Privacy Policy
Effective date: 2026-08-01 · Last updated: 2026-07-31
Knaap ("we", "us") operates Arkidor, a browser-based ArchiMate® modelling tool available at app.arkidor.io, and the marketing website at arkidor.io.
We are committed to protecting your privacy. This policy explains what limited data we process and why.
1. Controller
Knaap
Itäinentie 50, 06100 Porvoo, Finland
Business ID: 2183315-9 · VAT: FI-21833159
Email: support@arkidor.io
2. The Principle: Your Data Stays With You
Arkidor runs entirely in your browser. Your architecture models are stored locally (in your browser's file system or IndexedDB for crash recovery) and are never uploaded to our servers. We cannot see, access, or recover your models.
3. What We Process
| Data Category | Purpose | Lawful Basis | Retention |
|---|---|---|---|
| Error reports Stack traces, browser type/version, OS, screen resolution, app version. No model content. No names or email addresses. |
Diagnosing and fixing software defects | Legitimate interest (Art. 6(1)(f) GDPR) | 90 days |
| Server access logs IP address, URL requested, timestamp, HTTP status code, user-agent string |
Security monitoring, abuse prevention, service availability | Legitimate interest (Art. 6(1)(f) GDPR) | 90 days |
| Feedback submissions Content you voluntarily submit via the feedback portal (feedback.arkidor.io), plus your email address if you choose to provide it |
Product improvement, responding to your suggestions | Consent (Art. 6(1)(a) GDPR) — you choose to submit | Until deleted by you or us, or until the feedback system is decommissioned |
3.1. What We Do NOT Collect
- Your architecture models or their contents
- Personal names or email addresses (except if voluntarily provided in feedback)
- Usage analytics or behavioural tracking
- Advertising identifiers or fingerprints
- Session recordings or screen replays
- Cookies for tracking purposes
4. Cookies and Local Storage
Arkidor uses no tracking cookies. We use browser localStorage and IndexedDB solely for:
- Auto-save and crash recovery (your model data, stored locally only)
- UI preferences (panel visibility, grid settings)
- Clipboard (copy/paste within the application)
- Recent file history (file names only, stored locally)
These are strictly necessary for the service you requested and do not require consent under the ePrivacy Directive (Article 5(3)).
5. Data Processors
| Processor | Purpose | Location | Safeguards |
|---|---|---|---|
| Functional Software, Inc. (Sentry) | Error monitoring | EU (eu.sentry.io) | Data Processing Agreement in place; sendDefaultPii: false |
| Amazon Web Services EMEA SARL | Static hosting (CloudFront CDN, S3), access logs | EU (eu-west-1, Ireland) | AWS Data Processing Addendum; data stays within EEA |
6. International Transfers
All personal data is processed within the European Economic Area (EEA). Our hosting infrastructure is in AWS eu-west-1 (Ireland). Sentry is configured for EU data residency. No personal data is transferred outside the EEA.
7. Your Rights
Under the GDPR, you have the right to:
- Access — request what personal data we hold about you
- Rectification — correct inaccurate data
- Erasure — request deletion of your data
- Restriction — limit how we process your data
- Object — object to processing based on legitimate interest
- Data portability — receive your data in a structured format
- Withdraw consent — for feedback submissions, at any time without affecting prior lawfulness
To exercise any right, email support@arkidor.io. We will respond within 30 days.
8. Right to Lodge a Complaint
If you believe your data protection rights have been violated, you may lodge a complaint with the Finnish Data Protection Ombudsman:
Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
Lintulahdenkuja 4, 00530 Helsinki, Finland
tietosuoja.fi
9. Security
We protect data in transit with TLS 1.2+ enforcement (HSTS with preload). Access to infrastructure is restricted by IAM policies with least-privilege access. Access logs are automatically deleted after 90 days. We do not store your models — because we never receive them.
10. Children
Arkidor is not directed at children under 16. We do not knowingly process personal data from children.
11. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via the Arkidor changelog or website. The "last updated" date at the top reflects the most recent revision.
12. Contact
For privacy-related enquiries:
support@arkidor.io
Knaap · Itäinentie 50 · 06100 Porvoo · Finland