Privacy & Data Governance

Privacy Policy

Last Updated: October 6, 2026 • GDPR, UK GDPR & CCPA/CPRA Compliant

1. Sovereign Workstation Guarantee

When running the open-source acr-core reference daemon and acr-web-local, 100% of your data remains strictly on your local machine with zero cloud telemetry.

2. Zero Foundation Model Training Guarantee

We maintain an absolute commitment: prompts, tool execution records, git diffs, and deliberation logs are NEVER used to train or fine-tune AI models.

3. 15-Minute Auto-Purge Sandboxes

Ephemeral cloud containers automatically trigger hardware memory scrubbing and disk purging after 15 minutes of inactivity or task completion.

4. Sub-processors Table

Our approved sub-processors: Clerk Inc. (Authentication), Stripe Inc. (Payment processing), Unkey Inc. (API Rate Limiting), Vercel Inc. (Web Hosting), Resend Inc. (Transactional Emails), and Google LLC (Analytics).

5. GDPR Right to Erasure & Key Shredding

Merkle ledger entries use pseudonymized identifiers. When an erasure request is processed under GDPR Right to Erasure, ACR cryptographically shreds the decryption keys, rendering historical hashes mathematically unrecoverable.