Trust & Compliance

• Privacy Policy — what data we hold, why, who processes it, and how long we keep it.
• Cookie Policy — cookies and similar technologies.
• Terms of Service — the terms for this website and for a subscription bought online.
• Accessibility — our WCAG 2.2 AA commitment.

For data inside our products the school is the controller and Ark HQ is a processor on its instructions. We provide a signed Data Processing Agreement on request, with support for your DPIA. We are subject to the Irish Data Protection Commission and, for UK schools, the Information Commissioner’s Office.

We use a small, named set of processors — hosting, database, CRM, transactional email, payments, error monitoring and analytics. Each one is listed with what it does, what data it sees and where it holds it, in the Privacy Policy. That table is the definitive list and is kept current as we add or remove a service.

Our retention schedule — record by record, with where each one lives — is in the Privacy Policy. Data we hold on a school’s behalf is kept per the Data Processing Agreement and returned or deleted on request.

Our database is hosted in Ireland and our CRM in HubSpot’s EU data centre, and our server code runs on Vercel in Dublin — so a request is served, processed and stored inside the EU. Each school’s data is isolated, access is least-privilege, and data is encrypted in transit and at rest. A proposal link is a 128-bit random token rather than a guessable reference, and signature images are served through an authenticated proxy rather than from a public URL. AskArk tokenises identifiers before any AI processing, so the model sees anonymised data. We hold no formal security certification today; if your procurement needs a security questionnaire completed, email dpo@thearkhq.com and we will complete yours.

Where a school buys a subscription directly, checkout is hosted by Stripe. Card and bank details are handled by Stripe and never reach Ark HQ systems. Online subscriptions are annual and renew automatically; the billing, renewal and cancellation terms are in our Terms of Service. For a purchase order, an invoice or a tender, contact sales@thearkhq.com rather than using the checkout.

We follow the Data Protection Commission’s Fundamentals for a Child-Oriented Approach to Data Processing: minimise what we hold, keep it for the school, never use it to train a public model, and prefer on-device processing for the most sensitive summarising.

For any data-protection matter — a DPA, a DPIA, a sub-processor query or a data-subject request — contact dpo@thearkhq.com. That address reaches our Data Protection Officer.