Last updated: 7 October 2026
This policy explains what personal data ArcWealth collects, why we use it, who we share it with, how long we keep it, and the rights you have. It applies to the ArcWealth website and app at arcwealth.net (the "Services").
ArcWealth is a financial literacy platform for secondary-school students, their teachers and their schools. Many of our users are under 18, so we have tried to write this policy in plain language. If anything is unclear, email privacy@arcwealth.net and we will explain it.
A separate, shorter notice for parents and guardians is available at arcwealth.net/guardian-privacy-notice.
1. Who we are
ArcWealth is run by:
- Asociaţia Marom Initiative, a non-profit association registered in Romania
- Registration number: [INSERT REGISTRY OF ASSOCIATIONS AND FOUNDATIONS NUMBER AND CIF]
- Registered office: [INSERT REGISTERED ADDRESS]
- Privacy contact: privacy@arcwealth.net
- General support: support@arcwealth.net
Asociaţia Marom Initiative is the controller of your personal data. That means we decide why and how your data is used, and we are responsible for protecting it.
We have not appointed a Data Protection Officer, because the law does not require one for our activities. All privacy questions go to privacy@arcwealth.net.
When a school uses ArcWealth. A school can sign a written agreement with us that makes the school the controller for its students' accounts and us its processor. If your school has done this, the school decides how your data is used, and we follow its instructions. Ask your school, or email us, if you want to know which arrangement applies to you.
2. What data we collect
We only collect what we need to run the Services. We do not collect your date of birth, home address, phone number, photo, gender or location.
2.1 Information you give us when you register
- Email address and password. We store only a scrambled (hashed) version of your password and can never see the original.
- First name and last name
- Username, which is shown in the app instead of your real name
- School and grade or year group
- A parent or guardian's email address, if your grade requires guardian approval (see section 6)
- Your role in the app (student or teacher)
2.2 Information created while you use ArcWealth
- Learning progress: lessons and textbook chapters completed, quiz scores, attempts and completion dates
- Game features: XP, level, rank, streaks, hearts and achievements
- Social features: friends, friend requests and leaderboard groups you create or join
- Classroom features: which teacher's class you are in, assignments, teacher messages, nudges and congratulations
- Settings: private profile on or off, game features on or off, preferred currency, and onboarding tutorial progress
- Certificates: we use your name to generate a certificate when you complete a module. The certificate is created when you ask for it and is not stored by us.
2.3 Security and account data
- Records of your login sessions and when they expire
- Single-use codes and links for email verification, password resets and guardian approval. We store only hashed versions.
- If you turn on two-step verification: an encrypted authenticator secret and hashed backup codes
- If you sign in with Google: your Google account ID, email address and name. We do not store your Google profile picture.
2.4 Technical data
- Cookies that keep you signed in and secure your login (see section 9)
- Browser storage for lesson review progress and your light or dark theme choice
- Server logs created by our hosting provider when your browser contacts our servers, including IP address, the page requested, the time and any error. Our own application logs do not record email addresses, codes or links.
- Rate limiting: to stop people guessing passwords or spamming requests, we briefly keep counters in server memory linked to an IP address, email or account ID. These counters are never written to our database and disappear within minutes to hours.
2.5 What we never do
- We do not sell personal data or share it with advertisers or data brokers.
- We do not show adverts.
- We do not use third-party analytics or tracking tools.
- We do not make decisions about you that have legal or similarly significant effects using automated processing alone.
3. Why we use your data and our legal basis
Under data protection law (GDPR Article 6) we need a legal reason, called a "legal basis", for each way we use your data.
| What we do | Why | Legal basis |
|---|---|---|
| Create and run your account, sign you in | To give you the Services you signed up for | Performance of a contract (Art. 6(1)(b)) |
| Deliver lessons, track progress, award XP and certificates | This is the core educational service | Performance of a contract (Art. 6(1)(b)) |
| Ask a parent or guardian to approve accounts for students in certain grades | Minors in Romania need a parent's or guardian's agreement to enter into contracts, and guardians should know about their child's account | Performance of a contract (Art. 6(1)(b)), with guardian authorisation |
| Leaderboards, friends and groups | To motivate learning. You can switch these off at any time (section 5). | Legitimate interests (Art. 6(1)(f)) |
| Classroom features for your teacher | To let teachers support their students | Performance of a contract (Art. 6(1)(b)). Where a school has signed an agreement with us, the school's own legal basis (often a task in the public interest, Art. 6(1)(e)) |
| Send account emails (verification, password reset, guardian approval, classroom notifications) | These emails are needed to run your account | Performance of a contract (Art. 6(1)(b)) |
| Keep the Services secure, prevent abuse, keep server logs | To protect you and the platform | Legitimate interests (Art. 6(1)(f)) |
| Respond to legal requests and keep records the law requires | To comply with Romanian and EU law | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have checked that our interests do not override your rights. You can object to this use at any time (section 8).
