Privacy Policy
Effective date: [2026-10-29]
Last updated: [2026-10-29]
ArchiMAT Inc, a Delaware corporation at 4300w Tropicana Ave. Building A Ste . 125 Las Vegas,NV 89103, provides archimat.io and the ArchiMAT Services. Contact our privacy team at [[PRIVACY EMAIL]] or by post at that address. Our designated privacy lead or data protection officer, where applicable, can be reached at [[PRIVACY LEAD CONTACT]].
This Policy covers website visitors, account users, business contacts, people who contact us and individuals whose details are included in customer records or shared through the Services. It explains information about identifiable people; we also protect non-personal confidential business records under our contracts.
This notice describes processing associated with features you actually use. A description of a possible feature does not mean that we collect every category from every person. Independent websites and services you choose to use have their own privacy notices.
We determine the purposes of processing for our own account administration, billing, direct support relationships, security and business communications. In these activities we act as a controller or equivalent responsible organization under applicable law.
When a Customer uses Company, Project or Space tools to manage its contacts, workers, drawings, records or evidence, it generally decides why that information is processed. We process it on that Customer’s documented instructions under the Data Processing Addendum. The role depends on the actual activity, not just the label in a contract.
Your Company administrator may control workspace access and see activity within the permissions assigned to that role. Ask your organization about its own notices, employment rules, retention and sharing decisions. If a request concerns information it controls, we will direct it to the appropriate Customer and assist as legally required.
Account And Professional Identity
Name, work email, role, Company, credentials or authentication identifiers, profile details
Source: You, your administrator or sign-in provider
Subscription And Billing
Billing address, tax details, invoices, payment status and payment method metadata
Source: You and payment provider
Company And Network Records
Business contacts, employees, suppliers, role assignments and relationship notes
Source: Customer and authorised collaborators
Project And Space Records
Plans, specifications, asset and serial records, warranties, tasks, service records, costs and approvals that identify people
Source: Customers and authorised participants
Evidence And Location
Uploaded photos, named submissions, timestamps and location supplied for an enabled check-in
Source: You, your device with permission, or Customer
Impact Inputs And Outputs
Utilities, waste, materials evidence, assumptions, reporting approvals and reports that contain personal details
Source: Customer records, integrations and authorised contributors
Technical And Usage Records
IP address, device and browser information, access events, security logs and selected usage events
Source: Your interaction with our systems
Communications
Enquiries, support requests, feedback, consent records and marketing preferences
Source: You and authorised contacts
An organisation may provide information about someone who has no account, such as a technician or supplier contact. It must have lawful authority to do so. Public product and business information may be received from its authorised publisher; public availability does not remove privacy rights.
[[CONFIRM PAYMENT HANDLING: Our payment provider collects payment credentials directly. ArchiMAT receives payment status and limited metadata rather than storing full card numbers or card security codes.]] Do not send payment credentials through project notes, messages or support attachments.
We use relevant information to register and authenticate accounts; provide requested Company, Project, Space and Discover functions; carry out authorised sharing and handover; administer subscriptions; respond to support; maintain and secure the Services; prevent fraud; meet legal obligations; and manage our business relationship with you.
Where an optional analytics feature is enabled, we use the permitted events to understand feature use and improve usability. Optional tracking follows the Cookie Policy and your choices. Private project documents, drawings and personal details should not be included in general marketing analytics.
We send service notices needed for the account and security. We send promotional communications only where permitted and provide an unsubscribe or preference method. We do not treat acceptance of the Terms as agreement to optional marketing or tracking.
Where EEA or UK law applies to our controller activities, the relevant bases are performance of a contract with you; our legitimate interests in managing business relationships, support and proportionate security where these are not overridden by your rights; legal obligations such as tax or lawful disclosure duties; and consent where required for optional tracking or marketing. For an employee of a corporate Customer, administration may rely on legitimate interests rather than a contract with that employee.
