Privacy notice

What data we collect

Depending on how you use ARCO, we may collect:

• Identification and contact data: name, email, profile picture and the provider you sign in with.
• Your preferences and what you save in the app: watchlists, portfolio, alerts, notes, language and theme.
• If you connect Telegram or WhatsApp to receive alerts: your user or phone number on that service.
• If you try ARCO Pilot: your investor profile (date of birth, country, occupation, approximate income and savings, investment experience, goals and risk tolerance, and whether you are a politically exposed person), your electronic signature of the agreement, the API keys of your practice account (stored encrypted) and the balances, positions and orders of that account.
• If you pay for a plan: the payment is processed by Stripe; ARCO does not see or store your card number.
• Technical data: IP address, device and browser type, and the date and time of your visits, to keep the service secure and working.

Financial and asset data

The approximate income and savings in your investor profile are financial data. We only ask for them if you decide to try ARCO Pilot, and we ask for your express consent when you fill out the profile. ARCO does not intentionally collect sensitive data.

What we use your data for

Primary purposes (necessary for the service):

• Create and manage your account and identify you when you sign in.
• Provide the tools of your plan: research, alerts, portfolio, emails and notifications you choose.
• If you use ARCO Pilot: assess whether the strategy suits your profile, sign the agreement and send orders to your practice account.
• Process payments and invoices, and answer your questions and support cases.
• Keep the service secure, prevent fraud and comply with legal obligations.

Secondary purposes (you can refuse them without losing the service):

• Send you news about ARCO, promotions and surveys.
• Build aggregated, anonymous statistics on how the app is used, to improve it.

If you don't want your data used for secondary purposes, write to us (see “Your rights”) or turn off newsletters and promotions in Account → Notifications and emails.

Who we share it with

ARCO does not sell your personal data. To provide the service we rely on providers that process data on our behalf and under our instructions, some of them outside Mexico:

• Sign-in (Auth0) and hosting of the web app (Vercel).
• Payments (Stripe), email delivery and encrypted backups in the cloud.
• An artificial intelligence provider, only for the questions you ask the assistant and to draft texts; it does not receive your API keys or your investor profile.
• Telegram or WhatsApp, only if you connect them, to send you your alerts.
• The broker whose practice account you connect, to send orders to that account.

We will only share your data with authorities when the law requires it.

Your rights

You have the right to access your data, rectify it if it is inaccurate, cancel it when you consider it is not needed, and oppose its use for specific purposes (in Mexico these are known as ARCO rights, a name unrelated to our company). You may also revoke your consent and limit the use of your data.

To exercise them, send your request from the app (Account and settings → Support) with: your name and the email of your account, the right you want to exercise and what data it concerns, and, if you act on someone's behalf, a document proving it. We will reply within 20 business days, and if your request is valid we will act on it within the following 15 business days.

From the app you can download all your data and delete your account at any time (Account → Privacy and data).

How long we keep it

We keep your data while your account is active. If you delete it, we erase your data, except what the law requires us to keep (for example, invoices). Encrypted backups are replaced automatically within a few weeks.

Cookies and browser storage

ARCO uses your browser's storage to keep your session, language, theme and some on-screen preferences. We do not use advertising cookies or third-party trackers.

Security

Your data travels encrypted, API keys are stored encrypted and access to the systems is restricted. No system is infallible: if an incident affects your data, we will let you know.

Changes to this notice

If we change this notice, we will publish the new version on this page with its update date and, if the change is important, we will tell you in the app or by email.