Privacy Policy

Arch provides marketing and revenue intelligence software and services for residential home services contractors. This Privacy Policy describes Arch's privacy practices and how we handle personal information that we collect through our websites, web-based portal, and any other sites or services that link to this Privacy Policy.

Personal Information We Collect

We collect the following categories of information:

Information you provide

• Contractor contact details, including first and last name, phone number, and email address.
• Contractor company information, such as the contractor's contact URL and website.
• Payment information needed to complete contractors' subscription (including name, payment card information, and billing information). Payment information is processed by our third-party payment processors, and we do not store payment card numbers.
• Communications that we exchange with you, including when you contact us with questions, feedback, or otherwise.
• Marketing information, such as your preferences for receiving communications about our services and publications, and details about how you engage with our communications.
• Customer Information refers to data obtained through integration with your CRM or files you provide to us. This includes all relevant past customer details necessary for us to provide our services, including but not limited to homeowner addresses, email, phone number, job history, job values, and job types.

Use of Information

• Arch will use your information solely to provide and improve the services relevant to you. We will not share your proprietary information with other customers. Arch will not use Customer Information to independently contact homeowners or end-customers for Arch's own marketing purposes. Marketing communications sent through the Platform to homeowners or end-customers are initiated by and sent on behalf of the contractor.
• Arch may generate anonymized and aggregated data derived from customer information to develop and enhance tools and services for all users. However, this data will not contain personally identifiable or customer-specific details accessible to other users.

Information we obtain from other sources

We may obtain your personal information from other third parties, such as marketing partners, data providers, and publicly available sources.

Automatic data collection

We and our service providers may automatically log information about you, your computer or mobile device, and your interaction over time with our services, such as:

• Device data, such as your computer's or mobile device's operating system, manufacturer and model, browser type, IP address, unique identifiers, language settings, mobile device carrier, and general location information such as city, state or geographic area; and
• Usage data, such as pages or screens you viewed, how long you spent on a page, browsing history, and access times.

Cookies, pixels and similar technologies

We and our partners use cookies, pixels, tags, software development kits and similar technologies on our website and in our communications. These technologies collect information such as your IP address, device and browser type, pages viewed, links clicked, referring URL and the time of your visit. We use this information to operate and secure our website, understand how visitors use it, measure the performance of our marketing, and show you relevant advertising on other websites, apps and streaming services.

Some of these technologies are placed by advertising and analytics partners, who may collect information about your activity on our website over time and across other websites and services.

Advertising and Analytics Partners

We work with the following advertising and analytics partners, which may collect information through the technologies described above or receive information from us:

• Amazon Ads, including the Amazon ad tag, Amazon DSP and Amazon Marketing Cloud. Privacy notice: https://advertising.amazon.com/legal/privacy-notice
• LinkedIn, including the LinkedIn Insight Tag. Privacy policy: https://www.linkedin.com/legal/privacy-policy
• Google, including Google Analytics and Google Tag Manager. Privacy policy: https://policies.google.com/privacy
• Meta, including the Meta Pixel. Privacy policy: https://www.facebook.com/privacy/policy

Each partner's use of information is governed by its own privacy policy.

How We Use Information for Advertising

We use personal information to market Arch's products and services, including:

• Website-based advertising: showing ads on other websites, apps and streaming TV services to people who visited our website, and measuring whether those ads led to visits or requests on our website.
• Customer list matching: sharing hashed (one-way encrypted) contact information, such as email addresses, phone numbers or postal addresses, with advertising platforms so they can match it to their own users and show our ads to people who already have a relationship with Arch, such as customers, prospective customers who have requested information from us, and event contacts. We may also use this to exclude those people from campaigns. Platforms use hashed data only for matching and do not receive it in readable form.
• Measurement: understanding how our advertising performs, including comparing groups that did and did not see an ad.

Under some US state laws, these activities may be considered "selling" or "sharing" personal information, or "targeted advertising." You can opt out as described in "Your advertising choices" below.

The categories of personal information we may disclose for these purposes are: identifiers such as hashed email addresses, phone numbers, IP addresses and cookie or device identifiers; internet or other electronic network activity, such as pages viewed and interactions with our website; and general geolocation derived from IP address.

We do not sell or share the personal information of consumers we know to be under 16 years of age. We do not use sensitive personal information for advertising.

How We Use Personal Information

We use personal information for the following purposes:

To provide our services

• Administering, hosting, and operating our services;
• Communicating with you and responding to any inquiries you may have;
• Personalizing your experience with the app and our communications, and making recommendations to you based on your choices and interests; and
• Analyzing your use of our services to allow us to evaluate and improve the services.

