arc

Arc Privacy Policy

What Arc processes for merchants and their subscribers, why, who else receives it and how long it is kept.

Last updated: October 14, 2026 Effective date: June 18, 2026

This policy explains how Kinori Labs Inc. ("Kinori Labs", "Arc", "we", "us") handles personal data in the Arc Shopify app and on arcsubscriptions.com. Questions: privacy@arcsubscriptions.com.

1. Who we are and our role

Arc is a subscriptions app that Shopify merchants install on their stores. It is operated by Kinori Labs Inc. No postal address is published; general enquiries go to hello@arcsubscriptions.com.

For shopper and subscriber data, the merchant is the controller and Arc is the processor. We process that data only to provide Arc to the merchant and on the merchant's instructions. If you subscribe through a store that uses Arc, the merchant's own privacy policy governs your relationship with them, and the merchant is your first point of contact. Our Data Processing Agreement sets out the processor terms.

We are the controller for merchant account data and for the details people give us directly, such as the early-access form on our website.

2. What we process and why

Arc stores as little as it can. For names, emails, phone numbers and addresses, Arc keeps a Shopify customer reference and looks the details up from Shopify when it needs them.

  • Contact details and addresses (from Shopify): to send sign-in links, upcoming-charge reminders and failed-payment messages, and to show subscribers their own delivery details.
  • Subscription and order details: plan, frequency, status, prices and billing dates, so subscriptions bill on schedule and subscribers can skip, pause, swap, change or cancel.
  • Payment references: payment details stay with Shopify. Arc holds only the reference Shopify issues and never receives or stores card numbers.
  • Failed-payment details: decline codes and retry outcomes, to recover failed payments.
  • Cancellation and retention data: the reason a subscriber gives (including any text they type), the offer shown and the outcome, to run the cancel flow and help the merchant reduce churn. A churn-risk score helps merchants see which subscribers may leave.
  • Sign-in data: a hashed, single-use sign-in link and a short-lived portal session.
  • Service records: activity and usage records, to run, secure and support the service.
  • Merchant account data: store domain, settings and the access Shopify grants, to install and run the app.
  • Early-access sign-ups (Arc as controller): your email, optionally your store URL, and when you agreed to be contacted, so we can tell you about Arc.

We do not sell personal data, do not share it for cross-context advertising, and do not build advertising profiles.

AI features. Some retention features use an AI provider, for example to sort a typed cancellation reason into a category. Emails, phone numbers and card numbers are removed from typed text before it is sent, and only the content the feature needs is sent. Neither we nor our AI provider use it to train models. Billing never depends on the AI: if it is unavailable, Arc carries on with fixed rules.

Where the GDPR or UK GDPR applies, the merchant is responsible for the lawful basis for processing shopper data. For our own processing we rely on:

  • Contract: to provide the app to merchants and the subscription service to their customers.
  • Legitimate interests: failed-payment recovery, retention features, security and fraud prevention, and improving the service.
  • Legal obligation: to meet legal requirements, including privacy requests.
  • Consent: for the early-access form. You can withdraw it at any time.

4. Who we share data with

We share personal data only with service providers that help us run Arc, and only what each one needs:

  • Shopify, which runs the store, checkout and payments
  • cloud hosting and network providers
  • email delivery providers
  • error monitoring and cookieless product analytics
  • an AI provider, for the AI features described above
  • integrations a merchant chooses to turn on

The current list of sub-processors is in our Data Processing Agreement. Merchants get at least 30 days' notice by email before we add or replace one, and can object. We may also disclose data where the law requires it, or to a successor if our business is sold or merged.

5. International transfers

Some of our providers are in the United States, so data may be processed outside your country. For data from the EEA, UK or Switzerland we use the EU Standard Contractual Clauses with the UK and Swiss addenda, or rely on an adequacy decision.

6. Security

We protect data with encryption in transit, encryption at rest for sensitive values such as access tokens and credentials, access controls limited to the staff who need it, and strict separation between each merchant's data. Payment details stay with Shopify. No system is completely secure, and we hold no third-party security certification. If a breach affects shopper data, we tell the affected merchant without undue delay and within 72 hours. Report security issues to security@arcsubscriptions.com.

7. Retention

We keep data only as long as we need it to run the service or meet legal obligations:

  • Subscription data is kept while the merchant uses Arc.
  • When a merchant uninstalls, their store data is deleted after Shopify sends its store-deletion request, about 48 hours later. Remaining operational data is purged within 90 days.
  • A customer deletion request is completed within 30 days.
  • Cancellation feedback, churn scores and billing history are kept for up to 24 months; service records for up to 12 months.
  • Early-access sign-ups are deleted on request or after 24 months of inactivity.
  • Backups rotate out within 90 days, so deleted data leaves our backups by then.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, to restrict or object to processing, to withdraw consent, and to complain to a data protection authority. California residents have the right to know, delete and correct their personal information and not to be discriminated against for using these rights.

Subscribers: please ask the merchant first. Merchants pass access and deletion requests to us through Shopify's privacy requests, which Arc carries out automatically. Everyone else: email privacy@arcsubscriptions.com. We respond within the time the law requires.

Arc supports Shopify's mandatory privacy webhooks: customer data requests, customer deletion and store deletion.

9. Cookies

Our marketing site sets no cookies and loads no third-party analytics. The customer portal uses one strictly necessary session cookie to keep subscribers signed in. The embedded merchant admin uses Shopify's sign-in. Arc's own app pages use cookieless, anonymous analytics. We use no advertising trackers.

10. Children

Arc is a business tool and is not directed to anyone under 16. If you believe a child's data has reached us, contact us and we will delete it.

11. Contact

We have not appointed a Data Protection Officer, as the GDPR does not require one for us. We have not yet appointed an EU or UK representative and will do so before processing data for merchants established there.

12. Changes and governing law

We will post changes here with a new "Last updated" date and give merchants at least 30 days' email notice of material changes. This policy is governed by the laws of Ontario, Canada, without affecting any data-protection rights you have where you live.