Privacy policy.
What personal data ARK Services collects, why, who sees it, how long we keep it and what you can do about it.
Who we are
ARK Services (“ARK”, “we”) builds dashboards, automations, online systems, apps and ARKbot for businesses. ARK Services is a trading name and is not yet a registered company; the details below will be completed when that is done. We are the “controller” of the personal data described in this policy, except where section “ARKbot and customer data” says we act as a “processor” for a customer.
| DETAIL | VALUE |
|---|---|
| Name | ARK Services |
| Legal form | [to be confirmed] |
| Registered number | [to be confirmed] |
| Registered address | [to be confirmed] |
| Email for privacy requests | [to be confirmed] |
| Phone | [to be confirmed] |
| ICO registration number | [to be confirmed] |
| Website | www.arkservices.app |
This policy covers the website at www.arkservices.app, the client portal at /portal and the ARKbot website and installers. It follows the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
In short
- We do not sell personal data and we do not use it for advertising.
- The website sets no tracking cookies. Basic page counts carry no identifier. If you accept analytics we also count clicks, using a visitor id that changes every day and cannot follow you from one day to the next.
- If you send an enquiry we keep what you wrote and reply to it.
- Portal accounts hold your name, email and a scrambled form of your password, and record sign-ins and what is done, so that your data stays yours and we can show who did what.
- ARKbot runs on your own computers. The work and files your AI employees handle are your data; we process them for you, and the AI model providers named below process what a task sends them.
- You can ask to see, correct, delete or take away your data, and you can complain to the Information Commissioner’s Office.
What we collect, why, and our lawful basis
UK GDPR needs a lawful basis for each use of personal data. This table lists every use we make of data about you as a visitor, enquirer or portal user.
| WHEN | WHAT | WHY | LAWFUL BASIS | HOW LONG |
|---|---|---|---|---|
| You open a page | Page address (no query string), the website you came from (host name only), screen width band, browser language, the date. No IP address or browser details are stored and no identifier is attached. | To see which pages are used and fix what is not working. | Legitimate interests (Article 6(1)(f)): a small, expected, low-impact count that carries no personal data. You can switch it off with Do Not Track or Global Privacy Control. | 400 days |
| You accept analytics in the cookie banner | The above, plus a visitor id and the buttons and links you click (for example “Start a project”). The id is the first part of a one-way hash of your IP address and browser details mixed with a random value that changes and is destroyed every day, so it counts unique visitors for one day only. The hash inputs are not stored. | To learn which parts of the site help people, and improve them. | Your consent (Article 6(1)(a)). You can withdraw it at any time with “Cookie settings” in the footer. | 400 days |
| You send an enquiry (“Start a project”, contact form) | Name, email, company, what you need, your message, the time, your IP address (to limit spam) and your country (from Cloudflare). We also count, without any identifier, how many forms are sent, saved or blocked as spam. | To reply to you, discuss a project and keep a record of the conversation; to block spam. | Legitimate interests in answering business enquiries, and taking steps at your request before a contract (Article 6(1)(b)). | [to be confirmed] |
| You have a portal account | Name, email, a salted one-way hash of your password (we cannot read it), which clients you can open and your role, when you last signed in. While you are signed in: a session record with your IP address and browser name (up to 200 characters) for up to 14 days. | To give you secure access to your systems, invoices and projects. | Performing our contract with your employer or the business that asked us to set up your account (Article 6(1)(b), or legitimate interests where you are not the contracting party). | While the account is active; sessions 14 days |
| You use the portal | A log of sign-ins, launches of platforms, project requests, changes to the team and when ARK staff open a customer’s portal to help (read only). Your email is in the log. | Security, accountability and support. | Legitimate interests in running a secure service and being able to show who did what. | [to be confirmed] |
| You open a platform or ARKbot from the portal | A signed token, valid for 60 seconds, with your account id, name and email, so you do not sign in twice. | Single sign-in. | Performing our contract; legitimate interests. | Not stored; it expires after 60 seconds. |
| Your business is our customer | Contact names, billing email, invoices and payments for the business. | To invoice, collect payment and keep accounts. | Contract; legal obligation (tax and company records). | At least as long as tax law requires, usually six years. |
| You email or phone us | Your message and contact details. Enquiries sent through the form are also delivered to our own mailbox by Cloudflare Email Routing. | To reply. | Legitimate interests; contract. | [to be confirmed] |
Cloudflare, which hosts and delivers this site, necessarily sees the IP address and browser details of every request in order to deliver pages and protect the site. That is part of the hosting service, not a separate use by us. Your browser also fetches fonts from Google Fonts and some pictures from Unsplash, which see your IP address.
We do not make decisions about you by automated means that have legal or similarly significant effects.
ARKbot and customer data
ARKbot is software that runs AI employees on a customer’s own computers. It is in early access (alpha). Two different kinds of data are involved:
- Account data (who can sign in to ARKbot, their role, device registrations and usage and cost records): we are the controller, for the reasons in the table above.