For research, development, benchmarking, and improving our services

We may use personal information to analyze and improve the services, identify trends, and operate and expand our business activities. We may also create aggregated, anonymized, or other de-identified statistics, which we may use for lawful business purposes, including for analytics, forecasting, and strategic planning. We may use this aggregated and de-identified data to analyze and improve our services, to produce industry benchmarks, and to promote our business, provided that it does not identify any customer, any customer's brand, or any individual.

For direct marketing

We may send you direct marketing communications, including, but not limited to, sending newsletters or publications, and notifying you of promotions, offers and events via postal mail, email, telephone, and other means. We do not use Customer Information to send direct marketing communications from Arch. Marketing communications sent through the Platform to homeowners are initiated by, and sent on behalf of, the contractor.

For compliance and protection

Including to enforce any applicable terms and conditions, comply with legal obligations, defend against legal claims or disputes, protect the security and integrity of our services, and identify and investigate fraudulent, harmful, unauthorized, unethical or illegal activity.

Processing of Customer Information on Behalf of Contractors

When contractors integrate their CRM or provide Customer Information (including homeowner names, addresses, email addresses, phone numbers, and job history), Arch processes this data solely on the contractor's behalf and at the contractor's direction for the purpose of providing the Services. Arch acts as a data processor with respect to Customer Information and does not independently determine the purposes or recipients of marketing communications sent through the Platform. Contractors are responsible for ensuring that they have obtained all necessary consents and permissions from their customers prior to providing Customer Information to Arch and prior to initiating marketing communications through the Platform.

Advertising on behalf of contractors

Contractors may instruct us to use Customer Information to run advertising campaigns on their behalf, for example to reach their existing customers on streaming TV and other channels. In that case:

• We process Customer Information only on the contractor's instructions.
• We send only hashed contact information to advertising platforms, such as Amazon Ads, solely to match it to platform users and show the contractor's ads. We do not use one contractor's Customer Information for our own advertising or for any other contractor.
• The contractor is responsible for providing any notices and obtaining any consents required by applicable law, and for honoring opt-out and deletion requests from its customers. We support this by excluding records the contractor tells us have opted out or been deleted.
• We may measure campaign results in aggregated, de-identified form, for example by comparing outcomes between customers who were and were not included in a campaign.

Homeowners who want to opt out of advertising based on a contractor's records should contact that contractor directly. They may also contact us at [email protected], and we will forward the request to the contractor.

Data We Receive From Advertising Platforms

When a customer connects a Meta (Facebook or Instagram) advertising account to Arch, Meta may send us advertising performance data and lead form submissions associated with that account. This includes campaign metrics such as spend and impressions, as well as lead form fields (for example, name, phone number, email, and address) submitted by end users in response to the customer's ads.

How we use this data

• We use advertising performance data and lead form submissions to attribute outcomes to marketing activity and to report cost per booked job and related performance metrics back to the customer.
• We may use this data to provide, maintain, and improve the services for the connected customer, including analytics, benchmarking, and campaign optimization.
• Lead form submissions are processed on the customer's behalf. Marketing communications sent through the Platform to those leads are initiated by, and sent on behalf of, the customer.

We do not sell your data

Arch does not sell advertising performance data or lead form submissions received from Meta, nor do we sell personal information to third parties for their own commercial purposes. We do not use this data to independently contact homeowners or end users for Arch's own marketing purposes.

Retention and deletion

We retain advertising platform data for as long as a customer's account is connected and for a limited period thereafter as needed to provide the services and comply with legal obligations. A user may request deletion of their data, or the data associated with their connected advertising account, by contacting us at [email protected]. We will review and act on valid deletion requests in accordance with applicable law and the platform's own data handling requirements.

Google User Data

When you connect a Google Ads account to Arch, you allow Arch to access data from that account through the Google Ads API. This section explains what we access and how we handle it.

What we access

• Your Google account identifier, so we know which Google account you connected.
• Data from the Google Ads accounts you can access, including Local Services Ads accounts: account and campaign details, keywords and search terms, performance and spend, conversions, and Local Services leads. Leads can include the name, phone number and messages of people who contacted your business.

How we use it

We use this data only to provide Arch's features to the business that connected the account: to show your advertising results and leads in Arch, to answer your questions about them in Arch, and to make changes to your Google Ads account that you start or approve in Arch.

How we store and protect it

Access tokens are encrypted at rest and are never shown after you connect. Data is stored on secured servers run by our cloud provider Amazon Web Services.

How we share it

We do not sell Google user data and we do not use it for advertising. We share it only with service providers that help us run Arch, including our cloud hosting provider and the AI model providers behind Arch's question-answering features, and only to provide features you request. These providers may not use the data for their own purposes or to train their models. We may also disclose it when the law requires it, or with your permission.

We do not use Google user data to develop, improve or train generalized artificial intelligence or machine learning models.

People at Arch read this data only when you ask us for support, for security reasons, or to comply with the law.

