Privacy Policy

1. Who We Are

This Privacy Policy explains how ARQDIA MAYA LTD (ארקדיה מאיה בע״מ), a Private Limited Liability Company registered in Israel under Tax ID 517277141 ("Arqdia", "we", "us", or "our"), collects, uses, discloses, and protects personal information when you visit https://arqdia.com ("Website"), create an Arqdia account, use our property- management software, or otherwise interact with our services (collectively, the "Services").

Our registered address is 18 Arik Einstein St, Herzliya, 4659078, Israel. For any privacy-related question you can reach us at compliance@arqdia.com.

2. Scope of This Policy

This Policy applies to personal information we process about:

• Visitors to https://arqdia.com;
• Customers, prospective customers, and authorised users who sign in to the Arqdia property-management platform;
• Property guests whose contact information our customers upload to the platform so we can deliver messaging, reservation, and operational features on the customer's behalf; and
• Recipients of SMS, WhatsApp, Telegram, or email communications that are sent through Arqdia.

When our customers (property managers and hospitality businesses) upload guest information to the platform, Arqdia acts as a processor on their behalf. When you sign up directly for the Arqdia Website or for our own marketing communications, Arqdia acts as a controller.

3. Information We Collect

We collect the following categories of information:

• Account information — name, email address, mobile phone number, hashed password, role within the customer's organisation, profile image, and language preference.
• Property and booking data — listing details, calendars, rates, channel-manager identifiers, reservation metadata, guest first/last name, guest email, guest phone number, check-in / check-out dates, payment status, and platform reviews.
• Messaging data — the content and metadata of SMS, WhatsApp, Telegram, and email messages routed through Arqdia on a customer's behalf, including delivery receipts and opt-in / opt-out events.
• Payment and billing information — billing contact, VAT or Tax ID, invoices, and the last four digits of the payment card; full card numbers are processed by our PCI-DSS-compliant payment processor and are never stored on Arqdia servers.
• Technical and usage information — IP address, browser type and version, device identifiers, operating system, referring URL, pages visited, feature- usage events, error logs, and cookie identifiers.
• Communications you send us — support tickets, contact-form submissions, chat transcripts, and any documents you voluntarily provide.

4. How We Use Your Information

We use personal information to:

• Provide, operate, maintain, and improve the Services, including authentication, billing, account administration, and customer support;
• Deliver transactional and operational messages on behalf of our customers (booking confirmations, check-in instructions, overbooking resolution, payment reminders, review responses);
• Detect, investigate, and prevent fraud, abuse, security incidents, and other harmful or illegal activity;
• Generate aggregated, de-identified analytics and benchmarks to improve the Services and the recommendations our AI agents produce;
• Comply with legal, accounting, tax, and regulatory obligations;
• With your consent, send you marketing communications about Arqdia's own products. You can withdraw this consent at any time (see Section 12).

5. Legal Bases for Processing

Where the EU GDPR, UK GDPR, or Israel's Protection of Privacy Law applies, we rely on the following legal bases:

• Contract — to deliver the Services you or your organisation purchased.
• Legitimate interests — to secure our systems, prevent abuse, improve the Services, and pursue ordinary business administration in a way that does not override your fundamental rights.
• Consent — for marketing communications, optional cookies, and any other processing that requires consent under applicable law.
• Legal obligation — to comply with tax, accounting, anti-money-laundering, and other statutory duties.

6. SMS, WhatsApp & Messaging Programs

Arqdia operates messaging programs that send transactional, operational, and (where permitted) marketing messages over SMS, WhatsApp, and Telegram. These messages may originate from Arqdia directly or be sent on behalf of an Arqdia customer (such as a property manager) using carrier infrastructure provided by Twilio Inc., Meta Platforms Inc., and other regulated communications providers.

Consent. You will only receive messages after you (or the entity acting on your behalf, such as a booking platform you used to reserve a stay) have provided consent in accordance with applicable law. Message frequency varies based on your reservation, conversations with the property, and the operational events that affect your stay.

Cost. Standard message and data rates from your mobile carrier may apply. Arqdia does not charge you for receiving these messages.

