Privacy

This notice covers two things that are easily confused: this website getarca.de, which you are on right now, and the arca product itself, which brands use after signing in at app.getarca.de. Part 1 applies to the website, Part 2 to the product.

Controller

Armand Tetaj, Dorfstraße 57a, 24784 Westerrönfeld, Deutschland. Contact: hallo@getarca.de.

Part 1 — This website (getarca.de)

What this page stores

Nothing, unless you send something. This page sets no cookies, loads no third-party fonts and uses no analytics. That is also why it never asks for consent — there is nothing to consent to.

If you submit the form

Your name, brand, store address and email address are stored and passed on to us. We use them solely to answer your enquiry — not for advertising, and we pass them to no one. The legal basis is Art. 6(1)(b) and (f) GDPR.

We delete the details once the enquiry is settled and no retention period stands in the way.

Server logs

The server briefly records which page was requested when, including the IP address. This is technically necessary to deliver the page and to detect attacks (Art. 6(1)(f) GDPR).

Part 2 — The arca product

Who is responsible for what

arca is a tool that brands use for their influencer, affiliate and paid marketing. The brand decides which data it processes with it — under the GDPR, the brand is the controller. We process that data on its behalf and on its instructions (processing on behalf of a controller, Art. 28 GDPR); a data processing agreement is concluded with every brand.

If you are a creator and want to know what a specific brand holds about you, contact that brand. We may not release its data on our own — but we help the brand answer you, and we delete on its instruction.

Data from the Shopify store

When a brand connects its store, arca reads the following through Shopify’s official API: orders with amount, currency, time, country and the discount code used, the products ordered, the discount codes themselves, and the markets configured in the store. In addition — where the brand grants it — the name and email address of the customer.

Purpose: to work out which creator produced which revenue, what commission is due on it, and whether a booking paid off. Nothing else. This data is not combined into profiles, not used for advertising and not sold to anyone.

Customer data from the store falls under Shopify’s rules for protected customer data. We retrieve only what is needed to attribute a sale, erase it within 30 days of a store’s request, and remove it entirely when a brand uninstalls arca.

Data from Instagram and Facebook (Meta)

arca uses the official interfaces of Meta Platforms Ireland Ltd. — the Instagram Graph API, Facebook Login and, where granted, the Instagram Creator Marketplace. A brand connects its own Instagram business account; a creator may connect their account when working with a brand.

What is processed:

• About the account: ID, username, display name, profile picture, biography, category, follower count and the contact address on file — as far as the account makes these public or has granted access to them.
• About posts: ID, type (image, video, story), timestamp, thumbnail, caption, number of likes, comments, views and reach.
• About the audience: aggregated figures only — distribution by country, city, age bracket, gender and language. Never individual followers, never their names.
• For sign-in: the app-scoped ID under which Meta identifies an account to arca. arca never sees a password.

Purpose: so a brand can judge whether a creator fits, so booked posts can be tracked, and so the performance of a collaboration can be measured. The legal basis is the consent given to Meta when the account is connected, and the brand’s legitimate interest in evaluating its own collaborations (Art. 6(1)(a) and (f) GDPR).

What arca explicitly does not do with Meta data

• It is not sold, rented or passed on.
• It is not used to target advertising or to build advertising audiences.
• It is not used to assess anyone’s creditworthiness, insurability or suitability for employment.
• It is not used to train AI models.
• It is not merged with data from other sources into a profile that goes beyond the collaboration with the brand in question.

Data from the email mailbox (Google, Microsoft)

A brand can connect its own email mailbox to arca in order to contact creators from it and to see their replies. For Google accounts this runs through the official interfaces of Google Ireland Ltd. (Gmail API), for Microsoft accounts through Microsoft Ireland Operations Ltd. (Graph API). The brand grants access itself while connecting; arca never sees a password.

What is processed:

• The mailbox address — so arca knows which mailbox was connected and which address it sends from.
• Messages of that mailbox: sender and recipients, subject, body, timestamp and the thread identifier. The body is truncated at 20,000 characters; HTML mail is converted to plain text.
• Of attachments, only the file names — at most thirty per message. The content of an attachment is never downloaded and never stored.
• Messages arca sends — recipient, subject, body and attached files of the mail sent on the brand’s behalf.