Do you have to give us this data? You need to provide the registration details in section 2.1 to create an account, because we cannot run an account without them. Everything else is optional or created as you use the app.
4. Who can see your data
4.1 Inside ArcWealth
- Other students at your school can see your username, XP and rank on the leaderboard, and your public profile, unless you make your profile private or turn game features off. Leaderboards and public profiles are limited to people at your school.
- Your friends and group members can see that you are connected and your leaderboard position within shared groups.
- Your teacher can see the progress and classroom activity of students in their class.
- ArcWealth administrators can access accounts when needed to support you, fix problems or keep the platform safe. Access is limited to the small number of people who need it.
Classroom messages are free text. Please do not share sensitive information (for example health details) in them.
4.2 Service providers we use
We use a small number of service providers, called processors, to run ArcWealth. Each one has signed or accepted a data processing agreement with us that only allows them to use your data to provide their service to us.
| Provider | What it does | Where your data is processed |
|---|---|---|
| Vercel Inc. | Hosts the website and app, and creates server logs | Our application runs in Vercel's Dublin, Ireland (EU) region. Vercel is a US company and may access data from outside the EU for support and security. |
| Supabase Inc. | Hosts our database | Our database is located in Supabase's Dublin, Ireland (EU) region. Supabase is a US company and may access data from outside the EU for support and security. |
| Resend (Plus Five Five, Inc.) | Sends account and classroom emails | Emails are sent through Resend's infrastructure. Resend stores email records (recipient, subject, delivery status) in the United States. |
These providers use their own sub-processors, which they list publicly and bind to the same protections.
4.3 Google sign-in
If you choose "Sign in with Google", Google confirms your identity and sends us your Google account ID, email address and name. Google acts as a separate controller for your Google account, under Google's Privacy Policy. You can always use an email and password instead.
4.4 Legal reasons
We may disclose data if the law requires it, for example in response to a valid court order, or to protect someone's safety.
4.5 If the organisation changes
If ArcWealth is transferred to another organisation, your data would move with it only under the same protections described here, and we would tell you first.
5. Your privacy controls in the app
You can do the following yourself in Settings → Security:
- Make your profile private to remove yourself from leaderboards and hide your profile
- Turn off game features (XP, streaks, ranks, leaderboards and friends). Your lessons and progress still work.
- Download your data as a file (up to 3 times in 24 hours)
- Delete your account (see section 10)
- See and sign out of your active sessions
- Turn on two-step verification
6. Children and guardian approval
ArcWealth is designed for secondary-school students, many of whom are under 18.
- When you register, you choose your grade or year group. For grades 9 to 12, Years 9 to 12, MYP 4 and 5, and IB or DP years 1 and 2, we ask for a parent or guardian's email address.
- We email the guardian a secure link and a 6-digit code. The guardian uses both to approve the account. Until the guardian approves, the student cannot use the account.
- Guardian links expire after 7 days. The student or guardian can ask for a new one.
- Parents and guardians can ask us to see, correct or delete their child's data, or to restrict how it is used. Email privacy@arcwealth.net.
Our notice for parents and guardians explains what we collect about guardians themselves: arcwealth.net/guardian-privacy-notice.
7. International transfers
We keep our application and database in the EU (Dublin, Ireland). Some processing still happens outside the European Economic Area:
- Resend stores email records in the United States.
- Vercel and Supabase are US companies and may access data from the United States for support, security or legal reasons.
To protect your data when this happens, we rely on the European Commission's Standard Contractual Clauses, which are included in each provider's data processing agreement. Resend is also certified under the EU-US Data Privacy Framework. You can ask us for a copy of these safeguards at privacy@arcwealth.net.
