// PRIVACY
Privacy Policy
Arc IT Inc. ("Arc IT", "we", "us") is a Toronto-based IT consulting company. We are committed to protecting your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL).
This policy explains what personal information we collect, how we use it, who we share it with, and what rights you have — whether you are a client, a website visitor, or someone who contacts us by phone, SMS, WhatsApp, or our web chat assistant.
1. What We Collect
Contact and account details — name, email address, phone number, company name, and mailing address, provided when you fill out a form, email us, call us, or engage our services.
Service and project details — information about your IT environment, requirements, or support needs that you share during consultations or ongoing work.
Appointment information — preferred date, service type, and notes when you book a consultation through our scheduling system.
Conversations across all channels — Arc IT operates its own AI-powered assistant ("ArcIT AI") to handle inbound enquiries, support requests, and bookings across phone, SMS, WhatsApp, and web chat. When you use any of these channels:
- Phone calls are processed in real time and a transcript is retained in our secure database. By continuing a call after the opening disclosure, you consent to your call being transcribed and stored.
- SMS and WhatsApp messages are stored in our conversation database. SMS is subject to the consent and opt-out terms in Section 5.
- Web chat messages submitted through the chat widget on our website are stored in our conversation database.
- Cross-channel history and memory — to provide consistent service, ArcIT AI links your conversations across channels using your verified contact record and maintains a brief rolling summary of prior context. Full transcripts are retained and searchable by our team.
Contact records — when you engage with us, a contact record is created and maintained in our self-hosted CRM system, which runs on Arc IT's own infrastructure in Canada. This record stores your contact details, service history, interaction logs, and the AI-generated conversation summaries described above.
Identity verification — when you request account-sensitive information through ArcIT AI, we may verify your identity by sending a one-time passcode (OTP) to your registered phone number.
Website analytics — pages visited, session duration, referral source, browser type, and device type, collected in aggregate via Google Analytics. Cloudflare also logs request metadata (including truncated IP addresses) for security and performance purposes.
2. How We Use It
We use your personal information to:
- Deliver IT consulting, managed services, cloud, and cybersecurity work you have engaged us for.
- Respond to enquiries and provide customer support.
- Schedule appointments and send confirmations and reminders by SMS or email.
- Operate ArcIT AI — processing your messages through the assistant so it can understand your request and respond helpfully, and maintaining conversation history so you receive consistent service across channels.
- Verify your identity before sharing account-sensitive information.
- Send marketing newsletters and service updates, but only with your express consent and always with a clear opt-out (see Section 5).
- Detect and block abusive or fraudulent messages before they are processed.
- Meet our legal and accounting obligations.
- Improve our website and services using aggregated, de-identified analytics.
We do not use your information for automated decisions that produce legal or otherwise significant effects without human review.
3. Third-Party Service Providers
We do not sell your personal information. We share it only with the following vendors who process it on our behalf, under written agreements that restrict their use:
- OpenAI (United States) — the AI engine that powers ArcIT AI. Message content, voice audio, and conversation context are transmitted to OpenAI's API for real-time processing and response generation.
- Twilio (United States) — phone calls, SMS, WhatsApp delivery, and one-time passcode verification. Phone numbers and message content are processed through Twilio's platform.
- Microsoft 365 (Canada) — appointment scheduling via Microsoft Bookings and email delivery. Name, phone, email, and appointment details are stored within Microsoft's Canadian data region.
- Google Analytics (United States) — pseudonymous website analytics. IP addresses are truncated before storage.
- reCAPTCHA (United States) — spam and abuse protection for our website forms and chat systems. Hardware and software information, such as device and application data, is collected and sent to Google for analysis to secure our website.
- Cloudflare (United States / global) — DNS, CDN, DDoS protection, and website performance. Request metadata is processed across Cloudflare's global network.
- Vultr (Canada) — cloud hosting infrastructure and virtual private servers where our applications and services are securely hosted and processed.
We may also share your information with professional advisors (lawyers, accountants, insurers) under confidentiality obligations, and with law enforcement or government authorities when required by law.
4. Cross-Border Transfers
Our CRM and Microsoft 365 data is hosted in Canada. OpenAI, Twilio, Google, and Cloudflare operate primarily in the United States, meaning some of your personal information will be processed there. We take steps to ensure these providers maintain privacy and security standards comparable to PIPEDA. However, data in a foreign jurisdiction may be accessible to that country's courts or law enforcement. If you have concerns, please contact our Privacy Officer (Section 9).
5. SMS, WhatsApp, and Email Communications
Marketing messages — if you provide your email address when contacting us, submitting an enquiry, or engaging our services, you may receive marketing emails from Arc IT unless you opt out. Under CASL, this constitutes implied consent arising from our existing business relationship. You can unsubscribe at any time using the link in any email we send (see opt-out instructions below). We do not send unsolicited marketing SMS without your express consent.
Transactional messages — appointment confirmations, booking reminders, service notifications, and support follow-ups may be sent without separate marketing consent as they are necessary to deliver your service.
Opting out of SMS / WhatsApp — reply STOP, UNSUBSCRIBE, CANCEL, END, or QUIT at any time. We will process your opt-out within 10 business days. Reply START or YES to opt back in. Opting out of marketing messages does not affect transactional messages tied to an active service.
Opting out of email — click the unsubscribe link in any marketing email, or contact us directly. We will process your request within 10 business days.
Standard message and data rates from your carrier may apply to SMS. Arc IT is not responsible for carrier charges.
6. Cookies
Our website uses cookies and similar technologies in three categories:
- Strictly necessary (Arc IT, Cloudflare) — session management, security, and DDoS protection. These cannot be disabled without breaking the site.
- Analytics (Google Analytics) — aggregate, pseudonymous usage statistics. You can opt out via your browser's Do Not Track setting or the Google Analytics Opt-out Add-on.
- Chat widget (Arc IT) — maintains your chat session while you are on the page. No cross-site tracking. Clear your browser storage or close the widget to remove it.
We do not use advertising or behavioural-targeting cookies and do not share cookie data with ad networks.
7. Data Retention
We keep personal information for as long as it is needed to deliver your service, maintain our business relationship, and meet our legal obligations. In general: active client records are kept for the duration of our relationship plus seven years for tax and legal purposes; call transcripts and conversation logs are retained for 24 months then deleted or anonymised; SMS and email consent records are kept for three years after consent expires; OTP verification logs are deleted after 90 days; website analytics data is retained for 14 months (Google Analytics default). When a retention period expires, data is securely deleted or irreversibly anonymised.
8. Your Rights
Under PIPEDA you have the right to:
- Access — request a copy of the personal information we hold about you.
- Correction — ask us to correct inaccurate or incomplete information.
- Withdrawal of consent — withdraw your consent to a specific use at any time, subject to legal or contractual obligations.
- Deletion — request deletion of information that is no longer necessary, subject to our legal retention obligations.
- Complaint — if you believe your privacy rights have been violated, you may file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca. We encourage you to contact us first.
To exercise any of these rights, send a written request to our Privacy Officer (below). We will respond within 30 days and may need to verify your identity before fulfilling a request.
9. Contact Us
Privacy Officer, Arc IT Inc.Toronto, Ontario, Canada
Email: [email protected]
Phone: 1 (844) 20 ARC IT
For privacy-related requests we recommend emailing us directly to ensure your request is handled by a person.
10. Changes to This Policy
We may update this policy periodically. When we make material changes we will update the effective date above and, where required by law, notify active clients by email at least 30 days before the change takes effect. Continued use of our services after that date constitutes acceptance of the updated policy.