ArcWealth / Legal

Privacy Notice for Parents and Guardians

What ArcWealth holds about you as a guardian, and how you can manage your child's data.

Last updated: 7 October 2026

You are reading this because a student gave your email address when registering for ArcWealth, or because you want to know how ArcWealth handles your child's data. This notice explains what we hold about you as a guardian and what you can do about your child's account. It is given under Articles 13 and 14 of the GDPR.

Our full Privacy Policy covers everything we collect about students.


Who we are

ArcWealth is run by Asociaţia Marom Initiative, a non-profit association registered in Romania (registration number [INSERT], registered office [INSERT REGISTERED ADDRESS]). We are the controller of the personal data described here.

Contact us at privacy@arcwealth.net.


Why you received an email from us

For students in certain grades (grades 9 to 12, Years 9 to 12, MYP 4 and 5, and IB or DP years 1 and 2), ArcWealth asks for a parent or guardian to approve the account. The student entered your email address during registration, and that is how we got it. We did not obtain it from anyone else.

We sent you a secure link and a 6-digit code. Using both, you can review the Parental Agreement and approve the account. The student cannot use the account until you do.

If you do not recognise this registration, you do not need to do anything. The account stays unusable. You can also email privacy@arcwealth.net and we will delete it.


What we hold about you

DataWhere it comes fromWhy we have it
Your email addressThe student entered it at registrationTo send you the approval request and any later notices about the account
Your nameYou enter it when you approveTo record who approved the account
The date and time of approval, and the version of the agreement you approvedCreated when you approveTo keep a record that approval was given
A hashed (scrambled) copy of the link and code we sent youCreated when we email youTo check that the person approving controls your email address

We do not use your email address for marketing, and we never sell it or share it with advertisers.


We process your details to set up and run your child's account, which needs your authorisation because your child is a minor (GDPR Article 6(1)(b), performance of a contract). We also have a legitimate interest in being able to show that a guardian approved the account (Article 6(1)(f)).


Who we share it with

  • Resend (Plus Five Five, Inc.) sends our emails, including the approval email to you. Resend stores email records (recipient, subject, delivery status) in the United States, protected by the European Commission's Standard Contractual Clauses and the EU-US Data Privacy Framework.
  • Supabase Inc. hosts our database in Dublin, Ireland (EU).
  • Vercel Inc. hosts the website in Dublin, Ireland (EU).

Supabase and Vercel are US companies that may access data from outside the EU for support or security. Standard Contractual Clauses protect any such access.


How long we keep it

  • Approval link and code: the link expires after 7 days. Expired or used links and codes are automatically deleted 30 days later.
  • Your email address and approval record: kept for as long as your child's account exists, so that we can show the account was properly approved. They are deleted when the account is deleted.

Your rights, and your rights over your child's account

You have the right to access, correct or delete your own data, to restrict or object to how we use it, and to receive a copy of it.

As a parent or guardian, you can also ask us to:

  • show you the data we hold about your child
  • correct it
  • delete your child's account and data
  • restrict how your child's data is used, or turn off social features such as leaderboards

Email privacy@arcwealth.net from the email address we contacted you on. We will reply within one month. Using these rights is free.

If you are unhappy with how we handle data, you can complain to the Romanian data protection authority, ANSPDCP (B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest; anspdcp@dataprotection.ro; www.dataprotection.ro), or to the authority in your own EU country.