Privacy Notice

This Notice covers personal data of creators, brand and agency users and their personnel, and visitors. Where a brand or agency determines the purposes of personal data they bring to a campaign, they may be a separate controller and ARCA acts as processor under a data-processing addendum.

• Account & identity: name, email, phone, role, company, Emirates ID / licence details, and KYC documents (for verification and AML where ARCA facilitates payments).
• Profile & creator data: handles, audience/engagement metrics, niches, portfolio, rate cards, linked social accounts.
• Campaign data: briefs, offers, deliverables, messages, reviews, approvals, contracts, and e-signature records.
• Payment data: payout account references and transaction records (full card/bank details are handled by our payment processor, not stored by us).
• Usage & device data: log data, IP address, device/browser, pages and actions, cookies and similar technologies.

• Operate your account and provide the Platform — performance of a contract.
• Source, contract, review, license, and report campaigns — performance of a contract.
• Verify identity, prevent fraud, and meet AML/legal obligations — legal obligation / legitimate interests.
• Facilitate and reconcile payments and invoicing — performance of a contract / legal obligation.
• Security, debugging, and service improvement — legitimate interests.
• AI-assisted matching, scoring, and document extraction — legitimate interests (decision-support only).
• Marketing communications — consent (you may withdraw at any time).

We share personal data with other Platform users as needed for a campaign (e.g. a brand sees a creator’s profile and deliverables), and with the following service providers (processors) acting on our instructions:

• Stripe — payments and Connect payouts.
• Amazon Web Services (S3) — file storage and hosting.
• Anthropic (Claude API) — AI scoring and document field extraction; receives only the specific text/metadata or document needed, and is not used to train models per the provider’s API terms.
• Sentry — error monitoring (technical/diagnostic data).

We may also disclose data to authorities, advisors, or acquirers where required by law or in a corporate transaction. We do not sell personal data.

Some processors may process data outside the UAE. Where we transfer personal data abroad, we do so only in accordance with PDPL Articles 22–23 — to jurisdictions with adequate protection, or under appropriate safeguards or an applicable exception (such as performance of your contract).

We use automated and AI-assisted features for creator matching, fair-rate, brief- and content-quality scoring, and document field extraction. These produce indicative, decision-support outputs reviewed by humans; they are not solely-automated decisions producing legal or similarly significant effects on you without human involvement. You may contact us to query or contest an output that affects you.

We keep personal data only as long as needed for the purposes above and to meet legal, accounting, and dispute requirements (e.g. transaction and KYC/AML records for the period required by UAE law), then delete or anonymise it.

We apply appropriate technical and organisational measures (access controls, encryption in transit, least-privilege, monitoring) and will notify the UAE Data Office and affected individuals of a personal-data breach as required by the PDPL.

Subject to the PDPL, you may access your data; request correction or erasure; restrict or object to processing; request portability; withdraw consent (without affecting prior processing); and not be subject to solely-automated decisions with significant effects. Exercise these by contacting privacy@arca.ae. You may also lodge a complaint with the UAE Data Office.

We use necessary cookies to run the Platform and, where applicable, analytics/preference cookies you can control via your browser. The Platform is not directed to anyone under 18, and we do not knowingly collect their data.

We may update this Notice; material changes will be notified via the Platform or email. Questions or requests: privacy@arca.ae — Quantara LLC, Sharjah Media City (SHAMS), Sharjah, UAE.