Privacy policy

1. Who we are

This support portal is operated by AR WEBSITE SOLUTIONS LTD, trading as AR Website Solutions ("we", "us", "our"). For the personal data described in this policy we are the data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

• Legal name: AR WEBSITE SOLUTIONS LTD, registered in England and Wales
• Company number: 17428939
• Registered office: 66 Paul Street, London, England, United Kingdom, EC2A 4NA
• Privacy contact: support@arwebsitesolutions.com

Where you send us personal data about your own customers or website visitors inside a ticket (for example, a form submission that isn't arriving), we handle that data as your processor under the terms of our website services agreement with you.

2. What this policy covers

This policy covers the AR Support Desk client portal: signing in, raising and managing support tickets, and uploading attachments. It does not cover the websites we build or host for you, which have their own privacy notices.

3. Information we collect

Account information

Your name, email address, the company you are associated with and your account role. Accounts are created by us, there is no public sign-up. Your password is never stored in readable form; it is held only as a one-way salted hash by our authentication provider.

Support content

Ticket subjects, descriptions, replies, the website a ticket relates to, and any files you attach (such as screenshots or documents).

Security and technical information

• Your IP address and browser user-agent when you sign in and while your session is active.
• Sign-in times, failed sign-in attempts and a log of security-relevant actions (for example password changes, account changes and ticket status changes).
• If you turn on two-factor authentication, an encrypted authenticator secret.

What we don't collect

We do not use analytics, advertising or tracking tools, and we do not load third-party scripts, fonts or pixels in this portal. Please do not put passwords, payment card details or special category data (such as health information) in tickets.

4. How and why we use it

We do not make decisions about you based solely on automated processing, and we never sell your personal data.

5. Who we share it with

We only share personal data with service providers who process it on our instructions under a written data processing agreement:

• Netlify, Inc., hosts the portal and runs the secure server functions that handle your requests. These functions currently run in the United States.
• Resend (Plus Five Five, Inc.), sends account emails such as password reset links and security notifications, and ticket update emails (for example when we reply to or update your ticket). It receives your name, email address and the email content only.
• Supabase, Inc., provides the encrypted database, authentication and private file storage. Data is stored in the European Union (Ireland).

We may also disclose information if required by law, to protect the rights, safety or security of our clients, ourselves or others, or to professional advisers under a duty of confidentiality. Within AR Website Solutions, access is limited to staff who need it to provide support.

6. International transfers

Our providers are US-headquartered and some of their infrastructure or support teams may be outside the UK. Where personal data is transferred outside the UK we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with supplementary security measures such as encryption in transit and at rest.

7. How long we keep it

8. How we protect it

• All traffic is encrypted with HTTPS (HSTS enforced); data is encrypted at rest by our providers.
• Your browser never receives database credentials or API keys. All data access happens server-side, and the database denies access to anything else.
• Sessions use secure, HttpOnly, same-site cookies; only a hash of the session token is stored.
• Optional two-factor authentication, rate-limiting of sign-in attempts and automatic session expiry.
• Attachments are stored privately, checked for their true file type, and only available to you and our support staff.
• Strict content security policy with no third-party code.

No system is completely secure. If we become aware of a personal data breach that is likely to put your rights at risk, we will notify you and the ICO as required by law.

9. Your rights

Under UK data protection law you have the right to:

• Access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to our processing, including processing based on legitimate interests;
• data portability, receive data you provided in a machine-readable format;
• withdraw consent at any time where we rely on it (for example, preference storage).

To exercise a right, email support@arwebsitesolutions.com. We'll respond within one month. We may need to verify your identity first. There is normally no fee.

10. Cookies

We use only the cookies needed to keep you securely signed in, plus optional preference storage if you agree. Full details are in our cookie policy.

11. Changes to this policy

We may update this policy from time to time. The "last updated" date shows when it last changed. If we make significant changes we'll let you know through the portal or by email.

12. Contact us and complaints

Questions or concerns: support@arwebsitesolutions.com or write to us at AR WEBSITE SOLUTIONS LTD, 66 Paul Street, London, England, United Kingdom, EC2A 4NA.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113. We'd appreciate the chance to resolve your concern first.