Privacy Policy

Arca · Owner Portal · Last updated September 23, 2026

Arca (arcaportfolio.com) is a business application operated by Arca LLC, a Missouri limited liability company. Anyone can create a workspace; the owners, partners and staff invited into a workspace use it to review the business information they share with each other. Each workspace's data is visible only to its members.

What we collect

• Account information. Your name and email address, used solely to sign you in and control what you can see. Sign-in is by emailed magic link or Google sign-in; with Google we receive only your basic profile (name, email) and never your password.
• Business records. Financial statements, documents, invoices, and related operating data that portal members share with each other as part of running the business.
• Activity records. Basic sign-in and usage events, kept for security and audit purposes.
• Connected accounts. If a workspace admin links a unit to QuickBooks Online, we store the access tokens needed to read that company's profit and loss report on request. Tokens are never visible in the portal and are removed when the link is deleted.
• Notifications. If you turn on notifications for a device, we store that device's push subscription and your notification preferences, and remove the subscription when you turn them off or the device stops accepting them.
• Billing. Payments are handled by Stripe. We keep a Stripe customer reference and subscription status; card and bank details are held by Stripe, never by Arca.

What we don't do

• We do not sell, rent, or share personal information with third parties for their own use.
• We do not use advertising or cross-site tracking of any kind. Browser storage is used only to keep you signed in and remember simple preferences, such as the tab you were last on. The public demo keeps its sample data in your own browser and sends none of it to us.

Service providers

The portal runs on providers acting on our behalf, each processing data only as needed to provide its service:

• Supabase — authentication, database and file storage.
• Vercel — hosting the website.
• Resend — sending and receiving email, including bills emailed to your workspace's inbound address.
• Stripe — payments.
• Anthropic — the AI model behind features that read an invoice, statement or document for you. It receives only the document being read, only when someone uses one of those features, and under terms that do not allow it to train its models on that data.
• Google — optional sign-in.
• Intuit — QuickBooks Online, only for units an admin has connected.
• Your browser's push service (Apple, Google or Mozilla) — delivering notifications to devices where you turned them on.

Retention and access

Account and business records are kept for as long as they are needed for the business and its legal obligations. Access is limited by role, and every member sees only what their ownership or role permits. A workspace administrator can ask us to delete the workspace and its data at any time.

Contact

Questions or requests about your information: info@arcaportfolio.com.