Privacy Policy

1. Who is responsible for information

ArchWalk is operated by Muhammad Usama, an independent business operator based in Pakistan, using the trading name ArchWalk. The website is archwalk.app and the service is ArchWalk 360. Privacy questions and requests may be directed to [email protected].

For our website, sales, security and our own customer-account administration, the ArchWalk operator generally determines why information is processed. When an organization uses ArchWalk to store, manage, publish or embed its property content, that organization may determine the purpose of processing personal information within its content and ArchWalk may act on its instructions. The roles depend on the particular activity and agreement. If you are a viewer or a client of an ArchWalk customer, that customer may be the appropriate first contact for a request concerning its content.

2. Information we collect and receive

• Account and organizational information: names, email addresses, identity-provider identifiers, session and authentication information, organization memberships, roles and relevant preferences.
• Projects and Experiences: property and Experience names, panoramas, floor plans, thumbnails, navigation hotspots, configuration, publishing history, access settings and related media. Where available, architectural design-review workspaces may also contain 3D models, comments, annotations and client feedback.
• Integration information: integration and organization identifiers, customer-supplied external customer/resource IDs, allowed origins, API/session credential records and usage information necessary to run hosted or embedded experiences.
• Viewer and technical information: Experience publication/version references, viewer-open session identifiers, whether a Viewer is direct or embedded, browser/device and network information in service requests, and security/diagnostic records. This information may also be present in hosting-provider logs.
• Payment and commercial information: purchased plan, subscription status, transaction references, billing dates, customer identifiers and information needed to administer access. For Paddle purchases, payment-card entry and the underlying payment transaction are handled by Paddle rather than an ArchWalk card-entry form.
• Communications: names, contact details, organization information and messages submitted for demonstrations, sales, support or invitations.
• Optional AI interactions: user prompts, project briefs, relevant scene and comment context, preceding messages and an optional image snapshot of the current view if supplied when requesting an AI response.

Property media may itself include identifiable people, addresses, family photos, vehicles or documents. Customers should review and obtain any necessary permissions before uploading or publishing such material.

3. Purposes and legal bases

We use information to deliver purchased services, manage accounts, provide the features you request, troubleshoot and secure the platform, answer inquiries, manage billing-related entitlements and meet legal obligations. The applicable legal basis depends on the activity, our relationship with the person and the relevant law. Where UK GDPR or EU GDPR applies, typical grounds may include contractual necessity, legitimate interests in operating a secure service, compliance with legal obligations, or consent where required for optional technologies.

Where we rely on legitimate interests, they include preventing abuse, keeping the service secure and dependable, and responding to business inquiries, balanced against the rights and expectations of the people affected. Optional cookies or comparable technologies may require consent depending on their purpose and the laws that apply.

4. Managed media, external media and published viewers

Under managed-media use, ArchWalk stores and serves uploaded panorama files and related media for a customer. Under external-media integrations, the customer retains the original media on a customer-controlled CDN or storage service; ArchWalk processes the supplied URLs, metadata and technical validation information needed to use the media. Other Experience configuration and publication information may still be stored by ArchWalk in either mode.

Unpublished workspace content is not the same as a published Experience. When a customer publishes or shares a Viewer link or embeds a Viewer on a website/app, selected published content may become accessible to people visiting that link or site. Customers must decide what is appropriate to publish and manage their own sharing and access choices. Access to a published Viewer should not be treated as equivalent to secure private file storage.

5. AI-assisted features

If an available AI feature is used, ArchWalk may send the requested text and context to OpenAI for generating an answer. In the architectural-review workflow, that context can include a project brief, scene details, excerpts of comments or conversation history and an optional current-view image snapshot. Do not submit confidential or sensitive personal information to an AI feature unless you have authority to do so.

AI responses can be incomplete or incorrect and should be reviewed independently. We do not use AI output as the sole basis for legal or similarly significant decisions about individuals. Provider-side retention, handling and any model-training arrangements must be checked against the applicable service terms and deployment configuration; this notice does not promise that all AI input stays only on ArchWalk infrastructure.

6. Service providers and sharing

We use third-party infrastructure and tools to run ArchWalk. The implementation includes Clerk for authentication; Railway for application hosting; Neon for database services; Cloudflare R2 for relevant managed media and backup storage; Sentry for error monitoring; and OpenAI for AI features when used. Account invitations and other messages may be delivered through Clerk or Resend, depending on the configured delivery path. Which providers receive a particular item of information depends on the service feature used.

For eligible purchases, Paddle is Merchant of Record and processes buyer and transaction information under its own privacy obligations. Paddle is not simply a card processor acting exclusively on ArchWalk's instructions; it acts independently for relevant buyer information. We also may disclose information when legally required or reasonably necessary to protect the service, users or rights.

We do not claim that customer content is public merely because it is stored on our infrastructure. Visibility depends on the customer's sharing and publication choices, subject to lawful disclosures and necessary processing by providers.

7. Cookies and similar technology

Authentication, application session continuity, organization selection and security can involve cookies or comparable browser storage. Error monitoring and service diagnostics may process technical information. Any non-essential analytics, advertising or measurement technologies must be assessed separately and, where required, enabled only with an appropriate user choice. Cookie and tracking practices may change as features are deployed; this section must remain consistent with the technologies actually used on the live website.

8. Retention, deletion and backups

Retention depends on the category of information and why it is needed. Active account and Experience information may remain while the relevant account, contract, published content or organization is maintained. Certain deleted resources are subject to recovery or cleanup workflows rather than disappearing instantly. Operational records can be retained for reliability, abuse prevention, accounting, dispute resolution and legal obligations.

Database backups and cloud-provider copies may continue to contain data for limited periods after deletion from active systems, subject to applicable backup rotation and provider controls. Requests to delete data will be assessed against the customer's rights, the ownership of the information and any retention obligations. We cannot guarantee immediate erasure of every copy across all systems.

9. Security and international processing

We use authentication and permission controls, service isolation and operational safeguards intended to protect information. Internet services still carry inherent risk and no method of transmission or storage is completely secure.

Our providers operate infrastructure in multiple jurisdictions, so information may be transferred to or accessed from countries outside the customer's country. Where transfer restrictions apply, suitable safeguards and their availability must be assessed under the applicable provider agreements and law. Contact us for information about transfers relevant to your use.

10. Your rights and requests

Depending on your location and the applicable law, you may have rights to access, correct, delete, restrict or export personal information, or to object to certain processing. Where consent is the basis of processing, you may be able to withdraw it. You may also have a right to complain to the appropriate data-protection authority. We may need to verify identity and coordinate with the organization controlling Customer Content before acting.

For privacy requests, contact [email protected]. Include enough detail to identify the relevant account or Experience; do not email passwords or card numbers.

11. Children, third-party sites and changes

ArchWalk is intended for professional and business use and is not directed at children. Customer-provided links, embedded experiences, external media hosts and third-party sites can have their own privacy practices. We may update this notice to reflect service, legal or operational changes and will update the date shown above; where required, we will also provide separate notice.

See our Terms of Service and Refund Policy for related terms.