- Work data (the tasks you give, the websites, files, screens and documents your AI employees see, their step logs and results, and anything in them about your own staff, customers or suppliers): the customer is the controller and we are a processor. We process it only to run ARKbot for the customer, on the customer’s documented instructions, and we will not use it for our own purposes. The customer is responsible for having a lawful basis to give us that data and for telling the people it concerns. Terms for business customers, including the processing terms under Article 28 UK GDPR, are [to be confirmed].
To do a task, ARKbot sends the relevant text and images to an AI model. Today that can be Anthropic (Claude models), directly or through OpenRouter, and models run by Cloudflare (Workers AI). Which one is used depends on the customer’s ARKbot settings and the task. Model providers receive only what the task sends them; see their own terms for how they treat it. We do not use customer work data to train models. Each provider’s own terms say how it treats what it receives.
Because ARKbot uses your browser sessions and apps on your own computer, it can see whatever is on screen in them. It asks before anything important and stays inside the budget you set. Do not give an AI employee access to data you are not allowed to process. Installers are not yet code-signed.
Who we share it with
We use these processors (services that handle data for us under contract) and recipients. We share data with no one else unless the law requires it (for example a court or tax authority) or you ask us to. Professional advisers such as our accountants and lawyers may see data they need to advise us, under duties of confidentiality.
| WHO | WHAT THEY DO | WHERE |
|---|---|---|
| Cloudflare, Inc. | Hosting and network for this website and the portal; the databases (D1); email routing that delivers enquiries to ARK’s inbox; and, for some ARKbot tasks, its AI inference service (Workers AI). | Global network; the United States and other countries |
| Anthropic PBC | AI model provider for ARKbot (Claude models). Receives the text and images an ARKbot task sends to a model. | United States |
| OpenRouter, Inc. | Routes ARKbot model requests to the model provider chosen for a task. It is used only if a customer’s ARKbot settings allow it. [to be confirmed] | United States |
| Google Fonts (Google LLC) and Unsplash | Your browser fetches fonts from Google and some pictures from Unsplash when you open pages of this site. They see your IP address and browser details. | United States and other countries |
Transfers outside the UK
Several of the services above process data in the United States and other countries outside the UK. When data goes to a country without a UK adequacy decision, we rely on a safeguard under Chapter V of the UK GDPR: the UK Extension to the EU–US Data Privacy Framework where the recipient is certified, or otherwise the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses in the provider’s terms. The safeguard used for each provider is [to be confirmed]. You can ask us for a copy of the relevant terms.
How long we keep data
- Analytics page counts and interaction events: 400 days, then deleted automatically. The random value behind visitor ids is deleted every day.
- Portal sessions: up to 14 days after you last used them, or until you sign out.
- Enquiries: [to be confirmed].
- Portal accounts: until the business asks us to remove you or the contract ends. Removing someone from every client disables the account.
- Portal activity log: [to be confirmed].
- Invoices and accounting records: as long as tax law requires, usually six years.
- ARKbot work data: as set by the customer in ARKbot, and deleted or returned when the contract ends.
Your rights
You have the right to:
- be told how your data is used (this policy);
- access the personal data we hold about you and get a copy;
- have wrong data corrected, and incomplete data completed;
- have your data erased, in some cases;
- restrict how we use it, in some cases;
- receive the data you gave us in a common format and have it sent to someone else (portability), where we use it because of a contract or your consent;
- object to uses based on legitimate interests, and to direct marketing at any time (we do not run marketing email lists from this site);
- withdraw consent at any time, without affecting what was done before (use “Cookie settings” in the footer for analytics).
To use a right, email [to be confirmed] or write to us at the address above. We may need to check who you are. We reply within one month and do not charge, unless a request is clearly unfounded or excessive. If your data is ARKbot work data held for a customer, we will pass your request to that customer, who decides.
Complaints
Please tell us first so we can put things right. You can also complain to the UK data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk/make-a-complaint. ICO registration number: [to be confirmed].
Security
- The website and portal are served only over HTTPS.
- Portal passwords are stored as salted PBKDF2 hashes. Sign-in cookies are HttpOnly, Secure and SameSite=Strict. Repeated wrong passwords lock the account for a while.
- Every portal request is limited to the clients your account may open. ARK staff can open a customer’s portal only in a read-only view, and each time is written to the activity log.
- Secrets such as API tokens are stored encrypted or as platform secrets, never in the website pages.
No system is perfectly secure. If a breach puts your rights at risk we will tell the ICO within 72 hours where the law requires, and tell you without undue delay where the law requires that too.
Children
Our services are for businesses and are not aimed at anyone under 18. We do not knowingly collect personal data from children. If you think a child has sent us data, tell us and we will delete it.
Changes to this policy
We will change this policy when what we do changes. The date at the top shows the current version. If a change matters to you (for example a new use of data that needs your consent) we will tell you in the portal or on this site. Cookies and similar technologies are explained in the cookie policy. Use of the site is covered by the terms of use.