This policy applies to everyone who uses Arcline: people who visit this website, and website owners who create an account and use the service. It is effective 12 November 2026 and was last updated 12 November 2026.
It is written to meet the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, which are being brought into force in phases. We follow their principles now and are preparing for the full obligations as they commence. It is also our privacy policy under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”), for as long as those provisions apply.
Who we are and what this policy covers
Arcline (“we”, “us”, “our”) is an autonomous SEO and AI-answer visibility assistant for website owners. It is run by Preet Patel from Ahmedabad, Gujarat, India, and was founded by Preet Patel.
A few words are used in a specific way in this policy:
- Personal data means any data about an individual who can be identified from it, such as your e-mail address.
- Data Principal means the person the data is about. For your account, that is you.
- Data Fiduciary means the party that decides why and how personal data is processed. For your account data, that is us.
- The service means this website, the Arcline app and the programs behind it.
- Connection secret means a token, key or password you give us so that the service can work with your website or another tool.
Questions about this policy can be sent to thescalelab10@gmail.com. Formal complaints go to our Grievance Officer: see Grievance Redressal and Your Data Rights.
The information we collect
The table below lists everything we keep, why we keep it and for how long. Most of it comes from you or from your own public website. We do not collect anything we do not need to run the service.
| What | Details | Why we need it | How long we keep it |
|---|---|---|---|
| Account details | Your e-mail address and a one-way hash of your password. We never store the password itself. | To create and secure your account, sign you in and contact you about the service. | Until your account is deleted. |
| Sign-in token | A signed token kept in your browser's local storage, valid for about 12 hours. It is not a cookie. | To keep you signed in. | In your browser until it expires or you sign out. |
| Websites you add | The website address, a random ownership-proof token, whether and how ownership was proved, the platform we detected (for example WordPress), and the access level you chose. | To prove you own the site, run the service and respect the access level you set. | Until you remove the website. |
| Public pages we read | For each public page: its address, status, title, description, headings, links, image descriptions, structured data, visible text (up to a size limit) and technical signals such as speed and whether it can be indexed. Also the robots.txt file and the sitemap. | To score the site, find problems and prepare recommendations. | Until you remove the website. Older scan details are trimmed automatically as newer scans arrive. |
| Results we produce | Scores, recommendations, keyword and competitor research, notes on what your site is about, performance results, alerts, and AI-answer visibility observations (what an AI assistant answered and which sources it cited). | To show you what to do and how you are progressing. | Until you remove the website. |
| Things you add | Competitor website addresses, search phrases, AI-visibility questions, instructions for drafts, a backlink list or server log file you upload for analysis. | To tailor the results to you. | Until you remove the website. We keep what we derive from an uploaded log file (counts and events), not the file itself. |
| Content drafts | Articles, FAQ pages and landing pages drafted by the service or edited by you, and their status. | To prepare content for you to review and publish. | Until you remove the website. |
| Changes and snapshots | Every change proposed or made: what, why, who approved it, before-and-after copies of the affected page content, the result of the live check and any undo. | To let you review changes, verify them live and undo them. | Until you remove the website. |
| Connection secrets | The token or password you give us for GitHub, WordPress or Ghost, and for the optional Cloudflare connection. Saved encrypted. Basic details of the connection (repository name, branch, account name) are kept in readable form so we can show them to you. | To read and, within your access level, change your website. | Until you disconnect (the secret is erased at once) or remove the website. |
| Visitor tracker data (optional) | Page views and crawler visits on a website where you installed the tracker. See the section on the visitor tracker below. | To show you where visitors and AI crawlers come from. | Until you remove the website. |
| Activity log | A record of important actions with the time and outcome: sign-up, sign-ins and failed attempts, website added or removed, connections made or removed, access level changes, and each step of every change. It does not contain IP addresses. | Security, accountability, and showing you what happened. | For the life of the account. It is not wiped when a website is removed, so a record remains that it was removed. |
| AI usage records | For each AI request: the kind of task, the AI model used, token counts, an estimated cost and whether it succeeded. Not the text itself. | To apply fair daily and monthly limits and fix problems. | For the life of the account. |
