ARSENALIS
Personal data processing

Privacy Policy

Last updated: 2026-11-15

This notice explains how AEGIS SOFTWARE SOLUTIONS LTD, operator of ARSENALIS at https://arsenalis.org, handles personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The EU GDPR also applies to personal data of EU visitors where relevant.

1. Data controller

The controller and operator of ARSENALIS is AEGIS SOFTWARE SOLUTIONS LTD, Companies House number 17240895. Registered office: 20 Wenlock Road, London, England, N1 7GU, United Kingdom. Active UK private limited company, incorporated 25 May 2026. Official Companies House record.

Contact: legal@armicompass.world.

2. Data we collect

  • Registration data (optional account): email address, username, avatar (selected by the user).
  • Browser storage: authentication session, language, theme and palette preferences, and banner choices stored locally in your browser.
  • Account interactions: viewed catalog entries, collections, ratings, reviews, reports and optional community submissions. Submissions include their content, supporting links, review status and moderator notes; submitters can see their own submissions and authorised moderators can review them.
  • Technical request data: hosting and security providers may process IP addresses, user agents and request timestamps for delivery, security and diagnostics. This is separate from the cookie-free visitor analytics described below.

3. Purposes and legal basis

  • Service delivery and account management (art. 6.1.b GDPR — contract performance).
  • Security and abuse prevention (art. 6.1.f GDPR — legitimate interest).
  • Compliance with legal obligations (art. 6.1.c GDPR).
  • Optional processing that requires consent relies on consent (art. 6.1.a GDPR). The current banner saves preferences but does not control Lovable visitor analytics; its actual behaviour is explained below.

4. Data retention

Account data is retained as long as the account is active. You can request deletion at any time. Technical log retention depends on providers and is not verified in project code.

5. Transfers and providers

  • Lovable: platform and application hosting; receives data necessary for service delivery, security and operation. The region is not verified as EU-only in this project.
  • Cloudflare: CDN and security, receiving technical request data; the technical bot-management cookie __cf_bm has been observed on the site. Global anycast network, not EU-only.
  • Authentication and database service via @supabase/supabase-js: stores account data, sessions and recorded interactions. The hosting region is not verified in project code.
  • Google OAuth: optional sign-in; Google receives data needed for sign-in and shares authorized account information with the site. Google is a US-based provider and the service involves international transfers.
  • Google Fonts: the browser requests fonts from Google, transmitting technical request data such as IP address and user agent.

Personal data may be transferred outside the UK and EEA. Where required, these transfers rely on appropriate safeguards such as Standard Contractual Clauses. We do not sell personal data.

No first-party analytics or marketing scripts are active in the application code. The hosting platform may collect operational logs and metrics outside the page.

The published site also has platform-provided Lovable visitor analytics enabled. It uses no cookies, stores nothing on visitors’ devices, does not keep IP addresses and does not identify visitors.

It records pages visited, referrers, country, browser, operating system, device type, time on site, page speed, errors and clicks on buttons and links. No application events are sent through window.__lovableEvents.

The current banner saves the choice in the browser but does not pass it to Google Consent Mode, so the listed clicks are recorded for every visitor. Page visits, time on page, speed and errors are also recorded for every visitor, without cookies or identifying them. The banner choice is stored in armicompass.consent; the current code sets no expiry.

Detailed data is retained for 90 days and daily summaries for one year. Lovable collects this data for us. Its privacy policy explains how it handles it. Lovable’s privacy policy.

6. Your rights

Subject to the applicable law and its conditions, you may request access, correction, erasure, restriction or portability of your personal data, object to processing, and withdraw consent without affecting processing already lawfully carried out. Contact us using the email below.

You may complain to the UK Information Commissioner’s Office (ICO). EU visitors may also lodge a complaint with their local supervisory authority. You do not need to contact us before exercising your right to complain.

7. Contact

To exercise your rights or for any question about this policy: legal@armicompass.world.