Privacy

Who we are

Arc helps couples work through big financial decisions, starting with whether they can afford a home. Arc Financial Technology Ltd (registered in England and Wales, company number 17426103) is the data controller for the information described here, which means we decide what is collected and why.

If you have a question about your data, or want to exercise any of the rights below, email privacy@arcfortwo.com and a person will answer.

What we collect

Everything Arc holds about you is something you typed in, or something your browser did while using the product. We do not buy data about you, and we do not enrich what you give us from other sources.

• Your email address
  So you can sign in and return to your saved decisions. Signing in uses a code we email you, so we never hold a password.
• First names
  Yours and your partner's, so Arc can address you both directly rather than as "Partner 1" and "Partner 2".
• The financial figures you enter
  Income, savings, deposit, debts, outgoings, and details of the property you are considering. This is the heart of the product: without it Arc cannot tell you anything useful.
• Where the home is, if you tell us
  An optional postcode or town for the home you are considering, so Arc can show it on a map and tell you when buying costs there are worked out differently. It is kept with the rest of your answers and is not used to work out your answer.
• Your saved decisions and ranges
  The scenarios you save, the verdicts Arc produced, and any adjustments you made, so you can come back to them.
• Your household
  If you use Arc with a partner, you each sign in separately and see each other's figures, unless one of you hides their own income, debts and deposit share in Settings. Answers about how you think about money are always shared, because Arc shows where you see things differently. We record every change to your household's numbers and who made it, so you can both see what changed.
• Your signed-in devices
  For each place you're signed in, the kind of device and browser, when you signed in and when it was last used, so you can see where you're signed in and sign out of the ones you don't recognise. We don't show IP addresses or locations.
• Early-access requests
  If you ask for early access to something Arc has not built yet, or ask to be told when Arc covers Scotland or Wales, we record what you asked for so we can tell you in your Arc inbox.
• How you use Arc, if you agree to it
  Which screens you visit and which buttons you press, through our analytics, but only if you accept analytics cookies.
• A snapshot of a verdict you see, if you agree to it
  When you accept analytics cookies, the figures behind a verdict or range you view and the result Arc produced are saved to our own database, so that if something looks wrong we can see what you saw and fix it. It is never used for advertising and never shared outside Arc, only our small team can read it, and it is deleted after 90 days.
• Feedback you choose to give
  Reactions to a verdict, answers to the optional survey, and anything you send us through Give feedback.
• One question after sign-up
  How you heard about Arc, if you choose to answer: it can be skipped, and if you pick "Somewhere else" you can say where. Accounts created before 25 September 2026 may also hold an earlier answer about how you and your partner tend to make decisions together. These shape the product, not your results.
• A copy of your answer, if you ask for one
  When you press "Send us both a copy", we email your answer to you, and to your partner if you give their email or they have already joined. We keep a note that a copy was sent and to how many people, so it only goes once. We do not keep your partner's address.
• Your partner's email, if you give it
  Used once, to send them the copy you asked for, with a link to create their own login. It is not stored and is never added to any list. Whether they hear from Arc again is up to them, if they sign up.
• A heads-up request, if you ask for one
  If you tick "Email me if mortgage rates move enough to change our answer", we record that you asked, which saved answer it is about, the exact wording you saw and when. Rate alerts are not live yet: we will email you when they are. Untick it and the request is deleted.
• Your consent choices
  Whether you accepted analytics cookies, whether you asked for updates or a heads-up, the wording you were shown, and when you accepted our terms. We record these so we can show what you agreed to and when.
• A waitlist email address, if you give us one
  If you ask to be told when a decision we have not built yet is ready, we store the address you gave and which decision you asked about. We use it for that one message and nothing else, and you can ask us to delete it at any time.

What we do not collect

Arc asks for numbers, not access. It does not connect to your bank, does not run a credit check, does not see your credit file, and has no way to move money or apply for anything on your behalf.

We do not collect your address, date of birth, national insurance number, or any identity documents. (A postcode or town for a home you are considering is optional, and is described above.) We do not use advertising trackers, and we do not sell data to anyone.

