Privacy policy

Who operates Arclore Voice

Arclore Voice is operated by Raveesh Chandra, sole proprietor trading as Arclore, India. For privacy questions or requests, contact privacy@arclorevoice.com. Your organization may also have its own employee privacy notice and obligations.

Information processed and why

• Employee feedback: feedback text, category, optional priority, area and organization scope, response preference, company association, and database identifiers and submission timestamps. These support workplace feedback collection and company-specific reporting. Free text can include personal information about you or others.
• AI analysis: feedback text and selected context are sent to an AI service. Outputs include categories, themes, sentiment, urgency, summaries, recommendations, escalation flags and confidence values. Analysis records are linked to feedback and include model/version information.
• Employer access: invited email address, Auth user and session identifiers, company membership, role and status, authentication/session information and revocation records are used to control employer access. Sign-in uses email one-time codes.
• Technical information: hosting, authentication, database, email and AI providers may process IP addresses, request times, browser/device information and operational metadata. Employer rate limiting uses hashed IP/email buckets; hashing does not make this information necessarily anonymous.
• Privacy correspondence: information you choose to send to the privacy contact is used to review and respond to your request.

Who receives information

The current application uses Cloudflare for hosting and infrastructure, Supabase for database and authentication services, OpenAI for feedback analysis, and configured SMTP email delivery, currently Zoho. Arclore’s operator may need access to stored information for service operation and handling requests.

Authorized employer users receive company-scoped metrics, themes, sentiment, urgency, AI summaries and reports for human review. The current dashboard does not display raw feedback text, but summaries can retain identifying context. Stored feedback is still processed by Arclore and its providers. There is no guarantee that a submission cannot be attributed to an individual.

Provider processing can occur outside India, depending on regions, routing and contractual settings. Information may also need to be disclosed where applicable law requires it.

Operator review: confirm provider agreements, actual regions, subprocessors, AI training/data-use settings, provider retention and backup/log settings, and applicable cross-border requirements. These have not been verified by this notice.

Cookies and browser behavior

Employer sign-in uses Secure, HttpOnly, SameSite=Lax cookies for access, refresh and CSRF protection. The application enforces an absolute eight-hour maximum employer session and server-side logout revocation. Signing out or expiry does not delete feedback, analysis or provider records.

The employee form keeps unfinished entries in page memory and does not require an employee account. It does not provide an employee account for recovering unfinished entries or requesting deletion through the form. Infrastructure providers may separately process technical metadata. The current reply feature is inactive even when a response preference is selected.

Retention and deletion

The proposed 90-day automatic deletion process is not yet active. The operator has approved a proposed retention period of 90 days for employee feedback and associated AI analysis, measured from feedback creation time. This is an intended policy, not a deletion deadline or a statement that records are currently removed after 90 days. Until a deletion process is activated and verified, feedback and analysis may remain stored beyond that period.

Stored reports may contain summaries and other information derived from feedback. Before automatic deletion can begin, the operator must verify which feedback those reports contain and how related information will be removed. The proposed process is intended to run on the server; it does not depend on employees reopening the form.

Deleting records from the active application database is separate from retention in provider backups, logs, AI-provider systems and any exports. Authentication records, any billing records and privacy-request correspondence also have separate purposes and retention arrangements. Their applicable periods and deletion procedures have not yet been verified. The proposed 90-day period does not promise erasure from every system or backup.

Operator verification required: finalize report coverage, activate and verify scheduled deletion, and document the separate retention and deletion arrangements above before presenting the 90-day process as operational. No deletion deadline is promised in this notice.

Privacy requests and security

Contact privacy@arclorevoice.com about access, correction, deletion, objections or other privacy concerns. Tell us which organization and approximate submission time are involved, without sending unnecessary sensitive information, passwords or sign-in codes. An account-free submission may be difficult to locate or verify; the displayed reference alone may not identify a stored record. The operator reviews requests, seeks only the information needed to locate records and verify authority, and considers the relevant organizational arrangements and applicable obligations. Earlier deletion can be requested, but no authenticated employee self-service deletion feature or particular deletion outcome is provided.

The implementation includes employer authentication, membership checks, company-scoped reads, protected cookies and session revocation. These controls do not guarantee anonymity, confidentiality or protection against every security incident. No certification or legal-compliance status is claimed.

Operator review: finalize operator/organization responsibilities, applicable legal grounds and notices, request and grievance procedures, incident handling and any required business/contact disclosures before production use.

Changes and contact

This revision is dated 12 October 2026 and remains subject to the operator verification items above. The notice should be updated when processing or retention arrangements change; an effective publication date remains to be approved. Privacy contact: privacy@arclorevoice.com.

Employees should also read the employee privacy notice.