← Back to Arc

Privacy Policy

Last updated: October 8, 2026

1. Introduction

Arc (“Arc”, “we”, “us”, or “our”) is operated by The Arc Studio. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use Arc, a LinkedIn growth management platform for agencies and their clients (the “Service”). By using Arc, you agree to the collection and use of information in accordance with this policy.

2. Who We Are

Arc is operated by The Arc Studio. For privacy inquiries, contact us at support@thearcstudio.com.

3. Information We Collect

3.1 Account Information

When you create an Arc account, we collect your name, email address, a hashed password (we never store passwords in plain text), and workspace details you provide.

3.2 LinkedIn Data (via OAuth)

When you connect a LinkedIn profile to a workspace, we receive the following from LinkedIn via their OpenID Connect API, only after your explicit authorization: your LinkedIn member ID, your public name, your profile picture URL, your email address associated with LinkedIn, and an access token that permits Arc to publish content on your behalf to your own LinkedIn feed.

For posts published through Arc, and for company pages you administer and connect, we also receive from LinkedIn the analytics LinkedIn makes available for them (such as impressions, reactions, comments and reshares) and the comments left on those posts, so they can be shown and answered within your workspace.

3.3 LinkedIn Post History (History Sync)

If you separately approve history sync on LinkedIn’s own consent screen (LinkedIn Member Data Portability), Arc receives a copy of the posts you have published on LinkedIn: the post text, publication date, links, media links and the post’s LinkedIn address. Arc also reads your name from that data, only to confirm that the person who approved is the owner of the connected profile. Arc imports these posts into your workspace so your analytics include posts you published directly on LinkedIn, and checks for new posts once a day while the approval is active. To find posts you publish after approving, Arc also reads LinkedIn’s record of your recent activity (the last 28 days) under the same approval; it keeps only posts you published yourself and stores nothing else from that record. History sync is optional, is only available where LinkedIn offers it, and never happens without your approval. Arc does not request any other part of your LinkedIn data archive.

We do not access, store, or process your LinkedIn connections, messages, other people’s feed content, search history, or any data about other LinkedIn members beyond the comments and reactions on your own posts described above.

3.4 Content You Create

Posts you draft, schedule, or publish through Arc are stored in our database so the Service can display, schedule, and publish them.

3.5 Usage Data

We log basic usage data (request timestamps, IP addresses, user-agent strings) for security and debugging purposes.

4. How We Use Your Information

We use the information we collect to provide and operate the Service, authenticate you, publish content to LinkedIn at your direction, display analytics within your workspace, communicate about the Service, and comply with legal obligations. We do not sell your personal data. We do not use your data to train machine learning models. We do not sell or share your LinkedIn data with third parties for their own purposes. It is processed only by LinkedIn itself (when publishing on your behalf) and by the service providers listed in section 6, solely to run the Service.

5. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, we process your personal data on the following legal bases: contract (to provide the Service), consent (for connecting your LinkedIn profile, publishing on your behalf, and history sync — withdrawable at any time by disconnecting the profile in Arc or removing Arc under LinkedIn’s “Permitted services”), and legitimate interests (security, fraud prevention, and Service improvement).

6. Data Storage and Transfer

Your data is stored in the European Union (Ireland) on servers operated by Supabase (PostgreSQL database) and Vercel (application hosting). We also use the following service providers, only for the features named: Anthropic (AI reply suggestions, which process the comment and post you ask for a suggestion on), an n8n workflow service (the idea sparring feature, which processes the draft you submit), and an email delivery provider (invitations and notifications). These providers act on our instructions and may process data outside the EU; we rely on Standard Contractual Clauses and equivalent safeguards for international transfers where required.

7. Data Retention

We retain your account and LinkedIn profile data for as long as your account is active. When you disconnect a LinkedIn profile, we delete its access tokens, its history-sync approval, the profile record, and the posts and analytics imported for it within 30 days. If you remove Arc under LinkedIn’s “Permitted services”, history sync stops and no further data is imported. When you delete your account, we delete all personal data within 30 days, except where retention is required for legal or auditing purposes.

8. Your Rights

Depending on your location, you may have the right to access the personal data we hold about you, correct inaccurate data, request deletion, object to or restrict certain processing, request data portability, withdraw consent at any time, and lodge a complaint with a supervisory authority. To exercise these rights, email us at support@thearcstudio.com.

9. Cookies and Session Management

Arc uses strictly necessary session cookies to keep you logged in. We do not use third-party advertising or tracking cookies.

10. Security

We implement reasonable technical and organizational measures to protect your data, including encrypted transport (HTTPS), hashed passwords, and access controls. No system is perfectly secure, and we cannot guarantee absolute security.

11. LinkedIn Data — Specific Disclosures

In compliance with LinkedIn’s API Terms of Use:

  • Arc only accesses LinkedIn data that you explicitly authorize via OAuth.
  • Arc only publishes content that you or authorized workspace members explicitly create and schedule.
  • Post history obtained through LinkedIn Member Data Portability is used only to show your own posts and their analytics inside your workspace. It is not sold, shared for advertising, combined with data from other members, or used to train machine learning models.
  • You can revoke Arc’s access at any time from your LinkedIn account settings under “Data privacy” → “Permitted services”, or by disconnecting the profile inside Arc.
  • If your LinkedIn authorization expires, Arc will prompt you to reconnect and will not attempt any action until you do.
  • Arc will delete LinkedIn-derived data within 30 days of your disconnect or account deletion request.

12. Children’s Privacy

Arc is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent changes. Material changes will be communicated via email or in-app notification.

14. Contact

For questions about this Privacy Policy, contact:
The Arc Studio
support@thearcstudio.com