Privacy policy

Last updated: 21 May 2026.

Arkhety is a personal MVP (minimum viable product) run by Aleix Alcácer Sales as an individual, not as a registered company. This page explains what data is involved when you use it, and what we do — and don't do — with it. Written to comply with the EU General Data Protection Regulation (Regulation 2016/679, "GDPR").

1. Who we are

Data controller: Aleix Alcácer Sales, acting as a natural person, based in Spain. Contact: aleixalcacer@gmail.com.

2. What we collect

• CSV you upload — processed in memory during your Streamlit session and discarded when the session ends. Not written to disk, not stored in any database, not shared.
• Archetype coordinates and column names — sent to OpenAI's API to generate the plain-language descriptions. No raw rows, no identifiers leave your browser.
• Dataset-context text — only if you choose to type it. Sent to OpenAI together with the coordinates. Do not put personal data here.
• Payment data — when you buy an analysis (€9), payment is handled entirely by Stripe. We receive only confirmation that the payment succeeded and, optionally, your email if you provide one for the receipt. We never see your card details.
• Researcher profile — before running an analysis, you are invited to share your research area, role and a brief description of your dataset. This is anonymous (no name or email is collected). We also store a one-way SHA-256 hash of your IP address (not the address itself — irreversible), the version of the terms you accepted, and a timestamp. This data is stored in a private Google Sheet accessible only to Arkhety and is used solely to understand who uses the tool and improve it. Legal basis: legitimate interest.
• Technical logs — the platforms that host the landing (Vercel) and the app (Streamlit Community Cloud) keep standard HTTP logs (IP address, browser, timestamp) for security and reliability. These are not under our direct control.

3. What we do NOT do

• We do not store the contents of your CSV anywhere.
• We do not accept personal data — files containing names, emails, phone numbers or national IDs are detected and blocked automatically.
• We do not run analytics, ad pixels or any kind of cross-site tracking.
• We do not sell or share your data with anyone outside the subprocessors listed below.

4. Cookies

Arkhety uses only the functional session cookies that Streamlit needs to keep your session alive while you use the app. There are no analytics or advertising cookies. Under EU ePrivacy rules, strictly necessary cookies do not require consent.

5. Legal basis (GDPR Art. 6)

• Free demo: legitimate interest in providing a service you have requested.
• Paid analysis (€9): performance of a contract.
• Hosting logs: legitimate interest in security and reliability of the service.

6. Subprocessors

Arkhety relies on the following third-party services, each with its own privacy policy:

• Streamlit Community Cloud (Snowflake Inc.) — hosts the app — snowflake.com/privacy-policy
• Vercel — hosts this landing — vercel.com/legal/privacy-policy
• Stripe — processes payments — stripe.com/privacy
• OpenAI — generates the archetype descriptions — openai.com/policies/privacy-policy
• Google Fonts — serves the typeface (receives your IP when the page loads) — policies.google.com/privacy

7. International transfers

Some subprocessors (Stripe, OpenAI, Snowflake, Google, Vercel) process data outside the European Economic Area, mainly in the United States. These transfers rely on the European Commission's Standard Contractual Clauses (SCCs) or equivalent safeguards published by each provider.

8. Retention

Because Arkhety does not store your CSV or analysis results, there is nothing to retain on our side. Payment records held by Stripe follow Stripe's own retention policies. Hosting logs are retained by the platform providers under their own schedules.

9. Your rights

Under GDPR you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and the right to data portability. For data we hold (essentially: nothing about your CSV), write to aleixalcacer@gmail.com and we will respond within 30 days. To exercise rights over data held by Stripe, OpenAI or the hosting providers, please use the contact channels in their own privacy policies.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or your local supervisory authority.

10. Changes to this policy

This policy may be updated as the service evolves. The most recent version will always be available at this URL, with the "Last updated" date at the top.