Arka

Privacy Policy

Last updated: 24 August 2026

Norvis (“we”, “us”) builds and operates the Arka platform (“Arka”). We respect your privacy. This policy explains what we collect, why we collect it, and your rights over it.

1. What we collect

  • Account data: name, email, role, organisation.
  • Customer Data: the projects, tasks, financial records, field reports, and files you or your organisation create in Arka. Site photographs are stamped at upload with the server’s clock and, when the capturing device provides it, the GPS position of the shot; that stamp is part of the evidential record and has no edit path afterwards.
  • Billing data: plan, subscription status, and payment history. Card and UPI details are handled entirely by our payment processor, Razorpay: Arka never sees or stores them.
  • Usage data: login timestamps, feature usage, and audit log entries (who changed what, and when), kept for security and support.
  • Inquiries: if you write to us through the contact page, we hold the name, company, email, phone number, and message you give us, whether or not you ever open an account.

2. How we use it

Solely to operate, secure, and improve the Service: authenticating you, enforcing tenant isolation, processing payments, sending transactional email such as invoice reminders and expiry alerts, and answering support requests and inquiries. We do not sell your data, and we run no advertising trackers and no third-party analytics, on the product or on this site.

3. Where it lives and who processes it

Your data lives in a PostgreSQL database, with authentication and file storage alongside it, operated for us by Supabase and hosted in the Mumbai region. Billing is processed by Razorpay, a regulated Indian payment processor. Transactional email is delivered by Resend. These three are our only sub-processors, and we will update this page before adding another.

4. Tenant isolation, and who can see your data

Arka is multi-tenant: your organisation’s data is logically isolated from every other organisation’s by database-level access controls enforced independently of application code. Within your organisation, what each person sees is set by the role your administrator grants them. Features that show something to an outside party, such as a client portal link, share only what your administrator chose to share, and access can be revoked. How the isolation is built and tested is described on our Security page.

5. Cookies and local storage

Arka sets only the cookies that signing you in requires, and keeps small interface preferences, such as your theme, in your browser. There are no advertising cookies and no tracking pixels.

6. Retention

Customer Data is retained while your organisation’s subscription or trial is active. When it ends, we keep the data for 90 days so an administrator can export it, and then delete it. Audit log entries are kept for the life of your organisation’s account and cannot be altered or deleted by any user, including administrators: corrections are new entries. Inquiries from the contact page are kept only as long as it takes to respond and follow up.

7. Your rights

You may ask for a copy of your personal data, ask us to correct it, or ask us to delete it. Send the request through the contact page: it goes straight to the people who operate Arka, and every request is answered.

Organisation administrators can export their organisation’s complete data, tables and files both, directly from the product. Deletion of an entire organisation’s data is carried out on request, and is confirmed with your administrator in writing before anything is removed.

8. Grievance redressal

We handle personal data as Indian law requires, including the Digital Personal Data Protection Act, 2023 as its provisions are brought into force.

Complaints about how your personal data is handled go through the contact page and reach the operator directly. They are acknowledged within 72 hours and resolved within one month.

9. Changes to this policy

We will notify active subscribers by email of material changes at least 14 days before they take effect.

10. Contact

Through the contact page. Every message reaches the team that operates Arka.