Privacy

Introduction

This policy describes the data we collect and how we handle it when you visit arclight.vn and when you use the ArcCode BETA operated by ArcLight. ArcCode is currently in BETA, with access granted by invitation. We handle personal data in line with Vietnam's Decree 13/2023/ND-CP on personal data protection.

ArcCode can also be self-hosted. For self-hosted deployments, the party running the instance is the controller of their own data; this policy applies to the instance operated by ArcLight at arclight.vn.

Data we collect

• When you contact us: your email (required), plus your name, company, and message if you provide them.
• When you are invited and sign in to the BETA: account information (email, password) for the account created from your invite link.
• When you use the service: your conversations with the agent, the files in your workspace, your Git credentials, your attachments, and your provider/MCP/skills/plugins configuration. Each user has an isolated workspace.

We do not use third-party advertising to track you.

How we use data

• To operate, maintain, and improve the service; authenticate and grant access; respond to your requests; and keep the system secure.
• To use the email you leave us to reply and to discuss inviting you to the BETA. We do not send spam.
• When you run the agent, prompt content and files are sent to the model provider you configure (OpenAI through the ChatGPT account you link, or a provider you add with your own base URL/API key). Their processing is governed by that provider's terms.

We do not sell your personal data.

Storage & security

For the instance operated by ArcLight, data resides on our infrastructure. PostgreSQL stores accounts, invites, settings, Git credentials (sealed with AES-256-GCM before storage), MCP server configs, skill and plugin settings, session metadata, and attachment references. Conversation history is owned by Codex and stored in each user's own CODEX_HOME on the server's disk, not in PostgreSQL. Secrets are never returned to the browser or written to logs. Access is granted by invitation; each user has an isolated workspace, CODEX_HOME, and configuration.

Deleted projects go to trash and can be restored. When an account is deleted, a durable purge job removes its credentials, settings, session metadata, attachments, and the account's directories on the server. For self-hosted deployments, data resides on infrastructure controlled by the party running the instance.

Your rights

You may request access to, correction of, or deletion of the data associated with your account at any time. To exercise these rights, contactplatform@arclight.vn.

Contact

For any privacy questions, please contactplatform@arclight.vn.