| Technical and security data | A short request reference, the first characters of your account reference, the route requested, the response status and timing. Temporary counters of failed sign-ins per network address and e-mail address, to slow down password guessing. Our hosting providers keep their own network logs, which include IP addresses and browser details. | To run the service, fix faults and prevent abuse. | Counters reset automatically. Host logs are kept for the periods our hosting providers set, and longer only where the law requires. |
| Messages you send us | E-mails to our support or grievance addresses, with what you choose to include, and our replies. | To help you and keep a record of how we resolved it. | As long as needed to deal with it, then for a reasonable period as a record. |
| Plan and billing status | Your plan, whether your subscription is active, cancelled or has a failed payment, the billing period and renewal date, the number of extra websites, and a customer ID that Polar gives us. Your name, billing details and payment details go to Polar at checkout and never reach us. We never receive card numbers. | To give you the plan you pay for and keep the records that tax and accounting law requires. | While you have an account, and as long as tax and accounting law requires for billing records. |
| Usage counters | How much of the allowances of your plan you have used in the current month, such as fixes applied to your website, AI checks and article drafts, and whether the one-time AI snapshot has been used for a website address. | To apply the limits of your plan and show you how much is left. | For the life of the account. |
Of everything in the table, the only item that counts as “sensitive personal data” under the SPDI Rules is your password, and we keep it only as a one-way hash. You can withdraw your consent to our holding it at any time by asking us to delete your account, although we then cannot provide the service to you.
What we read from your website
When you add a website, we first ask you to prove that you own it, by adding a DNS record, a small file, or a meta tag that contains a random token we generate. We scan a website only after it is proved.
The scan fetches your public pages the way a search engine or an AI crawler would. Our crawler introduces itself as ArclineBot, follows your robots.txt rules, and is limited in speed and in the number of pages it reads. We refuse to fetch private or internal network addresses.
Public pages can contain personal data of other people, for example staff names, reviews or contact details. We process that text only to analyse the page. We do not build profiles of those people and we do not use the text for any other purpose. You are responsible for having the right to publish that information on your website.
If you connect a GitHub repository, a WordPress site or a Ghost site, the service also reads the page files, pages and posts it needs through that connection, and nothing more. See the next section.
Connection secrets: the tokens and passwords you give us
To make changes for you, Arcline needs a way into your website. Depending on how your site is built, you give us a GitHub fine-grained access token for one repository, a WordPress Application Password (not your main WordPress password), or a Ghost Admin API key. If you use the optional Cloudflare connection, you give us a Cloudflare token that can read analytics.
- Encrypted at rest. Before anything is saved, the secret is encrypted with a key that is kept in our application host's settings, separate from the database.
- Never shown again. After you save a connection, the screen shows that a secret exists, never the secret itself. Our programs decrypt it only in memory, for the moment a task needs it.
- Yours to delete. Disconnect at any time in Settings and the stored secret is erased at once. Removing the website erases it too. You should also revoke the token in GitHub, WordPress, Ghost or Cloudflare, because only you can do that on their side.
- You choose how much power it has. You set the access level, from no access to full care (see the Terms of Service). Whatever a token technically allows, the service acts only within the level you set.
- Least privilege. We recommend a token limited to one repository with only the Contents and Pull requests permissions.
The optional visitor tracker
Website owners can add a small script to their own website, send server reports, upload log files or connect Cloudflare, so that Arcline can show which visitors arrive from search, AI assistants and other sources, and which AI crawlers read their pages. It is optional and does nothing until you install it.
This is what the tracker records:
| What | Details |
|---|---|
| Page | The path of the page viewed, without any query string, and the page title. |
| Where the visit came from | The address of the referring page, its host, search words if they appear in that address, and campaign tags (UTM) in the address. We classify it as search, AI assistant, social, direct and so on. |
| Device | A rough class (phone, tablet or desktop), worked out from the browser type and screen width. |
| Time | When the page was viewed. |
| Pseudonymous visitor code | A short code computed from the visitor's IP address and browser details, mixed with a secret that changes every day. The IP address itself is not stored. Because the secret changes daily, a code from one day cannot be matched with a code from another day. We do not use the code to identify anyone. |
| Crawler visits | If a visit comes from a known bot, such as an AI crawler, we store the bot's name, its user-agent text, the page and the response status, instead of a visitor record. |
- No cookies and no local storage. Nothing is written to the visitor's device by the tracker.
- Do Not Track and Global Privacy Control are honoured. If the visitor's browser sends either signal, the script does nothing and we store nothing.
- Only your own pages. The tracker accepts page views only for the website it belongs to, and rejects anything else.
- No mixing and no advertising. We never combine this data across websites or accounts, and never use it for advertising.
There are other ways to feed the same reports. A server snippet can report bot visits using a secret key. If you upload an access log file, we take the IP address from each line, turn it into the same daily code and discard it, and we do not keep the file. If you connect Cloudflare, we read hourly counts of AI crawler requests with your read-only token.
Your role as the website owner. The visitors of your website are your visitors. You decide whether to install the tracker, and you must tell your visitors about it in your own privacy notice and meet the legal requirements that apply to your website, including the Digital Personal Data Protection Act, 2023. We process this data only on your behalf, in order to show it to you. If you remove the website, the tracker key is deleted with everything collected for it, and any old script left on your pages stops being accepted.
How we use your information, and on what basis
We use personal data only for the purposes below, and only as far as each needs. We ask for your consent when you create an account and when you connect a website. Some uses are allowed without consent as “certain legitimate uses” under the Digital Personal Data Protection Act, 2023, for example complying with the law or protecting the service from abuse.
- To provide the service: scan your website, score it, recommend fixes, draft content, and make, verify and undo approved changes.
- To keep accounts and websites secure: sign-in checks, login throttling and the activity log.
- To communicate with you: sign-in help, service and security notices, changes to our terms and replies to your messages. We do not send marketing e-mail unless you ask for it.
- To give you your plan and bill you: send you to Polar's checkout when you buy Premium, learn from Polar whether your subscription is active, apply the limits of your plan and keep the records the law requires.
- To fix problems and improve the service: look at error logs and usage counts. Our people look at the content of your account only when you ask for help, when it is needed to keep the service secure, or when the law requires.
- To meet legal duties: respond to lawful orders and meet obligations under laws such as tax law and the CERT-In Directions.
If we ever want to use your data for a new purpose, we will tell you and, where the law requires, ask for your consent first.
How the AI features use your information
Some features use a third-party AI model to write suggestions (titles, descriptions, headings, FAQ answers, drafts), to work out what a website is about, and to check how AI assistants answer questions about your business. This is what is sent:
| Feature | What is sent to the AI provider | Why |
|---|---|---|
| Suggestions for titles, descriptions and headings | The page address, the current title and headings, an excerpt of the page text (a few thousand characters at most), the website's brand name, and a few existing titles from other pages so we avoid duplicates. | To write a better version for that page. |
| Understanding what your site is about | Short notes built from your page titles and descriptions. | To pick the topics people would search for. |
| FAQ, landing page and article drafts | The brand name, the question or search phrase, and facts we found on your pages. | To draft content for you to review. |
| AI-answer visibility checks | Questions such as “What is your business?” or “best product in your city”, which may name your business and the competitors you added. | To observe how AI assistants answer, and whether they mention you. |
The provider we use today is Google, through its Gemini API, with a primary model and a backup model. If we add or change an AI provider, we will update this policy and the list of providers first.
- We send only the text needed for the task. We do not send your account e-mail address, password or connection secrets.
- We tell the model to treat website text as untrusted data, we check what comes back, and we never run it as code.
- We do not train AI models on your data.
- The provider handles the text under its own terms and privacy policy, which we do not control. Depending on the terms that apply to our account with it, the provider may keep the text for a limited time and may use it to improve its own services. Please do not type secrets or other people's personal data into free-text boxes in the app.
- We log, for each account, the kind of task, the model, token counts, estimated cost and outcome of each AI request, so that we can apply fair daily and monthly limits. The log does not contain your text.
Payments and Polar
If you buy Premium, you pay through Polar (polar.sh), which is both our payment provider and the merchant of record. This is what that means for your personal data:
- What Polar receives. At checkout, Polar receives your name, e-mail address, billing country or address and payment details, so that it can take your payment, work out and collect any sales tax or VAT, send your receipt and handle refunds.
- What we receive. We receive your subscription status (for example active, cancelled or payment failed), your plan, the billing period and a customer ID. We never receive your card number or other payment details.
