AI processing disclosure

ARCY AI uses a third-party AI model to answer questions and to act inside your Product on a visitor's behalf: it decides which of the operations you turned on for the chat to call, in what order, and works on the page itself when none of them fits. It also shows a visitor things they did not ask for, from how they use your Product, and asks them one question. If you are subject to automated-decision-making disclosure requirements, GDPR Article 22 and its equivalents, your privacy policy needs a disclosure for this, separate from your general data-collection paragraph.

Update your policies on ARCY MCP adds this notice as its own heading beside your privacy paragraph, lists only the attributes an AI model may read, and keeps each bullet about an Action only while a live Experiment carries that Action.

What to paste

Automated Processing and AI Features

[Your Product Name] uses an AI assistant, powered by ARCY AI, that may:

- Answer your questions using context about your account and how you use
  [Your Product Name]
- Carry out a sequence of steps inside [Your Product Name] on your behalf, such
  as navigating to a page, clicking a button, or filling in a form, when you
  ask it to do something for you
- Offer or start one of the guided flows we have built, based on how you use
  [Your Product Name], such as the page you are on or a task you have not
  finished
- Show you something in its own bar without being asked, based on how you use
  [Your Product Name]: a line of text in the bar, a card with news from us, or a
  list of steps left to finish, in words we wrote in advance and always inside
  the assistant's own area of the screen
- Open a web address in a new tab when you press the button on a card we show
  you. The address is one we chose, and it may lead outside
  [Your Product Name]
- Ask you how likely you are to recommend [Your Product Name], and the main reason
  for the score you give, at most once every 90 days
- Offer to pass your request to our support team when it cannot answer you,
  when you ask for a person, or when your question is one we send to a
  person

The assistant chooses for itself which steps to take and in what order, and
where none of the operations we turned on for it fits, it may find its own
way through [Your Product Name]. It works in your own browser under your own
sign-in, and only on web addresses we have verified as ours, so it reaches
nothing you could not reach yourself. Where a step would change your data, it
shows you what that step will do, written from the step itself rather than by
the AI model, and waits for you to agree; the only exceptions are operations
we have marked as safe to run without asking, and a step that cannot be
undone is never one of them. It never fills in or reads a password, a card
number, an expiry date, a security code, a one-time code or a bank account
number (IBAN), and it never presses a button on the page until you agree
to it.

It shows you the summary it would send before it does this,
and nothing reaches our support team unless you agree to it. The helpdesk that
receives it is a provider we chose and connected ourselves, and it handles
your request for us under our own agreement with it.

When it answers, the assistant may read these account details:
[list the attributes with AI access on, e.g. plan name]. We decide which details it may read, and we can withhold
any of them at any time. When it runs one of the
operations we turned on for it, it reads that operation's answer too, cut
down in your browser to the fields we named for it before any of it leaves
your device. ARCY AI never stores payment or
credential data (card numbers, card security codes, PINs, passwords, bank
account numbers) as an account detail.

This feature is powered by a third-party AI model. Neither [Your Company Name]
nor ARCY AI uses your conversation content, session data, or
behavioral data to train AI models, ours or the model provider's. This
feature is not used to make legal or similarly significant decisions about
you (for example, decisions about eligibility, pricing, or account status)
without human review.

You can decline this feature at any time by [describe your opt-out mechanism, e.g. "closing the assistant panel" or "disabling it in account settings"].

Notes on filling this in

• The sentence about legal or similarly significant decisions is accurate only if it is true of the flows you published. If a flow can take an action with real consequence, submitting a payment or deleting data, get specific legal advice on Article 22 rather than relying on this paragraph.
• Keep the paragraph under the bullets as written. Each sentence states a limit ARCY holds to on every step: the call runs in the visitor's own browser under their own sign-in, only on a verified Domain, a step that changes data shows a card ARCY writes from the step itself, a step marked No undo always asks and cannot be switched to run without asking, and the six field kinds are never filled or read. Softening any of them describes a product you do not have.
• The offer-or-start bullet is true once a live Experiment carries a Pill, a Peek or a Run Action, which all name a flow, or an Announcement or a Whisper whose button or tap starts one; see Specialists. With none of those live, delete the bullet.
• The bullet about what the assistant shows you unasked is true once a live Experiment carries a Whisper (the line of text), an Announcement (the card) or a Show (the list of steps). Delete the kinds you do not run and keep the rest of the sentence as written: the words are the ones you published, and nothing in any of the three covers the page.
• The bullet about a web address is true only once a live Announcement has a button you gave an address to under Link the button opens. An Announcement whose button starts a flow, and one with no button, open nothing: delete the bullet for either. Keep it as written where you keep it. The address is yours, so ARCY does not check it against your verified Domains, and the visitor reads your button label without seeing where it goes.
• The bullet about recommending is true only once a live Experiment carries an Ask NPS Action. It asks each person at most once every 90 days across your whole Product, and the wording of the question itself is fixed, so you write nothing for it. The score and the reason are collected data: the privacy paragraph lists them too, see Privacy policy.
• The bullet about passing a request to a person, and the paragraph under it, are true only once a helpdesk is connected on Integrations. Without one, delete both: nothing leaves ARCY for anyone. Keep the consent sentence as written where you keep them, because nothing is sent until the end user agrees to the summary they are shown.
• The account details list names only the attributes with AI can read this value on (Attributes). Update your policies fills it from the switches; after you turn one off, run it again. Keep the payment sentence as written. It says what ARCY does, which is refuse those values before storing them as an account detail. It does not say a visitor's chat message is refused: nothing checks a message for those values, and a sentence saying otherwise promises a protection you do not have.
• Describe only what you turned on, not every capability ARCY offers. A visitor reaches the Endpoints you set Use in chat on (Endpoints) and the flows you published for that environment (Flows), and the assistant works on the page itself when neither of those answers. With no Endpoint in chat, delete the sentence about an operation's answer.
• Before referencing model retention in your own disclosure, read How AI request content is handled: the model provider retains no request content, ARCY's call log records cost rather than content, and the conversation itself is stored unless you switch that off.