Privacy Policy

Last updated September 29, 2026

We are Third Frontier Ventures Ltd. trading as Arcla (“we”, “us”, “our”), a company registered in England and Wales. We operate the Arcla sales enablement platform, which provides real-time AI coaching and conversation intelligence tools for sales teams.

This policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have over it. If you have any questions, please contact us at support@arcla.com.

1. Who this policy applies to

This policy applies to three groups:

Users: sales representatives, managers, and administrators who access the Arcla platform directly.
Visitors: people who visit our marketing website at arcla.com.
Third-party data subjects: people whose personal data is captured as part of a sales call processed by Arcla (for example, a prospect speaking with a sales representative). These individuals typically have no direct relationship with Arcla. If this applies to you, see section 9 below.

If you are a sales representative using Arcla as part of your employer’s subscription, your employer (the “Customer”) is the data controller for data processed within the platform on their behalf. Arcla acts as their data processor. Please also refer to your employer’s own privacy policy.

2. What data we collect

Account and profile data

When you register for or use Arcla, we collect your name, work email address, job title, and organisation name. If your employer sets up your account, we receive the information they provide.

Call and conversation data

The core function of Arcla is to listen to and analyse sales calls in real time. When you use the platform during a call, we process:

Audio from your call sessions (where recording is enabled)
Transcripts generated from that audio
Notes and annotations you create during or after calls
Call metadata such as duration, date, and connected platform (e.g. Zoom, Google Meet, Microsoft Teams)

Important: calls may include conversations with people who are not Arcla users (such as prospects and customers). You are responsible for ensuring that all parties to a call are aware of and have consented to any recording or AI analysis, in accordance with applicable law.

Usage and technical data

We collect information about how you use the platform, including feature interactions, session duration, browser type and version, IP address, and device information. We use this to operate, maintain, and improve the service.

Our error monitoring records replays of dashboard sessions when an error occurs, so that we can reproduce and fix faults. A replay may show content that was on screen at the time, including transcript and knowledge base content.

Integration data

If you connect Arcla to third-party tools such as Salesforce, HubSpot, Slack, or your video call platform, we receive data from those integrations as necessary to provide the service (for example, pulling in CRM records relevant to an active call).

3. How we use your data

We use your data to:

Provide the Arcla service by running real-time call coaching, surfacing scripts and playbooks, detecting questions, and generating AI-assisted responses.
Improve the platform by analysing aggregated usage patterns and model performance to make the product better.
Evaluate and improve the service. We do not train AI models on your calls. Arcla builds no models of its own: every speech recognition and language model we use is operated by a third-party provider listed on our sub-processor page. To improve the product we use aggregated usage patterns and transcripts from our own internal test environment, not customer call content. We do not use data obtained through Google Workspace APIs to develop or train generalised AI or ML models.
Note on our providers: generating live answers requires sending call transcript extracts to the AI and speech-to-text providers listed on our sub-processor page. None of them is engaged to train on your data. We are working through explicit zero-retention and no-training terms with each of them, and that work is not yet finished. If it matters to your procurement, contact us at security@arcla.com for the current position on each provider.
Communicate with you by sending product updates, support responses, and account notifications.
Ensure security by monitoring for abuse, fraud, and unauthorised access.
Meet legal obligations by retaining records as required by law.

We do not sell your personal data to third parties.

Advertising measurement on our marketing website (with your consent only)

We advertise Arcla on Google, Meta (Facebook and Instagram) and LinkedIn. To see whether those adverts work, and to show our adverts to people who have already visited arcla.com, we use measurement tags from Google, Meta and LinkedIn on the marketing website. They run only after you allow the marketing category in our cookie banner. Until then no tag loads, nothing is stored on your device, and nothing is sent to those companies. If you decline, nothing changes about how the site works.

When you allow it, each of those companies receives the pages you visit on arcla.com, the fact that you requested a demo, and the advert click identifier from the link you arrived on, together with the identifiers in the cookies listed in our Cookie Policy. Google also receives the same page views for analytics if you allow the analytics category. Separately, and without consent because it sets no cookie and uses no persistent identifier, Cloudflare Web Analytics measures page views and page loading performance on arcla.com in aggregate. Each company acts as an independent controller for what it does with that data on its own platform; their privacy policies describe that use.

