What ARCY collects

ARCY runs inside your product. ARCY AI is currently offered as a BETA product; this page explains what we collect during normal arcy.js operation, what we never access, and how data is retained, as things stand today.

This is a technical explainer, not the legal Privacy Policy. For the binding document, including your rights over your data (access, correction, deletion, restriction, portability, and objection) and our Children's Privacy stance, see arcyai.com/privacy.

Session events

When arcy.js is installed, it collects the following per user session:

• Session start and end timestamps
• The active route when a session begins
• Interaction events: clicks on interactive elements, navigations, and form submits, described structurally (element type, position, label) rather than by value, so ARCY can identify which element a Flow step should target and compute struggle signals and insights, without you annotating your source code
• Flow progress (which steps of an authored Flow were started, completed, or skipped)
• The userId and any attributes you pass to identify()
• Conversation text when a user talks to Chat, or when a Flow runs, so the agent can hold context across a session and so you can review conversation history

Turning off message-content storage: You control whether ARCY stores the text your users type into the widget. In your app settings, under Data privacy, turn off "Store message content." When it is off, ARCY keeps only usage metadata for each conversation (which mode was used, which page, and timing) and never stores the message text or the assistant's reply. This is on by default so conversation history and insights work out of the box.

Masking, before anything leaves the browser: input and hidden field values, and anything matching an email, SSN, or card-number pattern, are masked client-side before an autocapture event is ever sent. What ARCY receives is the shape of an interaction (what kind of element, roughly where, what it's labeled), not the values your end users typed.

Autocapture events are rolled up into aggregated confidence statistics, and the events themselves are kept for as long as your app is active. Your own insights are computed against that history, so a rolling deletion window would quietly shrink what you can measure. See Data retention for every retention period, and how to request deletion.

What we do not collect: email addresses, passwords, or form field values you have not explicitly passed to us as an attribute.