This Privacy Policy explains what personal data Arche (https://arche.niamori.ai) collects, how we use and store it, who we share it with, and the rights you have. It is part of our Terms of Service.
01Who We Are
Arche is operated by Liu Guangkai, the data controller for the personal data described in this Policy. Contact us about privacy at support@niamori.ai. We have not appointed a Data Protection Officer because we do not process data at a scale that requires one.
02Information We Collect
Information you give us:
- Account information: your name, email address, and password. We store only a salted hash of the password.
- Images: the files you upload, their file names, sizes, and formats, and the optimized results.
- Messages: emails you send to support@niamori.ai.
- Feedback: what you write on the feedback page, the page you came from, and, only if you give it, an email address for our reply. Feedback is not linked to your account.
Information collected automatically:
- Session data: when you sign in, the IP address and browser user agent of that session, so you can recognize and revoke it.
- Service records: the batches you create, their status, image counts and sizes, and plan limits.
- Technical logs: request time, path, status, and error details. We do not write email addresses, file names, or image contents to logs.
- Abuse protection: counters keyed by your IP address for sign-in, sign-up, password reset, and similar actions, and by a one-way hash of the email address you enter when we send verification or password-reset emails, so that we can limit repeated attempts. They are kept for up to 24 hours.
- Security checks: uploads without Pro, and feedback, pass Cloudflare Turnstile, which evaluates browser signals to tell people from bots.
- Visit statistics: Cloudflare Web Analytics counts page views and visits by page, referring site, country, browser, and device type. It does not use cookies or local storage and does not follow you across sites.
- Usage counts: when you start an optimization, reach a Free-plan limit, open the pricing page, or click Get Pro, your browser tells us that this step happened. We store only the step, the page you arrived on (its path, without the query string) and the time, with no cookie, IP address, or other identifier, so the counts cannot be linked to you. Your IP address is used only to rate-limit these reports for one minute.
Payment information: purchases are made through Waffo Pancake, our Merchant of Record. We receive the order, payment, subscription, and refund identifiers, amounts, currencies, and statuses. We never receive or store your card number.
03How We Use Information
| Purpose | Legal basis |
|---|---|
| Optimizing your images and delivering the results | Contract |
| Creating and securing your account | Contract |
| Granting Pro access and handling billing, cancellations, and refunds | Contract |
| Sending service emails: verification, password reset, payment, cancellation, and refund notices | Contract and legitimate interests |
| Preventing abuse, fraud, and automated misuse | Legitimate interests |
| Diagnosing errors and keeping the Service reliable | Legitimate interests |
| Reading your feedback and replying to it | Legitimate interests |
| Counting visits to learn which pages people use | Legitimate interests |
| Counting how many visits reach each step, from optimizing to Get Pro | Legitimate interests |
| Keeping payment records required by law | Legal obligation |
04Cookies and Local Storage
We use only what the Service needs to work. We do not use analytics, advertising, or tracking cookies; visit statistics are counted without cookies.
| Item | Purpose |
|---|---|
| Session cookie (strictly necessary) | Keeps you signed in. |
| ARCHE_LOCALE cookie (functional) | Remembers your language. |
| Session storage (strictly necessary) | Lets you reopen an anonymous batch after refreshing the page; it is cleared when you close the tab. |
| Local storage (functional) | If you create an account from a page such as Pricing, remembers that page until you open the verification link in the same browser, so you can continue where you left off; it is removed then. It holds no personal data. |
05Arche for Chrome
If you install the Arche extension for Chrome, it reads the image you right-click, or, when you choose to save all images on a page, the images on that page. It converts them inside your browser and saves them through Chrome downloads; the images are never sent to us.
- To check whether you have Arche Pro, the extension asks arche.niamori.ai for your plan, sending the session cookie you already have from signing in to Arche. We use this only to answer that question.
- It keeps your extension settings, the last error message, and a step waiting for your permission in Chrome storage on your device; if Chrome sync is on, Chrome syncs the settings to your Google account. None of this is sent to us.
- Access to other websites is optional. If you allow it, the extension uses it only to download an image you chose that is hosted on another domain. You can turn it off in Chrome at any time.
06Sharing and Service Providers
We do not sell or rent your personal information, and we do not share it for advertising. We share it only with providers that run the Service for us, under their terms and privacy commitments:
- Cloudflare — hosting, database, file storage, image processing, Turnstile, Web Analytics, usage counts, and email routing (privacy policy).
- Resend — sending service emails (privacy policy).
- Google (Gmail) — receiving the emails you send to our support address (privacy policy).
- Waffo Pancake (Waffo.com Limited) — checkout, payment processing, taxes, receipts, and refunds. As Merchant of Record it acts as an independent controller for the payment data it collects (waffo.ai).
We may also disclose information when required by law or a valid legal request, to protect the rights and safety of users and the Service, or as part of a business transfer with notice to you.
07Retention
| Data | How long we keep it |
|---|---|
| Uploaded images and results | Deleted automatically within 48 hours, or immediately when you delete the batch. |
| Image file names | Deleted together with the images. |
| Batch records without file names (counts, sizes, status) | Kept for service limits and reliability; no longer linked to your account after you delete it. |
| Account information and sessions | Until you delete your account. |
| Payment and subscription records | As long as tax and accounting law requires. |
| Feedback | Up to 12 months. |
| Abuse-protection counters (IP address, one-way hash of email address) | Up to 24 hours. |
| Technical logs | Up to 30 days. |
| Usage counts (no identifiers) | Up to 3 months. |
| Database backups | Point-in-time backups expire after 30 days. |
08Security
Traffic is encrypted with TLS. Passwords are stored as salted hashes. Uploaded images are kept in private storage and are reachable only with your account session or the unguessable access key of an anonymous batch, and our image processor reads them through short-lived signed links. Access to production systems is limited to the operator. If a breach affects your personal data, we will notify you and the relevant authorities as required by law, within 72 hours where applicable.
09Your Rights
Depending on where you live, you have the right to access, correct, delete, or receive a portable copy of your personal data, to restrict or object to its processing, and to withdraw consent. You can:
- update your name and password in Account settings;
- delete your account in Account settings;
- delete any batch and its images at any time;
- email support@niamori.ai for any other request. We answer within 30 days.
You may also complain to the data protection authority in your country.
10International Transfers
Our providers process data in data centers around the world, including the United States. Where data leaves your country, we rely on our providers' safeguards, such as the EU Standard Contractual Clauses.
11Children
The Service is not directed at children. Accounts and subscriptions require you to be at least 18, or the age of majority where you live. If you believe a child has given us personal data, contact us and we will delete it.
12Changes to This Policy
We will update the date at the top of this Policy when it changes and email account holders at least 14 days before a material change takes effect.
13Contact
Email support@niamori.ai with any question about this Policy or your data.