When you request a demo and have allowed marketing, we also report that signup to Meta and LinkedIn from our own servers, sending a one-way hash of your email address rather than the address itself, so the conversion is counted once even if your browser blocked the tag. We do not use call data, transcripts or anything from inside the platform for advertising, and we do not run advertising tags on the dashboard.

If you are in the UK or European Economic Area, we rely on the following legal bases:

Contract: processing necessary to provide the service you or your employer has contracted for.
Legitimate interests: improving the platform, ensuring security, and communicating about the service.
Legal obligation: where we are required to retain or disclose data by law.
Consent: where we have asked for and you have given consent (for example, for optional analytics, and for advertising measurement on our marketing website).

We share your data only as necessary to provide the service:

Sub-processors: we use third-party service providers for infrastructure, call capture, speech-to-text, AI processing, analytics, and customer support. See the section below.
Advertising platforms: with your consent, Google, Meta and LinkedIn receive the marketing website activity described in section 3. They are not sub-processors for this purpose; each uses that data under its own privacy policy.
Your employer (the Customer): your call recordings, transcripts, and performance data are accessible to your organisation’s account administrators.
Integration partners: data is shared with the third-party tools you or your employer connects to Arcla (e.g. CRM, Slack), but only to the extent necessary to power those integrations.
Legal requirements: we may disclose your data if required by law, court order, or to protect the rights and safety of Arcla, our customers, or others.
Business transfers: if Arcla is acquired or merged, your data may transfer to the acquiring entity, subject to equivalent privacy protections.

Sub-processors

Our complete, current list of sub-processors is maintained at arcla.com/subprocessors. For each one it names the company, what it does, the data it handles, and the region where that data is processed. We keep it on its own page so it stays current between revisions of this policy.

We require data processing terms with each sub-processor that limit them to processing your data on our instructions and prohibit them from using it for their own purposes. For most providers this is their published standard Data Processing Agreement. For a minority we have not yet completed that paperwork, and the sub-processor page marks which. Where data is transferred outside the UK/EEA we rely on UK International Data Transfer Agreements or EU Standard Contractual Clauses, and completing that documentation across every provider is in progress.

We review the list at least annually and update it whenever a sub-processor is added or removed, and we give at least 30 days’ notice before adding a new sub-processor that handles customer call data.

Where we process personal data on behalf of a customer organisation, the governing terms are set out in our Data Processing Agreement.

Where your data is processed

Our processing is spread across regions. Our primary database is in the United Kingdom; call recording, speech-to-text and AI inference are in the United States; analytics and error monitoring are in the EU; and hosting runs on a global edge network. The sub-processor page gives the region for each service.

Call recordings made through the desktop app are normally uploaded to our recording provider for processing. Some calls started manually, without a detected meeting, are transcribed directly without going to that provider. We do not currently offer data residency or region locking, meaning you cannot yet contractually require that your data remains in a particular region. If this is a requirement for your organisation, contact us at support@arcla.com.

6. Data retention

We retain your personal data for as long as your account is active and for a reasonable period thereafter to comply with legal obligations and resolve disputes.

We do not yet offer configurable retention periods. Call recordings and transcripts are kept until they are deleted or the account is closed; there is no automatic expiry today, and no administrator-configurable retention setting. A defined retention schedule with automated deletion is in development. You may request deletion at any time (see section 8).