Where we rely on consent, you may withdraw it at any time without affecting prior lawful processing. A Customer is responsible for the legal basis for processing it directs. The Privacy Policy is an explanation, not a request for one consent covering every purpose
Private workspace information is made available to authorised users according to the selected Company and resource permissions. An invitation to quote or complete a service task does not grant access to unrelated Company records. A brand does not receive private project, owner or client details merely because its product is specified.
Publishing a profile, product, showcase or map entry makes the selected information public or available to the stated audience. A publish flow should identify the fields and location precision before confirmation. Precise check-in locations and unpublished layouts are separate from public map entries. Consider whether photographs reveal faces, screens, access systems or confidential work.
Authorised recipients may download reports or handover documents and lawfully retain their own copies. Access revocation limits future platform access but cannot recall every downloaded copy. Privacy requests affecting those copies may need to be addressed to the recipient as well.
We disclose only the relevant information to providers supporting the Services, such as hosting, storage, authentication, email, support, security, payments and enabled reporting or AI functions. The verified provider list, purposes, processing countries and change-notification method are at [[SUBPROCESSOR REGISTER URL]]. Providers processing Customer personal data for us are subject to the Data Processing Addendum.
We may disclose information to an integration you authorise; professional advisers under appropriate obligations; authorities where law requires; or a prospective or actual business successor under confidentiality and lawful safeguards. We assess requests and limit disclosure where appropriate. We do not grant advertisers unrestricted access to private workspace data.
[[COMPLETE SALE AND SHARING STATEMENT AFTER AUDIT: State whether ArchiMAT sells personal information, shares it for cross-context behavioural advertising, or uses it for targeted advertising under applicable US state laws. Identify recipients, categories and a working opt-out if any such activity occurs.]] Data sent through advertising pixels may fall within these definitions even if no money changes hands.
If an enabled function requests precise location or camera access, the request should explain its purpose at the point of use. You can decline device permission, although a location-dependent function may not work. A device permission is separate from your organization’s obligation to provide a lawful workplace notice or obtain consent where required. [[CONFIRM LOCATION DESIGN: State whether collection is limited to an initiated check-in, any precision reduction, and any available manual alternative.]]
The Services are not designed to store patient records, clinical information, government identity documents, biometric templates or other special-category data. A healthcare Space is a facilities record, not an electronic health record. Do not upload such information unless a separate written agreement and suitable legal and technical safeguards permit it. Do not upload access codes or security secrets into public fields.
Where released and enabled, AI features may receive the prompt, selected documents or records and context necessary for the requested task. The feature notice must identify relevant providers, purposes and retention. Data retrieval must respect the requesting user’s permissions. AI output requires review before external use or approval.
[[CONFIRM AI DATA RULE: Private Customer Content, prompts and outputs are not used to train generalpurpose AI models by ArchiMAT or its processing providers.]] [[CONFIRM AI LOG RETENTION AND HUMAN ACCESS]]. No significant automated decision about a person is authorised by this Policy; any such proposed use requires its own legal and product assessment.
[[CONFIRM SESSION REPLAY: State whether session replay is used. If it is, identify the provider and retention, obtain consent where required, exclude sensitive screens, and describe masking. If it is not used, remove this field and do not load the technology.]]
Our verified hosting and processing locations are [[HOSTING AND PROCESSING COUNTRIES INCLUDING REMOTE SUPPORT]]. Information may be accessed from countries with different privacy laws. We do not promise local data residency unless a specific order and the actual architecture support it.
For restricted transfers, we use a lawful mechanism appropriate to the actual parties and activity, such as a valid adequacy route or completed contractual safeguards, with any required transfer assessment and supplementary measures. EEA, UK, Singapore and Malaysia requirements are assessed separately where applicable. The details of applicable safeguards and how to request a copy are [[TRANSFER SAFEGUARD CONTACT OR URL]]. Website wording alone does not create a valid transfer mechanism.