Opt-out. You can opt out of any SMS messaging program at any time by replying STOP to any message we send you. To request help, reply HELP. For WhatsApp and Telegram, you may opt out by replying STOP or by using the platform's native block / unsubscribe control. After opting out you will no longer receive messages from that program, except for one confirmation message. To unsubscribe from messages tied to a specific reservation you may also contact the property directly or email us at compliance@arqdia.com.

Carriers are not liable. Carriers are not liable for delayed or undelivered messages.

7. How We Share Information

We share personal information only with:

• The Arqdia customer whose account the information was uploaded under (e.g. a property manager acting as data controller for their guests);
• Sub-processors and service providers that power the platform — including cloud hosting (AWS), messaging carriers (Twilio, Meta / WhatsApp Business), payment processing, email delivery, analytics, error monitoring, customer support tooling, and AI inference providers. These vendors are bound by written data- processing agreements and may use the information only to perform services for Arqdia;
• Property-management integrations you or your organisation connect (Lodgify, Mews, Guesty, Hostfully, Airbnb, Booking.com, and similar platforms), to the extent required to mirror reservations, pricing, and availability on your behalf;
• Professional advisors (lawyers, accountants, auditors) under duties of confidentiality;
• Authorities, regulators, or other parties when required by law, court order, or to protect the rights, safety, and property of Arqdia, our users, or the public; and
• An acquirer in connection with a merger, acquisition, financing, reorganisation, or sale of all or part of our business, subject to appropriate confidentiality safeguards.

8. No Sale or Sharing of Phone Numbers for Marketing

Arqdia does not sell, rent, lease, or otherwise share personal information — including mobile phone numbers and SMS / WhatsApp opt-in data — with third parties or affiliates for their own marketing or promotional purposes. The only entities that receive your phone number or messaging opt-in status are the sub-processors and integration partners described in Section 7, and only to the extent strictly necessary to deliver the Services you (or the Arqdia customer acting on your behalf) have requested.

This restriction applies to information collected through the Website, the Arqdia platform, our APIs, and any SMS or WhatsApp messaging programs we operate.

9. International Data Transfers

Arqdia is headquartered in Israel and uses cloud infrastructure located primarily in the European Union (Stockholm region) and the United States. By using the Services you acknowledge that your information may be transferred to, processed in, and stored in countries other than your own. Where personal information originates in the European Economic Area, the United Kingdom, or Switzerland and is transferred outside those jurisdictions, we rely on the European Commission's Standard Contractual Clauses, an adequacy decision, or another lawful transfer mechanism.

10. Data Retention

We retain personal information for as long as we need it to deliver the Services, comply with our legal and tax obligations, resolve disputes, and enforce our agreements. Account and reservation records are kept for the duration of the customer relationship plus seven years to meet Israeli tax-record-keeping obligations. Marketing-consent logs are retained for the period required to demonstrate compliance. Messaging logs are retained no longer than 24 months unless a longer period is required for fraud prevention or legal defence. Anonymised, aggregated analytics may be retained indefinitely because they cannot be used to identify you.

11. Security

We protect personal information with administrative, technical, and physical safeguards designed to be appropriate to the sensitivity of the data, including transport-layer encryption (TLS 1.2+), encryption at rest for databases and backups, role-based access control, least-privilege service authentication, audit logging, multi-factor authentication for staff, and continuous vulnerability scanning of our infrastructure. No system can be guaranteed to be 100% secure; if you have reason to believe your interaction with us is no longer secure, please contact us immediately at compliance@arqdia.com.

12. Your Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Request deletion of your information;
• Restrict or object to certain processing;
• Receive a portable copy of your information;
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• Opt out of any SMS, WhatsApp, or email marketing communications; and
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email compliance@arqdia.com. We will respond within the time frames required by applicable law and may need to verify your identity before acting on a request.

13. Children's Privacy

The Services are intended for adults engaged in property- management activities. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us at compliance@arqdia.com and we will delete it.

14. Third-Party Links & Services

The Services may contain links to third-party websites or integrate with third-party platforms (channel managers, payment providers, messaging carriers, etc.). This Policy does not apply to those third-party services, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third party you interact with through Arqdia.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will notify you by updating the "Last updated" date at the top of this page and, where appropriate, by email or in-product notice. Continued use of the Services after the changes take effect constitutes acceptance of the revised Policy.

16. Contact Us

For any question about this Privacy Policy or our handling of your personal information, please contact: