Privacy policy

Last updated 19 October 2026

This policy explains what personal information Arca collects, why, who helps us process it, and your rights. Arca is run by the operator of Arca, the data controller for the purposes of UK and EU data protection law. You can contact us at hello@heyarca.com.

What we collect

Your account: your email address and, if you sign in with Google, your name. Passwords are handled by our authentication provider; we never see them.
Your profile: the name you show to your group, your home airports, and any personal needs you add (for example “vegetarian” or “step-free”). Personal needs can reveal health or dietary information; only add what you’re comfortable sharing with the people on your trips.
Your trips: trip names and dates, who’s on them, the group’s needs, what you save to the board, likes, choices and agreements, chat and thread messages, and itineraries.
Booking clicks: when you open a booking link, which site you chose, for which kind of item, and the price shown.
Usage analytics: which pages and features are used, your approximate location derived from your IP address, and your device and browser type. See cookies for how to opt out.

We don’t collect payment details or passport information, and we don’t take payments.

Why we use it

To run the service you asked for: your account, your trips, sharing them with the people you invite, checking places against your needs, and building itineraries (contract).
To understand how Arca is used and improve it, and to keep it secure (legitimate interests).
To remember your device across visits for analytics, so we can see what works and improve it (legitimate interests; you can opt out on our cookie policy page).
To use that information for marketing, such as learning which posts bring people to Arca, only if you say yes in the cookie banner (consent, which you can withdraw at any time).

Who processes it for us

Supabase: database, file storage and sign-in.
Vercel: hosting the website.
Google: place information and photos (Google Maps Platform), and AI features (Gemini). When you add a need, search in your own words, ask Arca a question or make an itinerary, the relevant text (for example the group’s needs, the question and details of the places involved) is sent to Gemini to produce the answer.
SerpApi: live hotel prices, flights and booking links from Google Hotels and Google Flights. We send the destination, dates and airports, not your name or email.
Mixpanel (EU data residency): product analytics.
Stay22: a script on our pages turns links to booking sites (such as Booking.com and Expedia) into affiliate links. When you open one, Stay22 and the booking site know you came from Arca, which is how a booking can earn us a commission.

Some of these providers process data outside the UK; where they do, they rely on recognised safeguards such as the UK International Data Transfer Addendum or standard contractual clauses. We don’t sell your personal information.

What other people on your trip can see

Everyone on a trip can see its members’ names, the group’s needs (including personal needs from each member’s profile), the board, the chat and threads, and the itinerary. Anyone with the trip’s invite link can join it, so only share it with people you want on the trip.

How long we keep it

We keep your account and trips until you ask us to delete them. We keep analytics and booking-click records only while they help us understand and improve Arca, and review them regularly.

Your rights

You can ask to see, correct, delete or export your personal information, object to or restrict how we use it, and withdraw consent at any time. Email hello@heyarca.com. If you’re unhappy with how we’ve handled your information, you can complain to the Information Commissioner’s Office (ico.org.uk).

Children

Arca isn’t intended for children under 16, and we don’t knowingly collect their information.

Changes

If we change this policy, we’ll update the date above, and tell you in the app if the change is significant.