We retain personal information only for the purpose and period justified by the service, Customer instructions and applicable law. Relevant factors include the account’s status, legal recordkeeping duties, security investigations and disputes. The approved schedule is [[RETENTION SCHEDULE URL]].
Cancelling a paid plan normally stops renewal and may return the Company to Free allowances; it is not a request to delete every record. Closing a Project preserves its history until applicable retention or deletion instructions say otherwise. Complete account deletion follows verified authority, privacy rights and the Data Processing Addendum.
Active Customer workspace records
[[ACTIVE ACCOUNT RETENTION RULE]]
Closed Account Export Availability
[[POST TERMINATION EXPORT WINDOW]]
Deletion From Active Systems
[[ACTIVE SYSTEM DELETION PERIOD AND TRIGGER]]
Isolated Backup Expiry
[[BACKUP EXPIRY PERIOD AND TRIGGER]]
Billing And Tax Records
[[STATUTORY RECORD PERIOD AND JURISDICTION]]
Security And Access Logs
[[SECURITY LOG PERIOD]]
Support And Optional Ai Logs
[[SUPPORT AND AI LOG PERIODS]]
Unsubscribed Marketing Contacts
[[MINIMAL SUPPRESSION RECORD RULE]]
Legal holds may require limited retention with restricted access. Data remaining in isolated backups is protected, is not used for ordinary processing and expires under the approved cycle. If a backup is restored, applicable deletion instructions must be reapplied. Anonymisation is used only where re-identification is not reasonably likely; removing names alone is insufficient.
We use appropriate technical and organisational measures designed to protect information against unauthorised access, alteration, disclosure and loss. The verified security summary is [[SECURITY PAGE URL]]. No system is immune from every incident. If a breach occurs, we assess and meet applicable contractual and legal notification duties.
[[CONFIRM VERIFIED SECURITY DESCRIPTION AND REMOVE UNPROVEN CLAIMS BEFORE PUBLICATION]].
Depending on the law that applies, you may request access, correction, deletion, restriction, portability, information about recipients or purposes, or object to certain processing. You may withdraw consent, unsubscribe from marketing and exercise applicable sale/sharing or targeted advertising opt-outs. Some US state laws also provide a right to appeal a refusal. We will not unlawfully discriminate against you for exercising a privacy right.
Submit requests through [[PRIVACY REQUEST FORM URL]] or [[PRIVACY EMAIL]]. Tell us your relationship to the data without sending unnecessary identity documents. We verify identity and authority proportionately, apply lawful exceptions and respond within the period required by your applicable law. Where law permits an authorised agent, provide evidence of that authority. To appeal where applicable, use
[[PRIVACY APPEAL METHOD]].
If a Customer controls the relevant record, we will route the request to it and assist. We will not delete an entire Company’s records solely on an unauthorised individual’s request. You may complain to the regulator with jurisdiction over your information, including the relevant EEA authority, the UK ICO, Singapore PDPC or Malaysia Personal Data Protection Commissioner where applicable. We welcome the opportunity to address your concern first, without making that a condition of your rights.
[[US STATE NOTICE FIELD: If applicable, complete a regional supplement identifying categories collected and disclosed in the relevant preceding period, sources, purposes, recipients, retention criteria, sale/sharing status, sensitive data use, appeal rights and request methods. Honour legally recognised opt-out signals such as Global Privacy Control where required and explain the result.]]
The Services are intended for adults and professional business use. We do not knowingly offer accounts to people under 18. If you believe a child has supplied personal information without appropriate authority, contact [[PRIVACY EMAIL]] so we can investigate and take suitable steps. Customers should avoid uploading photographs or details of children into their workspace records.
We update this Policy when practices or requirements change and show the effective date. We will give prominent notice of a material change as required and obtain fresh consent or other authority when necessary before beginning materially different processing. Contact [[PRIVACY EMAIL]] with questions or requests.