PRIVACY POLICY

Last updated: February 2026

At OnArcher, we take your privacy seriously. This Privacy Policy describes how we collect, use, store, and protect your personal information when you use our SBA loan pre-qualification platform and services.

1. Information We Collect

Information You Provide
• Account Information: Name, email address, phone number, password
• Business Information: Company name, EIN, business address, industry, years in operation
• Financial Information: Revenue, expenses, existing debt obligations, credit score
• Documents: Tax returns, financial statements, bank statements, and other documents you upload
• Communications: Conversation history with ARCHI and any messages you send us

Information Collected Automatically
• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages visited, features used, time spent on platform, click patterns
• Log Data: Server logs, error reports, and access timestamps
• Cookies: Session cookies, preference cookies, and analytics cookies

2. How We Use Your Information

We use your information for the following purposes:
• Service Delivery: Process your pre-qualification application and calculate DSCR
• Lender Matching: Match appropriate SBA lenders based on your profile
• Communication: Send application updates, respond to inquiries, and provide customer support
• AI Improvement: Train and improve ARCHI’s responses and recommendations
• Security: Detect and prevent fraud, abuse, and security threats
• Analytics: Understand how users interact with our platform to improve our services
• Legal Compliance: Comply with applicable laws, regulations, and legal requests

3. Information Sharing

We may share your information in the following circumstances:
• With SBA Lenders: When you accept a pre-qualification and choose to proceed with a loan application
• Service Providers: Third-party vendors who help us operate our platform (hosting, analytics, customer support)
• Legal Requirements: When required by law, subpoena, or legal process
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you explicitly authorize us to share your information

We do NOT sell your personal information to third parties.

4. Data Security

We implement robust security measures to protect your information:
• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Strict role-based access controls for all employee access
• Secure Storage: Documents stored in SOC 2 compliant data centers
• Regular Audits: Periodic security assessments and penetration testing
• Employee Training: Mandatory security and privacy training for all staff

5. Data Retention

We retain your information for as long as necessary to provide our services and comply with legal obligations:
• Active Accounts: Information retained while your account is active
• Completed Applications: Records retained for 7 years per financial services regulations
• Account Deletion: Personal data deleted within 30 days of account deletion request
• Anonymized Data: Aggregated analytics data may be retained indefinitely

6. Your Privacy Rights

You have the following rights regarding your personal information:
• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Portability: Receive your data in a structured, machine-readable format
• Opt-Out: Unsubscribe from marketing communications at any time
• Restrict Processing: Request limitation of processing in certain circumstances

To exercise these rights, please contact us at privacy@onarcher.com.

7. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete your information, and the right to opt-out of the sale of personal information. As noted above, we do not sell personal information.

8. Cookies and Tracking

We use cookies and similar technologies to:
• Keep you logged in to your account
• Remember your preferences and settings
• Analyze how you use our platform
• Improve our services based on usage patterns

You can control cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of our Services.

9. Children’s Privacy

Our Services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on our platform and updating the “Last updated” date. We encourage you to review this Privacy Policy periodically.