Privacy notice

Who holds your data

Arrowmics (“we”, “us”), based in Ahmedabad, Gujarat, India, decides how the data described here is handled. For an organization's own records the organization is the one that decides what to collect; we hold them on its behalf.

What is stored

• Your account: name, email address, whether that address is confirmed, an avatar if you upload one, and a hashed password. We never store the password itself.
• Your sessions: for each signed-in device, the IP address, the browser's user agent, and when it was last active. You can see and end them from your profile.
• Your organization's records: clients, rates and their price history, enquiries, quotations, orders, invoices and payments, projects, vendors, jobs, and any file uploaded against a job. This is whatever your organization chooses to enter, including the customer details on a quotation or an invoice.
• Share links: when you share a quotation or an invoice, we store the link's token, whether it is still enabled, when it expires, how many times it has been opened, and when it was first and last opened. We tell the people in your organization that it was opened and note when one of your own members opened it. We do not store who else opened it.
• A request for a demo or a price: the name, email address, phone number, company name, and message you type into the form, which of our pages sent you to it, where you came from if a campaign or another site sent you, and your browser's user agent. If you were signed in, we link the request to your account and organization. We do not store your device's address with it.
• An email address or a message you send from the free quote sheet: what you type into those two fields, that it came from the free quote sheet, where you came from if a campaign or another site sent you, and your browser's user agent, kept as a request the team reads. If you were signed in, we link it to your account and organization. Nothing you typed into the sheet itself is sent with it.
• Email we send: for every message, the address, the subject, the kind, the provider's message id, and the time. We do not keep a copy of the message body.
• Error reports: when a request fails, the request id, the route, and the organization id go to our monitoring tool with the technical details of the failure. Document contents are not sent.

The free quote sheet

The free quote sheet keeps what you type in your own browser's storage and sends none of it to us: a database named quote-sheet with your quotes (quotes and documents), and your currency, page size, the quote you had open, and the notices you have seen (settings), where a saved quote that cannot be read is also kept rather than deleted. A sheet saved by an earlier version of the page is moved into it the first time you open the page. These are not cookies and go with no request. The PDF is made in your browser too. Clearing this site's data in your browser removes all of it. An email address or a message you choose to send from the page is the one thing it sends, and we keep it as a request, as described above.

Why it is stored

To run the service you asked for: to sign you in, to keep your records available to the people you invited, to calculate and reproduce a quotation, to send the messages you ask us to send, to keep the service secure, and to meet the bookkeeping obligations that come with a paid service. We do not profile you, we do not advertise, and we do not sell anything about you to anyone.

Where it is kept, and who processes it

Records live in a PostgreSQL database hosted by Neon. The application is hosted by Vercel, and the files you upload are stored by Cloudflare. These companies process data on our instructions and for no purpose of their own:

• Vercel, for hosting the application.
• Cloudflare, for storing the files you upload.
• Neon, for the PostgreSQL database every record is stored in.
• Resend, for sending transactional email.
• Sentry, for error reports, which carry a request id and no document content.
• Google, for optional sign-in, for accounts that choose it.

Cookies

Arrowmics sets only the cookies it needs to work: the cookie that keeps you signed in, a small preference for whether the sidebar is open, arrowmics_list, which keeps the currency you chose for the prices on our public pages (a currency code and nothing else) for 180 days, arrowmics_zone, which holds your device's time zone (such as Asia/Kolkata) so those pages open in your region's currency, also for 180 days, and, on your first visit, quoter_attribution, which records where you came from (the campaign or site that sent you) for 30 days so we know which of our own pages are worth keeping. It still carries the product's earlier name, and it is not set on a shared invoice or quotation. When product analytics are switched on, a usage library also stores an anonymous identifier in your browser; it records which screens are used, never what a document says. There is no advertising cookie and no third-party advertising tracker, which is why you are not asked to consent to a banner.

Who else sees your records

• The members of your organization, according to the role each of them has.
• Anyone you give a share link to. A share link is a long random token that opens one document and nothing else, and an owner or admin can revoke it at any time.
• The processors listed above, only as far as their job needs.
• Somebody with a lawful order that we are required to obey. Where we are allowed to tell you, we will.

How long it is kept

• An organization's records are kept while the organization exists. Deleting an organization removes its clients, documents, rates, prices, and uploaded files permanently, and there is no undo.
• Deleting your account removes your sign-in, your sessions, and your memberships. Records you created stay with the organization that owns them, with your name removed from them.
• The log of email we sent keeps the address and the subject after the account is gone, because it is our record that a message was sent.
• We keep a request for a demo or a price, and an address or a message from the free quote sheet, while we answer it, and remove it with our notes about it 365 days after we close it.
• A record of the actions the people who run Arrowmics take on accounts, organizations, and the built-in data is kept for as long as the service runs. It names the person acting and the person or organization acted on, and is never sold or shared.
• Backups held by our database provider roll forward on their own schedule, so a deleted record can persist in a backup for a short period before it ages out.

Your rights

Under India's Digital Personal Data Protection Act you may ask for a copy of the personal data we hold about you, ask us to correct it, ask us to erase it, and complain about how we have handled it. Most of it you can do yourself:

• Correct your name or avatar in your profile.
• See and end your signed-in sessions in your profile.
• Delete your account in your profile. If you are the only owner of an organization, hand it over or delete the organization first.
• Delete an organization and everything in it from its settings, if you are its owner.

For anything else, write to contact@arrowmics.com and we will answer within 30 days.

Grievance officer

Our grievance officer answers complaints about personal data. Write to contact@arrowmics.com. If you are not satisfied with the answer you may complain to the Data Protection Board of India.

If something goes wrong

If personal data is exposed, we will tell the people affected and the Data Protection Board within 72 hours of establishing what happened, and say what we know, what we have done, and what you should do.

Changes to this notice

A new version is posted on this page with a new date. If a change matters to you we will email the address on your account first. The terms of service cover the rest of the agreement.