- Polar's own role. As merchant of record, Polar collects this information itself and handles it under its own terms and privacy policy, which we do not control. You can read them on Polar's website.
- The customer portal. You manage or cancel your subscription in Polar's customer portal, which is on a polar.sh address. The Cookie and Local Storage Policy says what that page may store.
- Consent. You choose to buy Premium and to give your details to Polar. If you never buy Premium, none of your details reaches Polar.
We keep only what we need to give you your plan, as the table of information above shows.
Who we share information with
We share personal data only with the service providers below, who help us run the service, and only as far as needed. We do not sell it. Where a provider acts on our behalf, we rely on its terms and security commitments, and we give it only what it needs.
| Provider (category) | What it does for us | Information involved |
|---|---|---|
| Static-site host (our website and app) | Serves the pages and the app you see. | Your IP address and browser details in its connection logs. |
| Application host (our API) | Runs the service's servers and background work. | Everything the service processes while it runs, including account and website data in memory, and connection logs with IP addresses. |
| Managed database service | Stores the service's data. | The stored data described in this policy. Connection secrets are encrypted by us before they are saved. |
| GitHub (API), only when you connect a repository | Lets the service read page files and create branches, pull requests and merges. | The repository's page files and the changes we make. Your token is sent to GitHub only to authenticate. |
| Your own website platform (WordPress, Ghost) | Not our provider: the service calls your site's own interface using the credentials you gave. | The pages and posts it reads or changes. |
| Google (Gemini API), AI model provider | Writes suggestions and drafts, and answers the questions in AI-visibility checks. | The text described in the AI section above. |
| Google PageSpeed Insights | Measures how fast your pages load. | The addresses of your public pages. |
| Public search and research sources (Google, Bing, DuckDuckGo and Brave suggestions, Wikipedia, Google Trends; and, if we switch them on, Brave Search and OpenPageRank) | Show what people search for, find similar sites and estimate domain strength. | Search phrases drawn from your site's topics and, for the optional services, website addresses. Not your account data. |
| Cloudflare, only if you connect it | Reports counts of AI crawler requests to your site. | Your zone ID and your read-only token, used to ask Cloudflare for counts. |
| Google Fonts | Delivers the typefaces on our website and app. | Your browser asks Google's servers directly, so Google sees your IP address and browser details. |
| Polar (polar.sh), payment provider and merchant of record, only when you buy Premium | Takes your payment in its hosted checkout, calculates and collects sales tax or VAT where it applies, sends your receipt, handles refunds and runs the customer portal where you manage or cancel your subscription. It tells us whether your subscription is active. | At checkout, Polar receives your name, e-mail address, billing country or address and payment details. We receive your subscription status, your plan and a customer ID, never card numbers. |
We may also disclose information:
- when the law requires it, for example under a court order or a lawful request from a government agency;
- to protect the rights, property or safety of Arcline, our users or others, including investigating abuse or a security incident;
- in a merger, acquisition or sale of the business, in which case we will tell you, and the new owner must honour this policy; and
- with your consent, or at your direction, for example when you connect your own GitHub account.
Providers may change as the service grows. We will keep this table up to date, and tell you in advance when a change matters to your data.
Where your information is processed
Our providers run servers in different countries, so your information may be processed or stored outside India. The Digital Personal Data Protection Act, 2023 allows personal data to be transferred outside India except to countries or territories the Central Government restricts by notification. We transfer data only as that Act permits, and if a country is restricted we will stop sending data there.
Wherever the data is, we use providers that protect it in transit, and we encrypt your connection secrets before they reach the database.
