Privacy Policy
This Privacy Policy explains what information Arkly Solutions LLC ("Arkly Solutions", "we", "us") collects when you use Arklytech: the Arklytech mobile app for Android and iOS, the Arklytech web app at app.arklytech.ai, and the cloud service behind them at api.arklytech.ai (together, the "Service"). It also explains how we use that information and the choices you have.
1. What Arklytech is
Arklytech is a professional tool for access-control technicians. It configures Mercury access-control panels through the Arklytech Bluetooth handheld, and keeps a shared cloud library of your organisation's sites, buildings and devices so a configuration can be prepared once and pushed to a panel later. The Service is meant for business use by adults.
2. Information we collect
Account information
- Email address, name and organisation name, which you give us when you create an account or accept an invitation.
- Password, if you set one. We store only a one-way hash (bcrypt), never the password itself.
- Two-factor authentication. Every account must use an authenticator app. We store the authenticator secret in encrypted form and your backup codes as one-way hashes.
- Google or Apple sign-in. If you choose "Continue with Google" or "Sign in with Apple", we receive from that provider your account identifier, your email address (with Apple this may be a private relay address) and, the first time, your name. From Google we request only the basic profile scopes (openid, email, profile). For Apple we also keep an encrypted token that lets us revoke Arklytech's access to your Apple ID when you delete your account. We never receive your Google or Apple password.
- Sessions: for each signed-in device we keep the device name, platform, app version and when it was last used, so you can see your sessions and sign them out.
Team information
If you are a manager and invite technicians, we store their email address, name, role and which sites they can access. Please invite only people who expect to hear from us about your organisation's Arklytech account.
Device library
The content you and your team enter or import: sites, buildings and devices, with their names, MAC addresses, IP addresses, network settings, panel configurations and notes, panel user names and panel passwords, device web page certificate fingerprints, and records of the Arklytech handhelds your organisation uses (hardware address, Bluetooth name, firmware version, last seen and last user). Panel passwords and 802.1X passwords are encrypted on our servers with per-organisation keys.
Activity and security records
- Push history and status checks: which device, the result, when, by whom and through which handheld.
- An audit log of important actions, such as creating, editing, moving or deleting records, imports and exports, pushes, role changes, sign-ins and failed sign-ins, and changes to sign-in methods. Each entry records the user, the time, the IP address and the app version. Passwords and other secrets are never written to the audit log.
- Server logs with the IP address, request path, status and timing of each request. We do not log request bodies, passwords or tokens.
Crash reports and diagnostics
The app does not currently include a third-party crash reporting or analytics SDK. If we add crash reporting to improve stability, it will be set up to exclude email addresses, names, IP and MAC addresses, panel data and passwords, and we will update this policy before it ships. The app keeps a small local log for troubleshooting that leaves your phone only if you choose to share it with us from Help.
What stays on your phone
- The app keeps an encrypted offline copy of the library you can access (so pushes work without signal) and your session token in the phone's secure storage. Both are erased when you sign out.
- Bluetooth is used to connect to your Arklytech handheld. Local network access (iOS) and the handheld's Wi-Fi are used to open a panel's own web page.
- Location permission is requested only on Android versions that require it to scan for Bluetooth devices or join the handheld's Wi-Fi. Arklytech does not read, store or send your location.
- App lock uses your phone's own biometrics or passcode. We never receive biometric data.
3. How we use information
- To provide the Service: your account, sign-in, syncing your library between phones and the web app, pushes, status checks and reports.
- To keep accounts secure: two-factor authentication, lockout after repeated failed sign-ins, sign-in alerts, the audit log and investigating misuse.
- To send service emails, such as verification and password reset codes, invitations, security alerts and account notices. We do not send marketing email.
- To answer your support requests and to meet legal obligations.
Where the law asks for a legal basis (for example in the EU or UK), we rely on performing our contract with you or your organisation, our legitimate interest in keeping the Service secure and working, and compliance with legal obligations.
4. What we do not do
- No advertising and no advertising identifiers.
- No tracking of you across other companies' apps or websites.
- No analytics SDKs.
- No selling of personal information, and no sharing of it for cross-context behavioural advertising.
5. Who we share information with
- Your organisation. Library content is shared with the members of your organisation according to their role and site access. Managers can see team members and the audit log.
- Service providers that process data for us under contract and only on our instructions: DigitalOcean (servers, database and encrypted backups, in New York, USA) and Resend (delivery of service emails).
- Google and Apple, only when you choose to sign in with them. Their handling of your data is covered by their own privacy policies.
- Legal reasons: when required by law or to protect the rights, safety and security of our users, the public or Arkly Solutions.
- Business transfers: if Arkly Solutions is involved in a merger, acquisition or sale of assets, information may transfer under this policy.
6. Security
All traffic between the apps and our servers is encrypted with TLS. Two-factor authentication is mandatory for every account. Panel passwords, authenticator secrets and provider tokens are encrypted on the server; passwords and backup codes are stored as one-way hashes; database backups are encrypted. The phone's offline copy is stored in an encrypted database. No system is perfectly secure, so please keep your password, authenticator and backup codes safe.
7. Where data is stored
Our servers and backups are in the United States (DigitalOcean, New York). If you use the Service from outside the United States, your information is transferred to and processed in the United States.
8. How long we keep information
- Account and library data: for as long as your account and your organisation's account are active.
- When you delete your account, your sign-in methods, sessions, authenticator secret, backup codes and codes are deleted at once, and your name and email address are removed from your user record. Audit log entries are kept for security and record keeping, linked only to an internal user number.
- Encrypted backups are kept for up to 30 days and then overwritten, so deleted data leaves the backups within 30 days.
- Server logs are rotated automatically and kept only for a short time.
9. Deleting your account
In the app: open Settings › Account › Delete account, confirm with your password (or a fresh Google or Apple sign-in) and your authenticator code.
By email: write to contact@arklytech.ai from the email address of your account. We may ask you to confirm the request, and we complete it within 30 days.
A manager who is the only member of the organisation deletes the organisation and its device library together with the account. A manager whose organisation still has other members must remove them first. Records a technician created belong to the organisation and stay in its library. Full details are on the account deletion page.
10. Your rights and choices
Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to or restrict some processing, and to complain to a data protection authority. You can update your name in the app, managers can export the device library as CSV, and you can delete your account at any time. For any other request, email contact@arklytech.ai. We will not treat you differently for exercising your rights.
California residents: in the past 12 months we have collected the categories described in section 2 (identifiers such as name, email and IP address; account and security records; and the business data you enter) for the purposes in section 3. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information to infer characteristics about you.
11. Children
Arklytech is a professional tool and is not directed to children. We do not knowingly collect information from anyone under 16. If you believe a child has given us information, contact us and we will delete it.
12. Changes to this policy
We may update this policy. We will post the new version here with a new effective date, and for significant changes we will let you know in the app or by email before they take effect.
13. Contact
Arkly Solutions LLC
Email: contact@arklytech.ai