7. Data security

We implement technical and organisational measures to protect your personal data, including:

Encryption in transit: all traffic to and within the platform is served over HTTPS, with HTTP Strict Transport Security enforced on the domains we operate. We rely on the TLS floor set by our infrastructure providers rather than pinning a version ourselves.
Encryption at rest: databases and object storage are encrypted at rest by our infrastructure providers (Supabase, Cloudflare) using their platform defaults. We do not currently operate customer-managed encryption keys.
Tenant isolation: each organisation’s data is separated by an organisation identifier enforced in the database itself through Postgres row-level security, with live call transcripts held in per-call storage instances that are separated by construction.
Access controls: application access is role-gated, and Arcla staff have no standing access to customer organisations; support access is granted per organisation and can be revoked.
Network security: our infrastructure sits behind Cloudflare, which provides DDoS mitigation and platform-level protection, together with rate limiting on sensitive endpoints.
Monitoring: application errors and structured logs are collected and monitored by automated alerts for anomalous behaviour. We do not yet maintain a per-record access log showing which staff member viewed which call, and building one is on our roadmap.
Change control: every change reaches production through a pull request. Direct and force pushes to our main branch are blocked. Three checks must pass before anything can merge (linting, type checking and the automated test suite; linting and type checking also reject unused code), every review comment must be resolved, and merges run through a queue that re-runs the full suite.
Vulnerability management: dependency scanning, static analysis, database security advisors and automated security review run on every change and on a daily schedule. These report findings rather than blocking a merge. Findings are verified against the code before being filed, then tracked through to a deployed fix. We do not yet publish remediation time targets.

No method of internet transmission is completely secure, and we cannot guarantee absolute security.

Reporting a vulnerability

If you discover a security vulnerability in our systems, please report it responsibly to security@arcla.com. We aim to acknowledge reports within 2 business days and will work with you to understand and address the issue. Please do not publicly disclose the issue until we have had a reasonable opportunity to remediate it.

8. Your rights (platform users)

If you are an Arcla user, depending on your location you may have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Delete your data (subject to legal retention requirements).
Restrict or object to certain processing.
Port your data to another service.
Withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at support@arcla.com. We will respond within 30 days. If you are in the UK or EEA and are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection authority (in the UK, the ICO at ico.org.uk).

9. Rights of third-party data subjects (prospects and call participants)

Arcla processes call recordings and transcripts on behalf of its customers (sales organisations). If you are a prospect, lead, or other individual whose voice or personal data was captured during a sales call processed by Arcla, the following applies to you.

Who controls your data?

The sales organisation that recorded the call is the data controller for your personal data. Arcla processes that data on their behalf as a data processor. The organisation’s own privacy policy governs how they use your data and should be your first point of contact.

Your rights

You have the same rights as described in section 8: access, correction, deletion, objection, and portability. To exercise these rights:

Contact the organisation that recorded the call in the first instance. They can locate the call in Arcla and remove it, and they can ask us to erase the underlying data.
If you cannot identify or reach that organisation, or if you believe your request has not been handled appropriately, contact us directly at support@arcla.com. We will work with the relevant Customer to process your request within 30 days.

What data we hold

Your personal data may include your voice (in audio recordings), a transcript of your conversation, and any associated metadata such as the date and duration of the call. We do not hold your name, contact details, or other identifying information unless it was mentioned during the call or provided by the Customer via an integrated CRM.

Deletion

When a Customer deletes a call recording or transcript, whether at your request or as part of their own data retention policy, we permanently delete the associated data from our systems within 30 days, subject to any legal retention requirements.

Deletion is immediate in the product: the call is removed from the Customer’s workspace straight away and is no longer accessible. Removal from our underlying storage systems follows within the 30-day window. Encrypted backups, including a separate off-site copy we keep for disaster recovery, may hold a copy for up to a further 35 days before they age out on their normal cycle; those backups are not accessible in the ordinary course of running the service.

If you want a specific call erased and cannot reach the organisation that recorded it, contact us at support@arcla.com.

10. Cookies

We use a small number of strictly necessary cookies to keep you logged in and maintain session state. We use analytics cookies only with your explicit consent. On the marketing website we also use advertising measurement cookies from Google, Meta and LinkedIn, only with your explicit consent and never on the dashboard. For a full list of cookies we set, their purpose, their lifetime, and how to control them, see our Cookie Policy.

11. Changes to this policy

We may update this policy from time to time. We will post any changes on this page and, where changes are material, notify you by email.

12. Contact

Questions about this policy or your data should be directed to:

Third Frontier Ventures Ltd. trading as Arcla support@arcla.com