1. Who we are and what this policy covers
Arcforth is the brand under which Scoredile Technologies Private Limited provides product planning, design, software development, AI integration and ongoing product support. In this policy, “Arcforth”, “we”, “us” and “our” refer to that company.
This policy explains how we collect, use, disclose and retain personal information when you visit our website (thearcforth.com), contact us, discuss a project, become a client or interact with our business services. It also explains our role when we handle information on behalf of a client.
It does not replace the privacy notice of a client’s application or a separate notice for a particular Arcforth product. A client’s users should consult that client’s privacy notice for the purposes and rules governing their information.
2. Our role with client information
For website enquiries, sales communications, contracts, billing and business administration, we decide why and how personal information is used and act as the responsible organisation or controller, as applicable.
When a client engages us to develop, host, integrate, test or support its product, we may handle personal information under that client’s instructions as a service provider or processor. The client remains responsible for its processing purposes, appropriate notices, lawful authority and permissions. Our obligations are governed by the applicable services agreement and data processing agreement.
If your information is held in a client product, contact that client first to exercise your rights. We will assist the client as required by our agreement and applicable law. A client agreement cannot override rights or obligations imposed by law.
3. Information we may collect
Depending on your interaction, we may collect your name, work email, telephone number, job title, company, location and communication preferences; enquiry details, project briefs, requirements, attachments and correspondence; and contract, invoice, payment confirmation and transaction information.
Website or service systems may collect IP addresses, browser and device details, pages visited, timestamps, referral information and technical or security logs. The specific information depends on the systems enabled.
Client projects may involve account and authentication records; customer, employee, candidate, applicant, referee or tenant information; property and tenancy records; business contact and CRM records; messages, support tickets and notification history; identity or verification documents; transaction and billing records; location information; uploaded photographs, video, audio, transcripts and documents; analytics, activity logs and AI inputs or outputs. We process only the categories required for the agreed service. These examples do not mean that every visitor or client supplies every category.
Please do not send sensitive information, identity documents, payment credentials or live production datasets through a general enquiry form. Where a project requires sensitive or regulated information, the scope, access and handling arrangements should be agreed separately.
4. Where information comes from
We receive information directly from you, from authorised client representatives and project users, through connected services that you or the client authorise, and from technical interactions with our systems.
For relevant business outreach, we may use professional information from public business websites, professional profiles, referrals or business data providers. We use such information subject to applicable law and honour requests to stop marketing. A public profile alone does not establish consent for every use.
If a meeting is recorded or transcribed, we will provide notice and obtain permission where required before doing so.
5. How and why we use information
We use information to respond to enquiries, understand requirements, prepare proposals, manage engagements, deliver and support projects, organise meetings, manage accounts and billing, prevent misuse, investigate technical issues and comply with legal obligations.
We may use business contact information for relevant service updates or marketing where permitted. You can object to marketing or unsubscribe using the instructions provided or the contact details below. Essential contractual and service communications may continue.
Where applicable law requires a lawful basis, we rely on an appropriate basis such as consent, steps requested before entering a contract, contractual performance, legal obligations or legitimate interests where that basis is available. Legitimate interests may include managing business relationships and securing our services. We do not treat use of our website as blanket consent. Where consent is required, we obtain it for the relevant purpose.
6. AI tools and automated processing
Our services may use AI tools to assist with requirements, design, development, testing, analysis or other agreed workflows. This may include chat or voice assistants, transcription, document extraction, image processing and recommendations. If personal information is supplied to an AI provider, that provider may process it to return the requested output. The permitted provider, purpose and data scope for client information must follow the client agreement and instructions.
We will not use client personal information to train our own general purpose AI models without separate documented authorisation and any legal permissions required. Third party providers’ retention and model training settings depend on the selected service and account configuration; these must be checked before sending client information.
We aim to limit inputs to information necessary for the task, using synthetic, redacted or deidentified data where feasible. AI output can be inaccurate and should be reviewed before consequential use. Client systems involving recruitment, scoring or other decisions affecting individuals require their own notices, review arrangements and legal assessment.
7. Cookies and similar technologies
Our website may use cookies or similar technologies for essential functions, preferences, measurement or marketing, depending on what is enabled. Where required, nonessential technologies will operate only after your consent. Declining or withdrawing optional consent should not prevent access to essential website functions.
You can manage cookies through browser settings and, where available, our consent controls. Blocking essential cookies may affect functionality. The website’s cookie notice or settings should identify the actual providers, purposes and durations in use.
8. Who may receive information
We may share necessary information with authorised staff and contractors; hosting, communication, collaboration, analytics, AI, payment and other service providers; and professional advisers assisting with legal, accounting or business matters. Access is limited to relevant purposes and subject to appropriate obligations.
We may disclose information where lawfully required, to protect rights and security, or in connection with a business restructuring or transfer, subject to applicable safeguards. We do not sell personal information. Client information is disclosed to service providers only as permitted by the applicable agreement and law.
External sites, client applications and third party services have their own privacy practices. Their notices apply to processing for which they are independently responsible.
9. International processing
Arcforth operates from India and serves clients in other countries. Information may be accessed or processed in India and in locations used by authorised service providers. We do not promise that all information stays in a particular country unless that is expressly agreed.
Where applicable law restricts international transfers, we use the required transfer arrangements and safeguards. These may include contractual protections and, where relevant, approved standard contractual clauses. Any agreed client data residency requirements must be reflected in the project’s infrastructure and provider arrangements.