Why we hold it, and our lawful basis

UK GDPR asks us to name a lawful basis for each use. Ours are:

• To run the product (contract)
  Storing your account, your figures, and your saved decisions is the service itself. Without this there is no Arc.
• To send you a sign-in code (contract)
  This is how you access your account, so it is not marketing and you cannot opt out of it while you have an account.
• To email you about your own decisions (contract)
  For example, telling you that something has changed which affects a decision you saved. These are service messages, not marketing.
• Analytics (consent)
  Only if you accept. You can withdraw at any time and we stop.
• Diagnosing what you saw (consent)
  The verdict snapshot is stored only with your analytics consent, so we can look into a result that seems wrong. Withdraw the same way and we stop, and each snapshot is deleted after 90 days.
• Marketing emails (consent)
  Only if you tick the box. It starts unticked and stays that way unless you choose otherwise.
• Sending the copy of your answer you asked for (contract)
  You asked for it, so sending it is part of the service. It goes once.
• Emailing your partner the copy you asked us to send (legitimate interests)
  You asked us to, and it carries only your shared answer and a link to join you. We send one email, and keep no record of the address.
• A heads-up when rate alerts launch (consent)
  Only if the box is ticked. Untick it and we delete the request.
• Telling you a waitlisted decision is ready (consent)
  Asking to be told is the consent. It buys one message about the thing you asked about, and nothing else.
• Improving Arc (legitimate interests)
  We look at feedback and aggregate patterns to decide what to build. We balance this against your privacy by working from aggregates wherever we can, and by keeping the raw material to the small team building Arc.
• Responding to legal claims (legitimate interests)
  When an account closes, we keep a limited record of what Arc showed it, described under "How long we keep it", so we can answer if anyone ever makes a claim about a result Arc gave. We keep it no longer than that purpose needs, and it holds no names or contact details.
• Keeping records of consent (legal obligation)
  Data protection law requires us to be able to show what you agreed to, so we keep those records even if you later withdraw.

A note on financial information

UK GDPR does not treat financial details as a "special category" the way it treats health or beliefs. We think that undersells how personal your income, debts, and savings are, so we treat them as sensitive regardless: they are never used for advertising, and they are never sold or shared with lenders, brokers, or anyone else trying to sell you something.

Arc has no product referral arrangements. If that ever changes, we will say so here first, and it will not happen quietly.

Personalisation

As Arc grows, we intend to make what you see and what we send you more relevant to your situation: for example, tailoring the emails you have asked for around the kind of decision you saved, or the stage you are at.

This uses information you have already given us, for a purpose you can refuse. Personalised emails only go to people who asked for updates, and turning updates off stops them. Personalisation inside the product helps Arc show you the more useful thing first; it never changes the maths, and it never changes the verdict you are given.

Arc does not build advertising profiles, does not share what it knows with data brokers or advertisers, and does not use your figures to target you anywhere outside Arc.

Automated decisions

Arc runs your figures through a model to produce a verdict. That model does not make a decision about you. It does not approve or refuse anything, it is not shared with a lender, and it has no effect on what any lender will offer you.

The verdict is information for you to use, and you can change any input and run it again. Because of that, it is not the kind of solely automated decision with legal or similarly significant effects that gives you a specific right to human review under UK GDPR. If you want to understand how a result was reached, email us and we will explain it.

Analytics cookies

Arc uses analytics cookies to understand how people move through the product, so we can make it better. They are optional. None are set unless you accept them, and you can change your mind at any time using the control below or the Cookies link in the footer. Once set, they identify your browser, and after you sign in they are linked to your account, so we can follow one journey from start to finish. Arc does not use advertising cookies and never sells your data.

Marketing emails

We will only email you about Arc if you asked us to. The box at sign-up starts unticked, and ticking it is the only way it becomes true.

You can change your mind at any time in Settings, under Communication preferences, and every marketing email carries an unsubscribe link. Withdrawing is one click, exactly like giving it. Emails about your own account, such as your sign-in code or a change affecting a decision you saved, are not marketing and will still be sent.

Who else touches your data

We use a small number of companies to run Arc. They process your data on our instructions and cannot use it for their own purposes.