8. Your rights
Under the GDPR you have the right to:
- Access your data and get a copy of it. You can download most of it yourself in Settings → Security.
- Correct data that is wrong or incomplete
- Delete your data ("right to be forgotten")
- Restrict how we use your data, for example while we check a complaint
- Object to uses based on legitimate interests (section 3)
- Data portability, meaning you receive your data in a machine-readable format (the download is a JSON file)
- Withdraw consent at any time, where we rely on consent
To use any of these rights, email privacy@arcwealth.net from the email address on your account. If you write from another address, we may need to check it is really you. We will reply within one month. For complex requests the law allows us up to two further months, and we will tell you if we need it. Using your rights is free.
Complaints. If you are unhappy with how we handle your data, please contact us first so we can try to fix it. You also have the right to complain to the Romanian data protection authority:
Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania anspdcp@dataprotection.ro · www.dataprotection.ro
If you live in another EU country, you can also complain to the authority in your country.
9. Cookies and browser storage
When you first visit, a banner asks you to allow the cookies that are needed to sign in. We only use cookies that are necessary for the Services to work. We do not use advertising or analytics cookies.
| Cookie | What it does | How long it lasts |
|---|---|---|
arc_cookie_consent | Remembers your cookie choice | 400 days |
arcwealth_session | Keeps you signed in | Up to 30 days |
oauth_google_state, oauth_google_cv | Protect the Google sign-in process | About 10 minutes |
arcwealth_2fa_pending | Holds a sign-in in progress while you enter a two-step code | A few minutes |
arcwealth_totp_enroll | Holds setup progress while you turn on two-step verification | A few minutes |
Sign-in cookies are only set after you allow them in the banner. Without them you can browse public pages but cannot sign in.
We also use your browser's local storage to remember your lesson review list and your theme choice. This stays on your device.
To change your choice, clear the cookies for arcwealth.net in your browser settings and reload the page. The banner will appear again.
10. How long we keep your data
| Data | How long we keep it |
|---|---|
| Account, profile, learning progress, XP, achievements, friends, groups | Until your account is deleted |
| Classroom links and records | Until the student is removed from the class or the account is deleted |
| Verification, password reset and guardian approval codes and links | Verification codes expire after 24 hours, reset links after 1 hour and guardian links after 7 days. Expired or used ones are automatically deleted 30 days later. |
| Login sessions | Up to 30 days, then automatically deleted |
| Rate-limiting counters | Minutes to hours, in memory only |
| Server logs (Vercel) | A short period set by Vercel for our plan, then automatically deleted |
| Email records (Resend) | According to Resend's retention settings, then automatically deleted |
| Database backups (Supabase) | Removed when the backup rotates out on Supabase's backup schedule |
| Data downloads you request | Created on demand and not stored by us |
Deleting your account. In Settings → Security, choose Delete account. We delete your account and everything linked to it straight away. Copies in backups disappear when those backups expire.
If you are in a class. While you are on a teacher's class list, self-service deletion is paused so the class records stay accurate. Your teacher can remove you from the class (Classroom → Students → Remove from class), and then you can delete your account. You, your parent or guardian, or your school can also email privacy@arcwealth.net and we will handle the deletion for you, within one month.
We may keep limited information for longer only where the law requires it, for example to deal with a legal claim.
11. How we protect your data
- All connections use encryption (HTTPS).
- Passwords, codes and links are stored only in hashed form. Two-step verification secrets are encrypted.
- Our database can only be reached by our servers, and staff access is limited to people who need it.
- Our hosting and database providers hold independent security certifications (SOC 2 and ISO 27001).
- We have a written plan for handling security incidents. If a breach puts your rights at risk, we will tell the Romanian data protection authority within 72 hours and tell you without undue delay where the law requires it.
No system is completely secure. Please use a strong, unique password and keep it private.
12. Changes to this policy
When we update this policy, we change the "Last updated" date. If a change significantly affects how we use your data, we will tell you in the app or by email before it takes effect.
13. Contact
- Privacy questions and requests: privacy@arcwealth.net
- General support: support@arcwealth.net
- Post: Asociaţia Marom Initiative, [INSERT REGISTERED ADDRESS]