is the designated point of contact for complaints about our handling of your personal data. If we do not resolve your grievance to your satisfaction, you may escalate it to the Data Protection Board of India. If you are in the EEA or UK, you may also complain to your local supervisory authority.

See also our Terms of Service, which governs the commercial relationship between Arkyniq and its clients.