How long we keep information
We keep personal data only for as long as it is needed for the purpose it was collected for, or as the law requires. In practice:
| Information | How long |
|---|---|
| Your account (e-mail address and password hash) | Until the account is deleted. |
| Everything about one website (results, changes, snapshots, drafts, tracker data and the saved connection secret) | Until you remove the website. Removing it deletes all of it. Older scan details are trimmed as newer scans arrive. |
| Visitor tracker data | Until you remove the website. We do not currently delete older records automatically. The app reports only on a window of recent days. |
| Activity log | For the life of the account. It stays after a website is removed, so there is still a record of what happened. It is deleted or anonymised when we delete the account, except where the law requires us to keep records. |
| AI usage records | For the life of the account. |
| Finished background jobs | About two weeks. |
| Messages to us | As long as needed to resolve the matter, then a reasonable period as a record. |
| Billing and tax records | As long as tax and accounting law requires. |
| Security logs | For the period our hosting providers keep them, and longer where the law requires. |
When a period ends, the data is deleted from the live database. We do not promise or offer backups of your data, so please keep your own copy of anything you could not recreate. We may keep information longer where it is needed for a legal claim, a dispute or a legal obligation.
Your rights as a Data Principal
Under the Digital Personal Data Protection Act, 2023 you have the rights below. You can use any of them by writing to thescalelab10@gmail.com from the e-mail address of your account. The steps and our time targets are on the Grievance Redressal and Your Data Rights page.
- Access. Ask for a summary of the personal data we process about you, what we do with it, and the identities of the other parties we share it with.
- Correction, completion and updating. Ask us to correct inaccurate data, complete incomplete data or bring it up to date.
- Erasure. Ask us to delete your personal data when it is no longer needed for its purpose, or when you withdraw consent, unless the law requires us to keep it.
- Withdraw consent. You can withdraw consent at any time, and it should be as easy as giving it: remove a website, set its access to “No access”, or write to us. Withdrawal does not undo what was lawfully done before, and some features cannot work without the data they need.
- Grievance redressal. Raise a complaint with our Grievance Officer. We respond within the period the law prescribes.
- Nominate. Name another person to exercise your rights if you die or cannot act for yourself.
Once the Data Protection Board of India is constituted and operating, you may also complain to it after you have used our grievance process.
The Act also asks Data Principals to do the following, and we may refuse a request that breaks these duties:
- comply with the laws that apply;
- not impersonate another person;
- give only information that is verifiably authentic when asking for correction or erasure;
- not make false or frivolous complaints; and
- not hide material information when giving data for an official document or service.
Deleting your data
- Remove a website yourself
In Settings, choose “Remove this website”. We stop all work on it and delete everything stored about it, including its saved connection secret and its tracker key. Your real website is not touched. This cannot be undone.
- Disconnect only
If you only want to stop our access, disconnect the website connection in Settings. The stored secret is erased at once and your results stay.
- Delete your account
There is no delete-account button yet. Write to thescalelab10@gmail.com from your account e-mail address. If you have Premium, cancel it first (Profile, then Plan and billing, then Cancel my plan) so that it does not renew. After confirming that it is you, we delete your account, your websites and the data tied to them.
- What may remain
Records the law requires us to keep, such as billing and tax records, and security logs for the period the law requires. Until your account is deleted, the activity log also keeps a line saying that a website was removed.
How we protect your information
We use reasonable security practices, as section 43A of the Information Technology Act, 2000 and the SPDI Rules expect: HTTPS, passwords kept only as one-way hashes, connection secrets encrypted, every request checked against the account and website it belongs to, rate limits and login throttling, and an activity log. The Security Practices page explains each in plain words.
No system is completely secure, and we cannot promise that nothing will ever go wrong. If a personal data breach happens, we will contain it and tell the Data Protection Board of India and each affected person as the law requires. We will report cyber incidents to CERT-In within six hours of noticing them, as the CERT-In Directions of 28 April 2022 require, and we will tell you which connection secrets to revoke if they could be affected.
Children
The service is for website owners and businesses, and you must be 18 or older to use it. We do not knowingly collect personal data of anyone under 18. We do not track or monitor the behaviour of children, and we do not direct advertising at anyone. If you believe a child has given us personal data, write to thescalelab10@gmail.com and we will delete it.
Changes to this policy, and how to reach us
We may update this policy as the service or the law changes, and we will change the “last updated” date at the top. For material changes we will give at least 15 days' notice by e-mail or in the app before they apply, and we will ask for your consent again where the law requires it.
For privacy questions, write to thescalelab10@gmail.com. For complaints, write to our Grievance Officer, Preet Patel, at thescalelab10@gmail.com, or by post to Ahmedabad, Gujarat, India. You can also contact us in other ways. Our rules for using the service are in the Terms of Service.