• Supabase
  Our database and sign-in system. Your account and everything in it is stored here, in a project hosted in London.
• Twilio SendGrid
  Sends our emails, including your sign-in codes and any copy of your answer you ask for. It sees the addresses we send to and the contents of those emails. We switch off its link and open tracking for copies of your answer. SendGrid is based in the United States.
• PostHog
  Our analytics, on their European servers, and only if you accepted analytics cookies. Once you are signed in it also sees your email address and first name, so we can tell one person's activity from another's.
• Vercel
  Hosts the Arc website and serves it to your browser.
• postcodes.io
  If you type a postcode or town for the home, it is sent to postcodes.io, an open-data service, to find where it is and which part of the UK it is in. Nothing else is sent with it.
• MapTiler
  Draws the map of where the home is. Your browser asks MapTiler for the map around that spot, so MapTiler sees the area being shown, but not your name, email or figures. MapTiler is based in Switzerland.

We will update this list when it changes. If we ever needed to share your data for a reason not described on this page, we would ask you first, unless the law required otherwise.

If Arc changes hands

Data privacy is fundamental to Arc, and that does not change if the company does. If Arc is ever bought, merges with another company, or sells part of what it does, we will tell you openly and in good time, before anything happens to your data rather than after.

You will have a real chance to decide what happens to your information first: take a copy and leave, delete your account, or stay. Any new owner would be bound by a policy at least as protective as this one. We will not let your data quietly become someone else's asset, and the commitments on this page carry forward regardless of who owns Arc.

Where your data is stored

Your account and all the figures you enter are stored in the United Kingdom. Analytics, if you accept them, are stored in the European Union.

Our email provider is based in the United States, so your email address and the emails we send you are transferred there. That transfer relies on the safeguards UK data protection law provides for international transfers, through the provider's standard contractual terms.

How we keep it safe

There is no password to be stolen or reused, because signing in uses a one time code sent to your email.

No system is perfectly secure, and we will not pretend otherwise. If a breach ever affected your data in a way likely to put you at risk, we will tell you and the Information Commissioner's Office within the timescales the law sets.

How long we keep it

We keep your account, your figures and everything you save for as long as you have an account. That includes your saved decisions, saved price ranges and budget limits, and the figures each one was worked out from. When you delete a saved decision or range, we delete it and the figures behind it. Budget limits stay in your household's history for as long as the household exists.

When you close your account in Settings, we delete your sign-in, name and email, your own figures, your answers, your notes, your feedback and survey answers, and any waitlist requests. We remove your figures from your partner's saved decisions and history, and ask our analytics provider to delete what it holds about you. If you were the last person in your household, we delete the household and everything saved in it. If not, your partner keeps the household and its saved decisions.

We keep one thing after you close: a limited record of what Arc showed you, so we can answer if a legal claim is ever made about a result Arc gave. It holds a reference number that nothing left in Arc connects to your name or email, the dates your account opened and closed, the versions of our terms and this policy you accepted, your consent choices, and every verdict your household saved while you were in it, with the figures it was worked out from and the version of Arc that produced it. It holds no names, email addresses or contact details. We delete it automatically after 6 years.

Those figures include both partners' numbers, because a verdict can only be explained from everything it used. So if your partner closes their account, the record kept for them includes your figures from the verdicts your household saved, for the same 6 years, even if you stay.

The verdict snapshots we take with your analytics consent are diagnostic, not records to keep, so we delete them automatically after 90 days.

Deleted data can stay in our database backups for up to 7 days, until those backups are cleared.

Children

Arc is for adults making decisions about their own finances, and is not intended for anyone under 18. We do not knowingly collect data about children. If you believe a child has given us information, email us and we will delete it.

Your rights

Under UK data protection law you can ask us to:

• Show you what we hold
  We will send you a copy of your data.
• Correct it
  If something is wrong, tell us and we will fix it.
• Delete it
  You can close your account in Settings at any time, which deletes it as described under "How long we keep it". You can also ask us to.
• Give you a portable copy
  In a machine-readable format you can take elsewhere.
• Stop or limit a use of it
  Including objecting to anything we do on the basis of legitimate interests.
• Withdraw a consent
  For analytics or marketing, at any time, without needing a reason.

To do any of these, email privacy@arcfortwo.com. We will respond within one month. Exercising these rights is free, and we will not treat you differently for it.

If you are unhappy with how we handled it

Please tell us first, so we have the chance to put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk, or by calling their helpline on 0303 123 1113. Complaining to us first does not affect that right.

Changes to this policy

We will update this page when what we do changes, and update the date at the top. If a change materially affects how we use your data, we will tell you rather than relying on you to notice. This version is dated 30 September 2026.