Your details, looked after

Who we are

Arch is a social wellbeing platform in Hong Kong, operated by RA Arc Labs Limited (“Arch”, “we”). We are responsible for the personal data you give us on archglobal.space and at Arch experiences. Questions go to info@archglobal.space, and a real person reads them.

What we collect

• Your account. Your email, and the name, phone number and other details you choose to add to your profile.
• Signing in. If you continue with Google or Apple, we receive your name, email and a sign-in ID from them. Nothing else: no contacts, no calendar, no files.
• Bookings and membership. What you booked, when, your ticket, and your membership plan and renewal dates.
• Payments. Stripe handles every payment. We see that you paid, how much and the last four digits of the card. We never see or store your full card number.
• Your Arch Passport. Which experiences you checked in to, which stations you completed at larger events, the stamps you earned, and the perks you unlocked, claimed or used. Your Passport QR is a random code. It holds no name, email or payment details.
• Forms. What you send us when you join a waitlist, apply as a partner, or get in touch.
• The basics of a visit. Our hosting provider keeps short-lived technical logs (such as IP address and browser type) to keep the site running and safe.

Why we use it

• To run your account, sign you in, and take bookings and payments.
• To check you in at experiences, keep your Passport and stamps up to date, and unlock the perks you've earned.
• To send you things you need: booking confirmations, reminders, changes and receipts.
• To introduce you to people at experiences, when you've asked us to. We do this in groups and never rank or score people.
• To understand, in aggregate, which experiences people come back to, so we can plan better ones.
• To keep Arch safe, prevent misuse and meet our legal duties.

News and offers

We only send news of experiences, membership and partner offers if you tick the box to say yes. That box is always optional. You can stop at any time with the link at the bottom of any email, or by writing to us, and it costs nothing. We don't sell or hand your details to anyone else for their own marketing.

Who else sees it

• Hosts and venues of an experience you book see your name on the guest list, and anything else only as needed to run it.
• Arch Network partners see that a member redeemed their perk. They don't see your attendance history, your other bookings or your contact details unless you give them yourself.
• Arch staff at check-in see only what they need to let you in: your first name, membership type and whether you're booked.
• Service providers who run parts of Arch for us and may only use your data to do so: Supabase (accounts and database), Cloudflare (hosting and email), Stripe (payments), Google or Apple (if you sign in with them), and Airtable and Luma (waitlists and event calendars).
• The authorities, when the law requires it.

Some of these providers store data outside Hong Kong, for example in India (where our database is hosted), Singapore, the United States or the European Union. We choose providers with strong security and put agreements in place so your data is protected to a standard similar to Hong Kong law.

How long we keep it

We keep your account while it's open. If you close it, we delete or anonymise your details within 90 days, except records we must keep by law, such as payment and tax records, which we keep for seven years. Passport and attendance records are kept with your account and removed with it. Aggregate counts that no longer identify you may stay.

Seeing, fixing or deleting your details

You can ask to see the personal data we hold about you, ask us to correct it, or ask us to close your account and delete it. Most of your details are in your profile, where you can change them yourself. For anything else, write to info@archglobal.space. We'll reply within 40 days, as the Personal Data (Privacy) Ordinance requires, and usually much sooner. If you're not happy with how we've handled it, you can contact the Office of the Privacy Commissioner for Personal Data, Hong Kong.

Cookies

We use the cookies that keep you signed in and keep the site secure. We don't use advertising cookies or cross-site tracking. Stripe sets its own cookies on its checkout page to prevent fraud.

Keeping it safe

Your data is encrypted in transit, access is limited to people who need it, and every admin action on partner approvals, check-ins and stamps is logged. If something ever goes wrong, we'll tell you and the Privacy Commissioner promptly, and say plainly what happened and what we're doing about it.

Changes to this page

If we change how we use your data, we'll update this page and the date below. If the change is a big one, we'll email you first.