10. Retention and deletion
We retain personal information for as long as needed for the stated purpose, applicable contractual obligations, legal recordkeeping, security or resolving disputes. Retention depends on the record type and context; information is not kept indefinitely merely because it was collected.
Client project information is returned or deleted in accordance with the client agreement and instructions, subject to applicable legal requirements. Backup copies may remain until the applicable backup cycle expires and should be protected against routine use. Records required by law or needed for legitimate legal claims may be retained for the relevant period.
11. Security and incident handling
We use reasonable organisational and technical measures proportionate to the information and service, including appropriate access restrictions and secure handling. The controls used for an individual client environment depend on the agreed architecture and service scope. No system is entirely risk free.
If a personal information incident occurs, we will investigate and take appropriate corrective action. We will notify affected clients, individuals or authorities when required by applicable law or contract. This policy does not represent that Arcforth holds any particular security certification.
12. Your choices and rights
Depending on applicable law and our role, you may request access, correction, deletion, restriction, portability, withdrawal of consent or objection to certain processing. You may also have rights to raise a grievance, nominate another person or complain to the relevant authority where those rights apply and are in force.
Contact us using the details below. We may ask for proportionate information to verify your identity and clarify the request. We will respond within the applicable legal period and explain any lawful limitation. Withdrawing consent does not affect processing already lawfully completed and may prevent us from providing a service that requires the information.
13. Children
Our corporate website and business services are directed to adults and business representatives. We do not knowingly seek personal information from children through general enquiries. If you believe a child has provided information, contact us.
Where a client product is intended for children or may process their information, age controls, parental permissions and other required protections must be addressed in the project agreement and that product’s privacy notice before processing begins.
14. Client project access and environments
Our work may require access to client applications, databases, source repositories, cloud accounts, backups and connected services. Personal information encountered through those systems is subject to the same purpose limits as information supplied directly. Project access should be authorised, limited to the people and permissions needed, and removed when no longer required.
Production data should not be copied into development, demonstrations or testing merely for convenience. Synthetic or deidentified datasets should be used where feasible. If identifiable data is necessary, the client must authorise the purpose, environment, access and retention. Removing a name alone does not necessarily make a dataset anonymous.
Passwords, API keys, access tokens and other secrets must be handled through appropriate secure channels and storage. They should not be placed in public repositories, ordinary enquiry forms, shared screenshots or AI prompts. On handover or termination, access and credentials should be revoked or rotated as appropriate to the agreed responsibilities.
15. Sensitive records and connected workflows
Projects involving identity documents, health information, financial records, recruitment information, precise location, children’s information or biometric identification require an assessment of the applicable protections before processing. Ordinary photographs or recordings are not automatically biometric identifiers; their use for identification may introduce additional obligations.
Payment integrations may involve transaction references, payment status and billing details. Payment credentials should be collected through the authorised payment provider’s appropriate flow rather than supplied to Arcforth through general communications. Any project requiring direct handling of payment credentials needs separately agreed controls.
Where agreed services include email, messaging, voice calls, call recordings, transcription, CRM synchronisation or notifications, processing is limited to the authorised workflow. The client is responsible for establishing the relevant notices, permissions and communication rules. Arcforth’s own business communications remain subject to the purposes and choices described in this policy.
Images, video and recordings may contain information about bystanders or other people. Clients should establish the lawful authority for collection and use, including required recording notices. We do not treat client access to a dataset as permission to reuse it for unrelated purposes.
16. Confidentiality and limits on reuse
Client project information is used to deliver the agreed services and fulfil applicable obligations. We will not publish identifiable client user information in portfolios, case studies, social posts or public demonstrations without documented authorisation and any required permissions. A client’s permission to use its logo does not authorise disclosure of its users’ information.
We will not reuse one client’s identifiable personal information for another client’s project or combine client datasets for unrelated profiling without a separately established lawful purpose and documented authorisation. Confidential commercial information, source code and intellectual property are also governed by the applicable confidentiality and services agreements.
Where information is described as aggregated or anonymous, it must not reasonably identify an individual in context. Pseudonymised records remain personal information where they can be linked back to a person.
17. Providers, requests and project closure
Providers that process client personal information on our behalf should be subject to appropriate confidentiality, security and processing obligations. Where client authorisation or notice is required for a new subprocessor, it must be obtained or provided before the relevant processing. Provider information and agreed processing locations should be available through the project documentation.
We assist clients with relevant privacy requests, incident investigations and compliance information within the agreed service scope and applicable legal requirements. We do not independently grant access to client datasets to someone claiming to be a user; requests are verified and coordinated with the responsible client unless law requires otherwise.
On project completion or termination, the agreement should specify data export or return, deletion, access removal, backup handling and any continuing support responsibilities. Information retained for legal requirements or claims remains protected and limited to those purposes. Where deletion confirmation is agreed or required, we provide it in the form appropriate to the systems and scope concerned.
18. Contact and privacy grievances
Responsible organisation: Scoredile Technologies Private Limited, trading as Arcforth.
Website: thearcforth.com
Privacy email: official@thearcforth.com
Use the subject “Privacy request” or “Privacy grievance” and explain your concern without including unnecessary sensitive information. We will acknowledge and address grievances within the periods required by applicable law. You may also contact a competent regulator where applicable.
19. Changes to this policy
We may update this policy to reflect changes in our services, practices or legal obligations. The published version will show its effective date. Where required, we will give additional notice or seek new consent for a material change. Updated wording does not authorise an incompatible use of information collected previously.
