Last Updated: September 29, 2026
ARCTHEON operates the AEMS platform. This Privacy Policy explains what information the platform collects, how we use it, and the choices you have. It applies to the cloud Service and, where relevant, to the local install edition. It forms part of our Terms of Service.
Account information: your name, business email address, company name, and password (stored only as a salted hash). Subscription and billing information: your plan and payment status; card data is handled by our payment processor and never stored on our servers. Usage and technical information: how you and your Team Members use the platform, security and audit logs, and basic device and browser information needed to run the Service. Data you and your Team Members create or handle: business records such as customer contacts, notes, tasks, messages, and documents. Connection credentials: when you link a third-party service (email, storage, CRM, phone), the credentials you provide are stored only in encrypted form and are decrypted only at the moment of use, never displayed in full.
We use information to provide and maintain the Service, authenticate you, process subscriptions and payments, deliver notifications and support, secure the platform and detect abuse, and improve reliability. Your business data is processed to operate the features you use, such as your CRM, task board, and Team Member memory. We do not sell or rent your personal information. We do not use your business data or your Team Member conversations to train language models.
Team Members reason through third-party brain services (language model providers) that you connect, such as Ollama, OpenAI, Anthropic, or Google. When a Team Member works, the content of that work, which may include business data you have supplied, is sent to the provider you configured, under the account you created with them. How that provider stores or processes data is governed by their privacy policy. We recommend reviewing the policies of the providers you connect and choosing providers and settings appropriate for your business.
Data is stored on infrastructure in the United States. Credentials and secrets are encrypted at rest (AES-256) and all traffic is encrypted in transit (TLS). Each business workspace is isolated at the database layer through row-level security, so one customer cannot read another customer data. Every Team Member action is written to a signed, tamper-evident audit log. In the cloud edition, when a Team Member uses Cloud Computer Use on your machine, pictures of your screen never leave your computer and are never stored; only the words and controls needed for the next step are transmitted over the encrypted connection. In the local install edition, your data stays on your hardware, and cloud connections occur only if you configure them.
Different categories of information are kept for different periods. Account and billing records are retained while your account is active. Work history, including Team Member outputs, follows your plan retention setting: 7 days on Light, 30 days on Full Suite, and up to 1 year on Enterprise. On the local install edition, retention is entirely on your hardware and under your control. You can export your data at any time from the platform. When you close your account, your data is deleted within 30 days, except where we must retain records for legal, tax, or security purposes.
We share information only as needed to run the Service: with hosting and database providers, our payment processor, email delivery providers, and the third-party services you explicitly connect. Each provider handles data under its own terms and privacy policy. We do not sell your data, and we do not share it for advertising. We may disclose information where required by law or to protect our rights, and we will notify you where legally permitted.
If we become aware of a security incident affecting your data, we will notify affected account owners without undue delay, along with what happened, what data was involved, and what we are doing about it.
You can access, correct, export, and delete your data using the tools built into the platform, including full export from the Import and Export page. You can disconnect any third-party service at any time, which stops all processing through it. Marketing emails, if you subscribed, include an unsubscribe link, and every email we send carries a working opt-out. To exercise any right you cannot complete yourself, contact us and we will respond within 30 days.
We use only essential cookies: session authentication tokens, security tokens, and your theme and language preferences. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.
The Service is intended for business use and is not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.
We may update this Privacy Policy as the Service evolves. When we make material changes we will notify registered users by email or in-app notification before they take effect, and we will update the date at the top of this page. Continued use after the effective date means you accept the updated policy.
This Privacy Policy is binding in English. The Spanish translation is provided for accessibility only. In any conflict between the English and Spanish versions, the English version governs.
If you have questions about this policy or how your data is handled, contact us through the Contact page in the Service.