ARC-AI · Legal

Privacy Policy

Effective: 26 August 2026 · Version 1.0

1. Who is responsible

SELZIOR S.R.L., Bucharest, Romania, CUI 50260236, Trade Register J40/12255/2024 ("Selzior", "we", "us") operates ARC-AI.

Privacy and data-rights requests: privacy@selzior.com.

For Selzior's own ARC-AI services, Selzior generally acts as data controller. When a client business uses ARC-AI for its own customer communications, that business may act as controller and Selzior may act as its processor under written instructions. In that case, the client business's privacy notice also applies.

2. Data we may process

Depending on the enabled features and the choices made during onboarding, ARC-AI may process:

• WhatsApp identifiers, phone numbers, profile names and business-account identifiers;
• message text, attachments, voice notes, images and other content sent in a conversation;
• message metadata, including timestamps, message IDs, delivery, read and error status;
• contact information synchronized from a WhatsApp Business account when the business authorizes synchronization;
• up to 180 days of eligible one-to-one WhatsApp Business app history when the business expressly chooses to share and synchronize that history;
• messages sent by an authorized human operator through the WhatsApp Business app, received as message echoes;
• instructions, preferences, approvals and records needed to supervise AI-assisted work;
• technical, security and operational logs, such as request time, webhook validation results, error records and abuse-prevention signals.

Group-chat history is not imported through WhatsApp Business App Coexistence. We do not intentionally request special-category data. Users should not send sensitive information unless it is necessary and appropriate for the business interaction.

3. Why we process data

We process personal data only for defined purposes, including:

• delivering and synchronizing business conversations requested by users and authorized businesses;
• providing supervised AI assistance, retrieval, summarization, drafting and, where enabled, bounded message responses;
• maintaining continuity between human operators and approved automated agents;
• authenticating users and business assets, applying access controls and recording approvals;
• detecting duplicate, fraudulent, malicious or technically invalid requests;
• maintaining reliability, troubleshooting incidents and measuring service performance;
• complying with legal obligations and establishing, exercising or defending legal claims.

Selzior does not sell personal data and does not use WhatsApp conversation content for third-party advertising. Selzior does not use conversation content to train a general-purpose foundation model.

4. Legal bases

The applicable legal basis depends on the relationship and purpose:

• Contract and pre-contractual steps — to provide a requested service or respond to a business inquiry;
• Legitimate interests — to operate secure, useful and supervised business communications, prevent abuse and maintain service continuity, balanced against individual rights;
• Consent — where the law requires consent or where an optional feature, such as initial WhatsApp Business app history sharing, is presented as a choice;
• Legal obligation — where records must be retained or disclosed under applicable law;
• Legal claims — where necessary to establish, exercise or defend claims.

Consent may be withdrawn at any time without affecting processing already carried out lawfully. Withdrawing or refusing optional history sharing may limit features that depend on conversation history.

5. AI-assisted processing and human control

ARC-AI may use AI models to retrieve context, summarize conversations, classify requests, draft responses or generate an approved response. The active mode may be observe-only, human-copilot or bounded agent operation. Selzior designs the service so that consequential actions remain subject to defined authorization and supervision.

ARC-AI is not intended to make decisions that produce legal or similarly significant effects about an individual solely through automated processing. If a deployment changes this position, the affected individuals will receive additional information and safeguards before that processing begins.

6. Who receives data

Personal data may be processed by carefully selected recipients only as needed for the service:

• Meta Platforms / WhatsApp, which operates WhatsApp Business Platform and delivers messages and webhooks;
• Cloudflare, which provides DNS, encrypted tunnel, delivery and security infrastructure;
• AI and infrastructure providers configured for a deployment, under appropriate contractual and security controls;
• authorized Selzior personnel and approved contractors subject to confidentiality;
• the client business responsible for the relevant conversation;
• public authorities or professional advisers where disclosure is legally required or necessary for legal claims.

We use data minimisation and, where available, provider settings designed to limit retention and secondary use.

7. International transfers

Some service providers may process data outside Romania or the European Economic Area. Where required, transfers rely on an adequacy decision, the European Commission's Standard Contractual Clauses, or another valid transfer mechanism, together with supplementary safeguards where appropriate.

8. Retention

We retain personal data only while it is necessary for the active service, the stated purposes, security, dispute handling or applicable legal obligations. When data is no longer necessary, we delete it or anonymize it. Raw technical payloads and diagnostic logs are kept for shorter operational periods unless an incident requires preservation.

A verified deletion request may result in earlier deletion unless retention is required by law, necessary for legal claims, or technically required for a short backup-rotation period. When Selzior acts as a processor, deletion is coordinated with the relevant client controller.

9. Security

We use measures appropriate to the risk, including transport encryption, webhook-signature verification, access controls, credential separation, allowlists, duplicate-event protection, logging and supervised operational boundaries. No system is completely secure; we investigate suspected incidents and make legally required notifications.

10. Your rights

Subject to applicable conditions, you may request access, correction, deletion, restriction, portability, or object to processing. You may withdraw consent where processing relies on consent. You may also ask for information about safeguards used for international transfers.

Send requests to privacy@selzior.com. We may request proportionate information to verify identity and protect conversation data from unauthorized disclosure. See the separate Data Deletion Instructions.

You may lodge a complaint with the Romanian supervisory authority, ANSPDCP, or with another competent supervisory authority in your place of residence or work.

11. Children

ARC-AI is intended for business communications and is not directed to children. We do not knowingly design the service to collect children's data. If you believe a child has provided data inappropriately, contact us so we can assess and delete it where required.

12. This policy website

This static policy page does not use analytics, advertising pixels or non-essential cookies. Basic network and security logs may be generated by the hosting provider to deliver and protect the page.

13. Changes

We may update this policy when ARC-AI's processing changes or legal requirements evolve. We will publish the revised version and effective date here. Material changes will be communicated through an appropriate channel where required.