Privacy

What this covers

This notice covers My Private Arc: the website, the installable app and the services that belong to them. It explains which information is processed, why, for how long, and what you can require.

It is written to be checked. Where something is a technical limit, it is stated as a limit and not as a promise.

Data controller

LexiCo AS is the controller for the personal data described here. Registration number: 937 155 344. Business address: Trolltorødveien 18, 3140 Nøtterøy. Any partner profile is visual branding and grants the partner no archive access. The linked partner name and code are account metadata included in personal data export. The link is removed when an account is closed after its last member leaves.

Encryption and optional exceptions

Without an enabled vault, archive storage is zero-knowledge, subject to the separate AI exception below: images, documents, descriptions, categories, prices, relationships and travel information are encrypted on your device before they are sent for storage. The server stores encrypted content, hashes and necessary metadata. Your archive key never leaves the device in plaintext. We cannot read or recover the encrypted archive without the key.

Local image analysis is the default. AI analysis is a limited exception: after separate consent for one to three selected images of the same object, copies without camera metadata are sent through our server to OpenAI. Images and the analysis are processed temporarily in server memory and are not written to server files, databases or logs. The consent version, user, account and time are recorded as an audit event without images or analysis content.

We ask OpenAI not to store the analysis response for later retrieval. This is not a guarantee of zero retention by OpenAI; the provider's current API policies apply. Cloud analysis cannot read your archive key. The response is an editable suggestion without an appraisal and is stored only when you choose encrypted archive storage. Cancelling or discarding cannot recall images already sent.

The vault is off by default. With explicit consent, an additional encrypted key envelope is stored; with an enabled vault, LexiCo can technically open the archive. Recovery requires your request, email confirmation, a 48-hour waiting period and custodian approval. The vault restores access, not the old archive passphrase.

Vault (optional)

The vault is off by default and requires explicit consent per member and archive. Enabling it stores an additional archive key envelope encrypted with the public vault key. With the vault enabled, LexiCo can technically open the archive.

Recovery requires your request, email confirmation, a 48-hour waiting period and custodian approval. The vault restores archive access, not the old archive passphrase. Steps are recorded in the audit log without private archive content.

Withdraw consent by disabling the vault. This removes the active vault envelope; it does not immediately erase older backups. The vault does not authorise background analysis of your archive.

What we store about you

To operate your account, we store your email address, password hash, account and memberships, language, currency and theme, plus archive names and access information. Archive names and other platform metadata may be readable by the service; avoid sensitive information in such names.

We also store encrypted content and technical information such as size, hash, revision and time. Metadata may describe service use even though it does not reveal the full archive content.

Account processing is based on the agreement to provide the service. Security and auditing rely on legitimate interests. The optional vault and AI analysis require separate consent.

Email

Email is used for address confirmation, account password resets and applicable invitation and recovery workflows. Delivery uses Resend, which receives the recipient address and message. Archive passphrases are not sent in these messages.

Address confirmation normally lasts 24 hours and account password-reset links one hour. A link may have expired or already been used; request a new one through the appropriate feature. Other email workflows may have their own deadlines.

The delivery log records technical status and errors without storing message content, one-time links or tokens.

Proofs and timestamps

Sealing sends a hash to the timestamping provider, not the private content. The hash is a check value used to verify content integrity against the timestamp.

A valid proof binds a hash and time. It does not establish truth, physical existence, ownership or value. Check the provider and verification status of each proof.

Proofs and related audit history are retained as historical records in the service. Changes to an archive do not make old proofs apply to the new content.

Cookies and local storage

We use only the cookies the service needs to work: one for signing in, and a few that remember language, currency, mode and which account you are working in. We use no cookies for tracking, marketing or analytics.

The cookie that points at the active account is only a hint. Access is checked on the server on every request.

Your device also holds a local, decrypted index so the archive can be searched offline. It is cleared when you lock the archive or sign out.

Your rights

You may request access, correction and erasure of personal data, and restriction, objection or data portability where the conditions for those rights are met. You may withdraw consent to optional features. This does not recall processing already performed.

The Personal information area of your account provides export and account deletion. The export covers platform data such as accounts, memberships, preferences, archive and sharing metadata, proof metadata and audit events. It does not include readable archive photos, descriptions, prices or keys. Generate readable archive reports from content unlocked on your device.

Use the contact point below for other requests or questions. You may complain about processing to the Norwegian Data Protection Authority.

Retention and erasure

Account data is retained while the account is in use. Account deletion removes sign-in and the member’s key envelopes, including any vault envelope, and revokes the member’s sharing grants. An owner may need to transfer ownership before deletion is allowed.

If other members still have access, their shared archive data and keys may remain. When no active members remain, the account is deactivated and its recovery envelopes are removed. Deletion cannot recall reports, copies or keys already held outside the service.

Selected proof, sharing and membership events are retained with a pseudonymised actor. This is not the same as anonymisation or physical deletion of every row. Other audit events linked to the user are removed by the deletion workflow.

Backups may contain older data. This page does not specify a fixed deletion period for backups or other proof and audit history. Contact us for the current retention information; do not assume everything is removed immediately.

Questions

Send privacy questions and requests about your rights to privat@lexico.no. Data protection officer: not published yet. A detail marked as not published has not been provided; this does not mean that a formal assessment or approval has been completed.

Visits and technical traffic

We record route templates without URL parameters, time, HTTP status, response time, browser and device type, likely bots and estimated country for operations and usage statistics. IP addresses and signed-in identity links are removed after the configured short retention period (initially 7 days). Daily pseudonymous visit signatures and other technical statistics remain. Access requires a system administrator and fresh confirmation. Visitor IPs are not sent to the geodata provider. Archive contents, forms, codes and URL parameters are excluded.