Privacy Policy

Policy version: 2026-10-17-v1.0

1. Contact and scope

This notice describes the account, quote, order and Studio features of ONE ARCYS Custom Apparel. Contact insight@onearcys.com to ask about your information or exercise an applicable privacy right. We verify the requesting person's authority without asking for unnecessary information. Never send a password or card security code by email.

2. Information used to provide the service

We process contact and account details, password hashes, quote and order records, garment choices, artwork, Studio designs and revision history, and the delivery information needed for an order. We also use necessary session identifiers and technical security records to operate and protect the service. Where payment is available, Stripe handles card details; our order system retains the payment identifiers, status and transaction references needed to reconcile the order. We do not store full card numbers or CVV.

3. Service providers and your artwork

Hosting and database providers support the website; email providers process transactional messages. Shipping information is shared with the selected USPS or UPS service as needed to fulfill an accepted order. When enabled and chosen by you, AI generation sends the design instructions and selected reference images to the configured OpenAI API. Stripe processes an enabled online payment. These providers receive the information needed for their respective services, subject to the applicable arrangements and their own requirements. We do not reuse customer artwork to train an AI model without specific permission and do not publish it as a portfolio or testimonial without authorization.

4. Necessary storage and optional analytics

Necessary browser storage supports your cart, sign-in, Studio continuity and privacy choices. A protected Studio cookie may last up to 180 days; signing in can connect authorized guest projects to your account. Unsaved Studio changes may remain in this browser for recovery for up to 7 days, with expired copies removed when Studio opens. Privacy choices last up to 180 days. Optional first-party analytics runs only with the applicable consent and uses opaque identifiers to measure visits, product choices, Studio interactions and quote activity without contact details, design text, artwork or filenames. You can change your choices through Privacy preferences in the footer. Withdrawal stops future optional tracking and does not itself erase earlier records. Newsletter collection, GA4, Meta Pixel and Google Ads tracking are disabled for phase 1.

5. Retention policy and current processing

Our retention targets are 18 months after the last activity for quotes that did not become orders; 24 months for inactive accounts without orders; and deletion on an authenticated request or after 24 months of inactivity for artwork not needed for an order. Necessary order, invoice and payment-document records are retained for 7 years or a different period required by law. The target for security logs is 90 days, except active incidents or investigations. Recovery backups follow a 30-day rotation target. Optional analytics has a 30-day retention policy. We minimize the fields kept for tax, dispute and other required records.

Scheduled removal is not currently automatic across every record category. Retention cleanup and deletion requests require verified, recorded processing, and some protected order or revision records may need to be retained. Removing a Studio draft from the active list does not necessarily erase its revision history or linked order material. We do not describe a draft removal or an account request as immediate deletion of every server copy.

6. Requests and exceptions

Request access, correction or deletion through your authenticated account where supported or by emailing insight@onearcys.com. After verifying your authority, we review which data can be removed or anonymized, explain lawful retention exceptions and record the action. Our internal response target is 30 days after verification, subject to a stricter applicable deadline or lawful extension. A deletion does not immediately rewrite historical recovery copies; applicable deletion decisions must be respected as backups expire or are restored.

7. Access and security

Access controls, session protections, CSRF checks, upload type and size validation, private artwork storage and password hashing help protect records. Production access requires HTTPS and restricted operational access. No security statement is a promise that every risk can be eliminated. Contact insight@onearcys.com about a suspected account or information issue.