Privacy and legal information

Updated: October 7, 2026.

Operator and contact

ARCVELIUM — A brand of Hexterm Security. The legal operator and business name are Hexterm Security. Business correspondence address: 1324 rue Breux, Chambly, Québec J3L 2Y5, Canada. Service territory: Québec and Canada.

Privacy officer: Hextem Security Gestion. For access, correction, deletion or withdrawal of consent, contact hextermsecurity@gmail.com. Proportionate identity verification may be required.

Your choices

You can contact us directly without the assistant. Demonstration replies are predefined; no conversation is sent to DeepSeek or stored on the server. Exports stay on your device. A message opened in your email application is sent only when you send it yourself.

The live assistant requires your consent before relevant text is sent to DeepSeek and the conversation is saved. Your name and email are collected separately and that contact form is not sent to the model. Do not enter secrets or sensitive personal information in the conversation. Filtering some data formats does not guarantee anonymity.

Project file and optional photos

Review and correct the summary before confirming transmission. Choose the complete project file or summary only and the photos to attach. The preview expires after one hour. Exact text exclusions may not remove paraphrases or information visible in an image: review the file and remove any photo you do not wish to share.

Selecting a local photo does not upload it. Storage requires your consent. Images are normalized, EXIF/GPS metadata removed, and stored in private Cloudflare R2 storage. This is not an antivirus scan. Limits: 5 photos, 8 MiB per file, 20 MiB before optimization and 3 MiB optimized total. HEIC files require a JPEG copy.

Attaching a photo does not authorize AI analysis. Analysis requires a separate explicit choice and is currently disabled. Photos are not used for a gallery or demonstrations.

Retention on the site

Unsubmitted drafts and conversations: 24 hours after the last authenticated activity (reading, chatting or managing the project file), with associated temporary photos deleted. Submitted project files and photos are kept separately for 30 days after submission. Server cleanup is scheduled every five minutes; outages may delay physical deletion. Expired sessions cannot be resumed.

Aggregated statistics are kept for 180 days without conversations, photos, contact information, free text or identifiers that can identify a visitor. Session-linked feedback is deleted with the session.

The erase control deletes the accessible conversation and temporary photos. It does not recall an already submitted request or its email attachments. Contact the privacy officer about these copies.

Email and client projects

Confirmed requests are saved before Cloudflare Email Service sends them to hextermsecurity@gmail.com. Google/Gmail receives the files and handles follow-up exchanges. Technical acceptance of a message does not establish receipt.

Unconverted ARCVELIUM inquiries in Gmail are deleted manually within six months after the last exchange, or sooner when no longer needed. Automatic Gmail deletion is not configured. Inquiries that become client projects are subject to a separate policy appropriate to the engagement and applicable obligations; conversations and photos are not all retained indefinitely.

Providers and international processing

Cloudflare provides hosting, abuse protection, D1 database services, private R2 storage and request delivery. Google processes emails on its international infrastructure. Processing is not guaranteed to occur exclusively in Québec or Canada. The eastern North America R2 placement hint does not guarantee Canadian residency.

DeepSeek provides conversation and project preparation when the assistant is enabled. Its general policy describes processing in China, model improvement uses and an opt-out right. ARCVELIUM-specific API assurances, including retention and exclusion from training, have not yet been confirmed: the public assistant remains disabled during this verification. DeepSeek policy.

ARCVELIUM does not automatically train on customer conversations, photos or feedback. Knowledge changes are reviewed and approved by a person. This internal rule is not an assurance about providers’ own processing.

Backups, logs and deletion

Deleting data on the site does not immediately destroy all external copies. D1 Time Travel provides a 30-day restoration window on the current plan. A restored database must be purged of expired data again before reopening. Application content logs are disabled; providers may retain technical and security data under their own rules.

Google describes a deletion process generally lasting about two months and some backups lasting up to six months, with exceptions and possible delays. These provider timelines are separate from the six-month active retention limit for unconverted Gmail inquiries. ARCVELIUM does not guarantee complete technical-copy retention periods for R2, Email Service or DeepSeek. Google retention · D1 backups · Cloudflare agreement.

Protection and limitations

Hexterm Security operates ARCVELIUM and its technical configuration: HTTPS connections, server checks, token-based sessions, private storage, quotas and Turnstile abuse protection. IP addresses are used for a pseudonymous counter renewed daily. Language and motion preferences and a tab session recovery token may be stored on your device. No advertising tracker is integrated.

This role is not an independent certification, absolute protection or a promise of continuous monitoring. Assistant suggestions are not a contract or a final quote: feasibility, pricing and timelines require human confirmation.