Privacy policy paragraph
Copy-paste language disclosing the embedded ARCY AI assistant to your end users, with notes on what to change before publishing.
When arcy.js runs in your Product, your end users' session data is processed by ARCY AI as a sub-processor acting on your instructions, and your privacy policy needs a paragraph saying so. The block below is a starting point, not a finished document.
Update your policies on ARCY MCP writes this paragraph under your own privacy policy's processors heading, listing the attributes you actually pass.
This is boilerplate, not legal advice. Have your own counsel review it before publishing, and adapt it to how you configured ARCY AI: which attributes you pass, whether conversation storage is on, which flows you published, and whether you connected a helpdesk.
What to paste
Third-Party Product Assistance (ARCY AI)
[Your Company Name] uses ARCY AI, a third-party service, to provide in-product
guidance, assistance, and support inside [Your Product Name]. When you use
[Your Product Name], ARCY AI's software collects certain data about your
session and interactions on our behalf, including:
- Session timestamps and the pages you visit within [Your Product Name]
- Structural details of your interactions (for example, that you clicked a
button, submitted a form, or navigated to a page), described by element
type, position, and label, not by the values you typed
- Progress through in-product guided flows, if used
- Your answer when the assistant asks how likely you are to recommend
[Your Product Name]: the score you give, and the main
reason you type for it, if you type one
- Conversation content, if you interact with the ARCY AI-powered assistant
("[Your Assistant Name]")
- An identifier and these account details we share with ARCY AI:
[list the attributes you pass, e.g. plan name, role]
ARCY AI never stores payment or credential data. An account detail that
looks like a card number, a bank account number (IBAN) or an API key, or
that is named for a card security code, PIN or password, is refused before
it is stored. An answer you type into one of our guided flows goes through
the same check before any of it is saved as an account detail.
ARCY AI masks sensitive input (such as passwords, form field values, and
patterns resembling emails, government IDs, or payment card numbers) in your
browser before this data is transmitted. Before you answer our cookie
banner, ARCY AI counts page views and interactions on [Your Product Name]
with no identifier and without storing anything in your browser; the only
per-day count is a one-way hash that is discarded at the end of the day, and
your IP address is not retained. A Do Not Track or Global Privacy Control
signal from your browser stops this measurement. ARCY AI acts as our data processor
for this purpose and does not sell your data or use it to train its own AI
models. For details on how ARCY AI itself processes data, including your
rights to access, correct, delete, restrict, port, or object to this
processing, see ARCY AI's own Privacy Policy at https://arcyai.com/privacy
(and, for data subjects in Turkey, https://arcyai.com/kvkk).
If the assistant cannot answer you, if you ask for a person,
or if your question is one we send to a person, it offers to pass your request
to our support team and shows you the summary it would send. Nothing is sent
unless you agree to it; once you do, ARCY AI sends our helpdesk the
conversation as ARCY AI stored it, the summary you read, and an email address
to reply to, either the one on your account or the one you give. That helpdesk
is a provider we chose and connected ourselves, so it processes this data for
us under our own agreement with it rather than as part of ARCY AI's own
service.
You can ask us to disable this functionality for your account by contacting
[your support contact].Notes on filling this in
- Replace every
[bracketed]placeholder. If the in-product assistant has no name, drop that sentence or write "the in-product assistant". - List only the attributes you pass to
identify(). Do not describe data you do not send. - Keep the payment sentences as written. ARCY refuses an attribute value that looks like a card number, a bank account number or an API key, no attribute may be named for a card, a security code, a PIN, a password or an IBAN (Attributes), and an answer a visitor types into a flow goes through that same check before it is saved. Nothing checks a chat message for those values, so a paragraph claiming a message is refused describes a protection you do not have; delete that claim where an older paragraph carries it and run Update your policies again.
- The two lines about recommending are true only once a live Experiment carries an Ask NPS Action (Specialists). The score is kept whatever else you configured. The typed reason is kept only while Store conversations is on for that Product, so with it off keep the score and delete the rest of that bullet.
- If Store conversations is off for your Product, replace the conversation bullet with: the timing of any conversation with the assistant, but not what you or the assistant wrote. The inventory this paragraph summarizes is on What ARCY collects.
- The paragraph about passing a request to a person is true only once a helpdesk is connected on Integrations. Without one ARCY sends nothing to anyone, so delete it rather than publishing a transfer you do not make. Update your policies writes it only when a connection is there.
- Do not claim a certification on ARCY AI's behalf that is not complete on Certification status.
- The cookies and browser storage this paragraph refers to have their own template on Cookie policy disclosure.