Privacy Policy

ARKHMS LLC, a California limited liability company (“ARKHMS,” “we,” “us”), operates the website at https://www.arkhms.com and the customer portal at https://app.arkhms.com (together, the “Services”).

• Location: Lincoln, California, United States
• Privacy contact: [email protected]

This policy describes what personal information we collect through the Services, why we collect it, who we share it with, and the choices and rights you have.

This policy covers the Services only. It does not cover information you give us in person, by phone, or by email outside the portal, except where we later enter that information into the portal — in which case this policy governs how we handle it there.

We collect the categories below. The CCPA column maps each to the statutory categories in Cal. Civ. Code § 1798.140(v).

We do not intentionally collect sensitive personal information as defined in Cal. Civ. Code § 1798.140(ae) — no Social Security numbers, driver’s license numbers, financial account numbers, precise geolocation, health information, biometric data, or the contents of your mail, email, or messages.

Children. The Services are not directed to children and we do not knowingly collect personal information from anyone under 16. We do not sell or share the personal information of minors.

• To create and secure your portal account and authenticate you
• To schedule, perform, document, and invoice the services you request
• To keep a record of the equipment, materials, and finishes installed at your property
• To communicate with you about your projects, including email notifications when a task is assigned or updated
• To respond to quote requests you submit through the public form
• To keep records required for tax, warranty, insurance, and licensing purposes
• To detect, investigate, and prevent security incidents, abuse, and fraud
• To comply with legal obligations

We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects.

We share personal information only with the service providers below, only as needed to run the Services, and only under contracts that restrict their use of it. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the CCPA.

About the Gemini image processing. When a receipt or equipment photograph is uploaded, the image is transmitted to Google’s Gemini API to extract structured details. We use a paid Gemini API tier, under which Google does not use the submitted images to train its models.

We may also disclose personal information when required by law, subpoena, or court order; to protect our rights, safety, or property; or in connection with a merger, acquisition, or sale of assets, in which case we will notify you.

We dispose of records containing personal information by shredding, erasing, or otherwise making them unreadable, as required by Cal. Civ. Code § 1798.81.

We maintain reasonable security procedures and practices appropriate to the nature of the information, as required by Cal. Civ. Code § 1798.81.5. These currently include:

• TLS encryption for all traffic in transit
• Federated sign-in through Auth0 — we never receive or store your password
• Database-backed sessions using secure, HTTP-only, same-site cookies with CSRF protection
• Per-account access control, so records are readable only by the accounts linked to them
• Every uploaded file scanned in an isolated worker — file-type verification from the file’s actual bytes, antivirus and YARA rule scanning, and content disarm and reconstruction — before it is stored
• Cryptographically signed internal webhooks, per-IP rate limiting, and bot verification on the public quote form

No system is perfectly secure. If a breach of unencrypted personal information occurs, we will notify affected California residents in the most expedient time possible and without unreasonable delay, as required by Cal. Civ. Code § 1798.82. To report a suspected vulnerability or account compromise, email [email protected].

If you are a California resident, you have the following rights. We honor these requests regardless of whether we currently meet the CCPA’s applicability thresholds.

• Right to know — what personal information we have collected about you, the categories of sources, the business purpose, the categories of third parties we disclosed it to, and the specific pieces of information we hold.
• Right to delete — request deletion of personal information we collected from you, subject to the exceptions in Cal. Civ. Code § 1798.105(d).
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell or share personal information, so there is nothing to opt out of. We will update this policy if that ever changes.
• Right to limit use of sensitive personal information — we do not collect sensitive personal information for any purpose requiring this right.
• Right to non-discrimination — we will not deny you service, charge you a different price, or provide a different quality of service because you exercised any of these rights.

How to submit a request. Email [email protected]. We will confirm receipt within 10 business days and respond within 45 calendar days, extendable once by another 45 days if we notify you.

Verification. To protect your information, we will verify your identity before acting on a request — typically by confirming control of the email address on your portal account, and by matching two or more data points we already hold. We will not use information you provide for verification for any other purpose.

Authorized agents. You may designate an agent to submit requests on your behalf. We will require written permission signed by you and will verify your identity directly.

Shine the Light (Cal. Civ. Code § 1798.83). We do not disclose personal information to third parties for their own direct marketing purposes.

If you are a resident of a state with a comprehensive consumer privacy law — including but not limited to Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and Montana — you may have rights to access, correct, delete, and obtain a portable copy of your personal information, and to appeal a denied request. Use the same contact method in Section 8.

The portal uses strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. The public quote form loads Cloudflare Turnstile, which sets its own cookie for bot detection. We do not use analytics, advertising, or cross-site tracking technologies.

Because we do not sell or share personal information, there is no sale or sharing to opt out of, and we therefore do not treat Global Privacy Control signals as an opt-out of sale or sharing.

We will post any changes here and update the effective date above. If the changes are material, we will notify you by email or through the portal before they take effect. We review this policy at least once every 12 months.

Questions, requests, or complaints: ARKHMS LLC, Lincoln, California · [email protected]

See also our Terms of Service.