Disconnecting and deleting your data

You can disconnect Google Ads at any time in Arch under Settings > Integrations. Disconnecting removes Arch's access at Google and deletes the stored access tokens. You can also remove Arch's access at https://myaccount.google.com/permissions. To delete Google Ads data that Arch has already imported, email [email protected], and we will delete it within 30 days.

Limited Use

Arch's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

How We Disclose Personal Information

We may disclose personal information to:

• Affiliates. We may disclose personal information to our corporate parent, subsidiaries, and affiliates, for purposes consistent with this Privacy Policy.
• Service providers. We disclose personal information to companies and individuals that provide services on our behalf or help us operate our services or our business (such as hosting services, communications, data and cyber security services, billing and payment processing services, fraud detection, investigation and prevention services, web and mobile analytics, email and communication distribution and monitoring services, and customer relation management systems).
• Professional advisors. We disclose personal information to professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.
• Business partners. We may disclose contractor contact details and contractor company information to business and channel partners, resellers, and distributors in connection with the promotion, sale, and support of our services. We do not disclose Customer Information to these parties for their own marketing or business purposes.
• Authorities and others. We may disclose personal information to law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate.
• Business transferees. We may disclose personal information to acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, Arch or our affiliates (including, in connection with a bankruptcy or similar proceedings).

Your Privacy Choices

Unsubscribe from direct marketing communications

You may opt out of marketing-related communications by following the opt-out or unsubscribe instructions contained in the marketing communication we send you. You may continue to receive service-related and other non-marketing communications.

Your advertising choices

You have the following choices about advertising:

• Opt out of targeted advertising and the sale or sharing of personal information: visit Your Privacy Choices or email [email protected] with the subject line "Opt out." We will stop using your information for targeted advertising and customer list matching, and will remove you from audience lists we provide to advertising platforms going forward.
• Global Privacy Control: if your browser sends a Global Privacy Control signal, we treat it as an opt-out request for that browser, as described below.
• Cookies: you can block or delete cookies through your browser settings, or use browser tools such as Privacy Badger, uBlock Origin or Ghostery. Blocking cookies may affect how our website works. You can opt out of Google Analytics with the Google Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout
• Platform settings: you can manage ad preferences directly with advertising platforms, for example through your Amazon account's advertising preferences, LinkedIn's ad settings and Google's My Ad Center.
• Industry tools: you can opt out of interest-based advertising from participating companies through the Digital Advertising Alliance at https://optout.aboutads.info and the Network Advertising Initiative at https://optout.networkadvertising.org

Opting out does not stop all advertising. You may still see ads from us that are not based on your activity or personal information.

Do Not Track and Global Privacy Control

Our website does not respond to "Do Not Track" browser signals because there is no common industry standard for them. We do honor the Global Privacy Control (GPC) signal. When we detect a GPC signal, we treat it as a request to opt out of the sale or sharing of personal information and of targeted advertising for that browser or device, and we do not load advertising tags on our website for that session.

Data Security

We employ a number of technical, organizational and physical safeguards designed to protect the personal information we collect. However, no security measures are failsafe and we cannot guarantee the security of your personal information.

Children

Our services are not intended for use by children under 13 years of age. If we learn that we have collected personal information through our services from a child under 13 without the consent of the child's parent or guardian as required by law, we will delete it.

Other Sites and Services

Our services may contain links to websites and other online services operated by third parties. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites or online services operated by third parties, and we are not responsible for their actions.

Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy. If we make material changes, we will notify affected customers and post the updated policy with a revised "Last Updated" date. Where a customer agreement specifies a notice period for material changes, that period applies.

Your US State Privacy Rights

Depending on where you live, including California, Colorado, Connecticut, Virginia, Texas, Oregon and other US states with comprehensive privacy laws, you may have the right to:

• Know and access the personal information we have collected about you, the categories of sources, the purposes for using it, and the categories of third parties to whom we disclose it.
• Delete personal information we have collected from you, subject to exceptions allowed by law.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information and of targeted advertising, as described in "Your advertising choices."
• Not be discriminated against for exercising these rights.
• Appeal a decision we make about your request, where your state provides this right.

How to submit a request: use the form on our Your Privacy Choices page or email [email protected]. We will verify your identity by matching the information you provide with information we have on file. You may use an authorized agent to submit a request on your behalf with your written permission; we may still ask you to verify your identity directly with us. We will respond within 45 days, or within any longer period allowed by law, and will let you know if we need more time.

If we deny your request, you may appeal by replying to our decision with "Appeal" in the subject line. We will respond to appeals within the time required by your state's law.

Retention: we keep personal information only as long as needed for the purposes described in this policy, including to provide our services, comply with legal obligations, resolve disputes and enforce our agreements. When personal information is no longer needed, we delete or de-identify it.

Contact Us

For privacy questions or requests, contact us at: