Privacy Notice
This notice describes how PromiseArc handles information across the public website, authenticated service, support, and related business communications.
Scope
This notice applies when you visit promisearc.com, use the authenticated PromiseArc service, or communicate with PromiseArc about the product, support, security, privacy, or a business relationship.
Customer organizations decide what service content their authorized users enter and how they use it. PromiseArc handles that content to provide the service on the organization's behalf, and the organization's own notices and agreements may also apply. If your question concerns information your organization placed in PromiseArc, your organization is usually the best first contact.
Information handled
PromiseArc does not ask for every category below in every interaction.
The public site does not include a contact form or advertising pixels. It uses cookie-free analytics to measure aggregate page views, devices, browsers, referrers, and approximate location. A third-party hosting provider processes ordinary network and request information needed to deliver, protect, and operate the site.
The service handles names, email addresses, password hashes, organization memberships and roles, invitations, preferences, session metadata, and limited sign-in security data.
Authorized users may enter customer-account and stakeholder details; Outcomes, Evidence, Risks, Actions, measurements, reviews, and Value Path steps; renewal or expansion context; imported records; and the history of important changes.
Email and other business communications may include contact details, the message, attachments, support context, and related follow-up. Please do not send passwords, credentials, or unnecessary customer-sensitive content by email.
Use and control
PromiseArc uses information to provide and secure the website and service; authenticate users and enforce organization and role boundaries; preserve records and audit history; respond to support, security, privacy, and business communications; understand service use and performance; maintain and improve the product; and meet applicable legal or operational obligations.
PromiseArc does not use customer-controlled service content for advertising. Access to that content is limited by the service's organization and authorization controls. Platform administration does not by itself grant access to tenant records.
Cookies and measurement
PromiseArc's public-site code does not set or read cookies or browser local storage and uses cookie-free analytics for aggregate website measurement. It does not load advertising scripts.
The service uses strictly necessary cookies for sessions and request verification. It also uses cookie-free analytics and performance measurement for aggregate page-view, device, referrer, approximate-location, and performance information. PromiseArc does not use advertising analytics in the service.
Service providers
PromiseArc uses third-party service providers to operate and support the website and authenticated service. Providers may process information in connection with the functions they support and under their own security and privacy responsibilities. PromiseArc remains responsible for its own privacy and security practices; a provider's certifications or assurances do not become PromiseArc certifications.
Additional provider information may be made available through appropriate customer diligence or contractual processes.
Retention and requests
Retention depends on the type of information, the service or business relationship, customer instructions and agreements, security and operational needs, and applicable law. PromiseArc does not publish one universal retention period for every category.
Depending on where you live and the circumstances, applicable law may provide rights concerning personal information. Email privacy@promisearc.com to ask a question or make a request. PromiseArc may need to verify your identity, authority, or relationship to the relevant organization before acting.
When a customer organization controls the service content involved, PromiseArc may direct the request to that organization or work with it to respond. This public route does not imply an automated request workflow or a particular outcome under every law.
Safeguards
PromiseArc uses organization and role boundaries, protected sessions, request controls, audit history, managed infrastructure, bounded diagnostics, and reviewed changes. No system can promise absolute security.
Review Security & TrustChanges
PromiseArc may update this notice as the website, service, providers, or legal requirements change. Material revisions will receive a new current date and a concise entry below.
For a general company question, use hello@promisearc.com. Existing customers can use Support, and suspected vulnerabilities should be reported privately through the security route.