Purpose: so that the correspondence with a creator sits in one place instead of being scattered across several mailboxes, and so a brand can see who replied and who did not. The legal basis is the consent given to Google or Microsoft when connecting the mailbox, together with the brand’s legitimate interest in organising its own collaborations (Art. 6(1)(a) and (f) GDPR).

Who can see it: only people of the same brand who hold the right to view mailboxes in arca. If a mailbox is connected as a personal one, only the person it belongs to can see it. Other brands never can.

When the AI reads a mail thread

A brand can create rules in arca that answer a plain-language question — for example “Does the creator want to collaborate?”. Only in that case are up to fifteen messages of the thread concerned, each truncated to 1,500 characters, transmitted to Anthropic PBC so the question can be answered. The result is a yes or no with a reason.

If a brand creates no such rule, no mail text leaves arca. arca itself never uses this data to train models and sends it to no further recipient. Which access to Anthropic the operator of this arca installation uses is stated in the list of processors below.

What arca explicitly does not do with mailbox data

• It is not sold, rented or passed on.
• It is not transferred to advertising platforms, data brokers or resellers.
• It is not used to serve ads, build audiences or re-identify people.
• It is not used to assess anyone’s creditworthiness, insurability or suitability as an employee.
• It is not used to train AI models.
• No human at arca reads it — unless the brand explicitly asks for help with a fault and grants access for that purpose, or the law requires it.
• It is used only for features that are visible in arca: the correspondence shown on a creator, the task arising from it, and the evaluation of the collaboration.

arca’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When a creator signs in to the portal

When a creator works with a brand, they receive access to their own area in arca. Stored there are: their name, their email address, an encrypted proof of their password — never the password itself in clear text —, the terms agreed with them and their figures. They see only what concerns them.

How long data is kept

• Access tokens for Shopify, Meta and the mailbox: until the connection is removed, then immediately.
• Data of an Instagram account: until the creator or the brand disconnects it, at the latest 24 months after the last retrieval.
• Order and revenue data: for as long as the brand uses arca; then 30 days, then deleted. The brand’s own statutory retention obligations are unaffected — those concern its own records, not our copy.
• After a brand uninstalls: all of that brand’s data within 30 days, without anyone having to ask.

How to have your data deleted

There are three routes, and all three end in the same place:

• Through Facebook or Instagram: if you remove arca there under “Apps and Websites”, Meta automatically sends us a deletion request. You receive a confirmation code; at app.getarca.de/meta-loeschen you can check the status of the deletion at any time using that code.
• Inside arca: if you have portal access, deletion is under Profil in the card „Deine Daten“.
• By email to hallo@getarca.de: write to us, we pass it on to the brand concerned and delete whatever is in our hands.

Deletion happens within 30 days in every case. The only exception is what we are legally required to keep; in that case we tell you what it is and why.

Who else processes the data

• Hetzner Online GmbH, Germany — servers and database. This is where the data lives.
• Shopify International Ltd., Ireland / Shopify Inc., Canada — the source of the order data.
• Meta Platforms Ireland Ltd., Ireland — the source of the Instagram and Facebook data.
• Anthropic PBC, USA — the AI that drafts text and assesses creator profiles. It receives only what a single question requires and does not retain it.
• The brand’s own email provider (such as Google Workspace or Microsoft 365) — arca sends messages through the mailbox the brand connects itself. We operate no mail service of our own for brands.

Where Anthropic, Shopify or Meta transfer data to the USA or Canada, those transfers rely on the European Commission’s Standard Contractual Clauses and, where applicable, on the adequacy decision for the EU-US Data Privacy Framework.

Security

All connections are encrypted. Access tokens for Shopify, Meta and mailboxes are stored encrypted and never displayed in clear text. Every brand sees only its own data; that is not merely a setting but enforced on every single query and backed by automated tests.

Your rights

You may request access, correction, deletion, restriction and portability of your data, object to processing, withdraw consent at any time, and complain to a supervisory authority. Write to hallo@getarca.de.