Privacy policy

Plain-English summary

Arca is a payment processor. To open and run a merchant account we collect the information a sponsor bank needs to underwrite your business and process card transactions on your behalf. We share what we have to share with the card networks and our sponsor bank (Citizens Bank, N.A.) to make payments work — and we don’t sell your data for marketing.

On the marketing site at arca.biz, we also collect the contact information you give us through forms and use it to follow up on your pricing inquiry. Standard cookies are used to measure how the site is performing.

Information we collect

• Account information — your name, business name, address, EIN, and the ownership information required to underwrite a merchant account.
• Transaction data — the records of card transactions you process through Arca, including amounts, card-brand identifiers, and timestamps.
• Site usage — pages visited, device and browser information, referrer, and other standard server-log details. Cookies and similar technologies as described below.
• Marketing inquiries — anything you enter into pricing, statement comparison, or contact forms on this site.
• Communications — emails, texts, and call recordings (where disclosed) you exchange with the Arca support team.

How we use it

• Provide payment processing under your merchant agreement.
• Comply with card-brand rules, federal law, and state law — including PCI DSS, know-your-customer (KYC), anti–money-laundering (AML), and OFAC screening requirements.
• Communicate with you about your account, your pricing inquiry, and updates to our services.
• Improve the site and our services (analytics, error reporting, A/B testing).
• Send marketing communications, only where you’ve given consent. See our TCPA disclosure for details on phone and text contact.

Who we share it with

• Sponsor bank — Citizens Bank, N.A., as the acquiring institution for your merchant account.
• Card networks — Visa, Mastercard, Discover, and American Express, as required to authorize and settle transactions.
• Service providers — vendors we use to run the site, send transactional emails, host the dashboard, deliver SMS, and process payroll. These vendors are bound by contract to use your information only on Arca’s behalf.
• Legal and regulatory authorities — when required by valid legal process or to investigate fraud, abuse, or violations of our terms.
• In a business transfer — if Arca is acquired, your information may be transferred subject to the receiving party’s honoring of this policy.

We do not sell your personal information to third parties for marketing purposes.

Cookies and analytics

We use cookies and similar technologies to keep the site secure, remember preferences, and measure performance. Categories: strictly necessary (always on), analytics (off by default where required by law), advertising (off unless you opt in).

We use analytics products (e.g., Google Analytics) to understand how visitors interact with the site. We do not use analytics data to identify individuals. You can opt out of cookies via your browser controls or the cookie banner once it’s implemented.

Your choices

• Access — request a copy of the information we hold about you.
• Correction — ask us to update inaccurate information.
• Deletion — request deletion of your data, subject to legal retention requirements (payment records and underwriting files are typically retained for several years).
• Marketing opt-out — unsubscribe from any marketing email, reply STOP to any text, or call us. See the TCPA disclosure.

To exercise any of these rights, email privacy@arca.biz with the request and enough information for us to verify your identity.

State-specific rights

Residents of California, Virginia, Colorado, Connecticut, Utah, Nevada, and other states with active consumer-privacy statutes have additional rights — including the right to opt out of certain processing, the right to non-discrimination for exercising those rights, and the right to appeal a denial. Contact us to exercise any of these rights.

California residents: this policy is intended to comply with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

Data security

Arca and its sponsor bank maintain PCI DSS compliance for the handling of cardholder data. Transmission of cardholder data uses TLS encryption; storage uses encryption at rest. Access to merchant data is restricted on a least-privilege basis and logged.

No system is perfectly secure. If we discover a breach affecting your information, we will notify you in accordance with applicable breach-notification law.

Children

arca.biz is not intended for use by children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe we have collected information from a child, contact privacy@arca.biz and we will delete it.

Changes to this policy

Arca may update this policy. Material changes will be posted on this page with an updated “last updated” date. We may also notify you by email or through the dashboard for significant changes.

Contact

Privacy questions: privacy@arca.biz. Mailing address: Arca, ATTN: Privacy, 1420 Celebration Blvd, Celebration, FL 34747.