Private by design, clear by policy.

1. Who we are and the scope of this policy

BitArc is operated by Domatic, Inc., a Florida corporation (“BitArc,” “we,” “us,” or “our”). This policy applies to bitarc.com, my.bitarc.com, our communications, and the preservation services we provide. Domatic, Inc. is the controller of personal information described here.

We may need to verify your identity before completing a privacy request.

2. Information we collect

Information you provide

• Account information: name, email address, password hash, email-verification status, and account preferences.
• Archive content: photographs, videos, audio, letters, documents, and other files you choose to preserve.
• Memory context: titles, stories, dates, people, locations, coordinates, country codes, privacy settings, file metadata, and other descriptions you add or that accompany a file.
• Legacy information: a trusted person’s name, email, relationship, intended role, invitation status, and your access instructions. Please obtain permission before giving us another person’s information.
• Transactions: plan, preservation term, gift and recipient details, amounts, currency, transaction status, and identifiers received from our payment provider. BitArc does not receive full payment-card numbers.
• Communications: beta applications, feedback, support messages, service emails, delivery events, and suppression preferences.

Information collected automatically

We collect security and operational data such as IP address, browser and device information, session identifiers, request timestamps, authentication events, error logs, and service-health records. If you allow optional analytics, Google Analytics also receives a client identifier, approximate location, browser and device information, referrer, pages viewed, and session activity. We do not load Google Analytics until you choose “Allow analytics.”

3. Why we use information

We use personal information to:

• create, authenticate, secure, and recover accounts;
• store, copy, verify, repair, export, and preserve archive content;
• maintain integrity records, funded preservation horizons, and portable archives;
• invite and authenticate legacy contacts and enforce owner-directed access;
• process subscriptions, gifts, refunds, and preservation funding;
• deliver security, preservation, billing, and service communications;
• prevent fraud and abuse, investigate incidents, and keep the service reliable;
• improve BitArc using feedback and, only with permission, analytics; and
• comply with law and protect users, BitArc, and others.

Where applicable law requires a legal basis, we rely on performance of our contract, our legitimate interests in operating and securing BitArc, compliance with legal obligations, protection of vital interests in exceptional circumstances, and consent for optional analytics or other processing where consent is required. You may withdraw consent at any time without affecting earlier lawful use.

4. When information is disclosed

We do not sell personal information. We do not share it for cross-context behavioral advertising, and we do not use archive content to train generative-AI models.

We disclose information only as needed to:

• Service providers: Cloudflare for edge security, traffic delivery, and private administration; Vultr for application, database, queue, and primary-object infrastructure; Amazon Web Services for deep archive, backups, and transactional email; Stripe for payments; Google for consented analytics; and email/support providers, including Proton, for messages you send us.
• People you direct: legacy contacts, Vault members, gift recipients, or another person you expressly authorize, subject to the access controls you select and the feature’s status.
• Legal and safety needs: comply with valid legal process, respond to emergencies, investigate abuse, enforce our terms, or protect rights and safety. We evaluate requests and disclose only what we reasonably believe is required.
• Business changes: support a financing, reorganization, acquisition, or transfer, subject to confidentiality protections and continued handling consistent with this policy.

Our providers process information under their own terms and our instructions where applicable. They may operate in the United States and other countries.

5. Retention, immutable copies, and deletion

BitArc is designed for long-term preservation. We retain account and archive information while an account is active and as needed to provide the preservation service. Archive objects may be versioned, duplicated across independent providers, and protected by immutable retention controls through the funded preservation horizon. Those controls block ordinary deletion or shortened retention on a locked copy. Current governance-mode controls permit only specially authorized override actions; BitArc restricts that authority, and the circumstances for any override require approved legal and operational policy.

A deletion or account-closure request therefore does not necessarily remove every copy immediately. We will remove information from active systems when legally and technically permitted, restrict access where appropriate, and allow locked copies and backups to expire according to their retention schedules. We may retain transaction, consent, security, integrity, suppression, and audit records when necessary for legal compliance, dispute resolution, fraud prevention, and proof of preservation actions. We will explain material limits when responding to a verified request.

6. Your choices and privacy rights

Depending on where you live, you may ask us to access, correct, delete, restrict, or provide a portable copy of personal information; object to or withdraw consent for certain processing; or appeal a decision on a privacy request. You may also manage archive context and legacy access in BitArc, download a Portable Archive, unsubscribe from optional preservation messages, and change analytics consent through “Cookie settings.” Security, billing, and essential preservation notices are not marketing and may continue while you use BitArc.

Submit a request through the legal and privacy contact listed below. Authorized agents may submit requests where permitted by law. We will not discriminate against you for exercising a privacy right. Because BitArc does not sell personal information or use it for targeted advertising, there is no sale or targeted-advertising opt-out to process. If we deny a request, you may reply and ask us to appeal the decision.

7. Security and incident response

BitArc uses layered safeguards, including encrypted transport, provider encryption at rest, password hashing, key-only private administration, least-privilege service access, integrity checks, redundant storage, retained backups, and monitored infrastructure. No system is perfectly secure. If an incident creates a legally reportable risk, we will investigate and notify affected people and authorities as required.

8. Children and information about other people

BitArc accounts are not offered to children under 18, and we do not knowingly collect account information directly from children under 13. An adult account owner may preserve family content that depicts or concerns a child only when the owner has the right and authority to do so. If you believe a child created an account or information was provided without proper authority, contact us promptly.

9. International use

BitArc is operated from the United States, and information is primarily stored and processed in the United States. If you access BitArc from another country, your information may be transferred to a jurisdiction with different privacy laws. BitArc’s initial public offering is intended for United States residents unless we expressly approve another region. Before offering the service where a recognized international-transfer mechanism is required, we will implement the applicable safeguards.

10. Changes to this policy

We may update this policy as BitArc evolves. We will post the revised version and change the date above. If a change materially affects how we use existing personal information, we will provide additional notice and seek consent when required by law.