Privacy policy

This page explains, in plain words, what information Archer keeps about you, why, where it lives, who else handles it, and what you can ask us to do.

Last updated: 6 October 2026

Who we are

Archer is an app made by Elven River, a small studio that helps brands with their marketing. Elven Heart is the home of Elven River's apps. Archer lives at app.elvenheart.com, and this website is elvenheart.com.

The one responsible for your information (the "data controller") is Dziugas Sablauskas, Lithuania.

Write to us about anything on this page at privacy@elvenheart.com. We answer within one month.

The short version

• Archer is open by invitation. We keep your email address and the details needed to let you in.
• What you write in Archer's chat goes to an AI company to get an answer. Pictures you ask for go to a picture AI.
• We do not sell your information, show ads, or use analytics services.
• You can ask us to show you, correct or delete your information at any time.
• If an organisation brought information about you into Archer, that organisation is in charge of it, and its own privacy notice explains it.

Two kinds of people, two roles

Archer's own users

You are one of Archer's own users if you have an Archer account, or if someone has put you on Archer's invited list. For your account, your profile, what you write in Archer and the records of your use, the studio is the controller. Most of this page is about you.

If an organisation brought your information

An organisation that uses Archer may bring information about other people, such as the people who ask about its courses, the families it calls, or the young people it works with. For that information the organisation is the controller, and the studio is its processor: we handle it only for that organisation's work and only on its instructions. If this is you, the organisation's own privacy notice explains how your information is used, and the organisation is the first place to ask. The section "People in an organisation's information" below says what Archer does with it.

This website

Our own pages on elvenheart.com set no cookies and use no analytics or advertising tools.

Other companies see your visit, because of how the web works:

• Cloudflare carries every request to our site, so it sees your IP address. It may set a short-lived security cookie to tell people apart from automated bots.
• Google Fonts serves the letters this page is written in, so your browser sends your IP address to Google.

Signing in

Archer is open by invitation. The first time, you come in with the invite code your team gave you, or with a personal welcome link the studio sends you. After that you can sign in with a password you chose, with a code we email to you, or with your Google account. Our emails, such as sign-in codes, are sent through Gmail. Gmail keeps a copy of each email we send in our mailbox, and we delete those copies by hand within 12 months. A sign-in code is useless 10 minutes after we send it.

If you choose a password, Supabase keeps it in a scrambled form that nobody can read back. Archer passes it on without keeping it, and notes only that you set one, and when.

When you sign in with Google

Google shares your name, your email address, whether that email is verified, a link to your profile picture, and your Google ID with Supabase. Supabase keeps them, on servers in Frankfurt, Germany, and updates them each time you sign in with Google. They travel only over encrypted connections, and they are deleted when your Archer account is deleted.

Archer itself uses only two things from that: your email address, to check that you were invited, and your Archer sign-in ID, to keep you signed in. Archer does not use your Google name or picture.

Archer's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain words: we use what Google tells us only to let you in, and we follow Google's rules about it. We never sell it, never use it for advertising, and never use it to train AI.

You can remove Archer's access to your Google account at any time at myaccount.google.com/connections.

The invited list

Archer keeps a list of the people who may sign in. For each person it holds the email address, name, organisation, title, role and access level, who invited them and when, when and how they joined, and whether the account is active. The list is a locked file on the studio's own computer.

Some of these details, such as your name, organisation and title, may come from the person who invited you. The name Archer shows is the one you, the person who invited you, or the studio typed in. If someone on the list already uses that name, Archer adds your workspace's short name to tell you apart. You can ask us to correct any of it.

If you add a profile picture or a short "about" line, Archer keeps those too, filed under your short code. Before your picture is sent, your browser cuts it to a small square, and Archer keeps no hidden details such as location. You can remove both yourself at any time.

Who sees what: other people signed in to Archer can see your profile picture. People in your workspace see your name, role and when you joined. Your workspace's owners and admins, and the studio team, also see your email address. Only you see your "about" line.

When you hear about this page

Archer does not write to you when someone invites you. The first pages Archer itself shows you are the welcome link, Create your account and Sign in. Since 6 October 2026, each of them carries a link to this policy, and the welcome-link page also tells you that your name and details came from the person who invited you.

Cookies and browser storage

The app at app.elvenheart.com uses cookies only to keep you signed in. None are for advertising or analytics.

The app also keeps things in your browser's own storage, on your device only: a copy of your chats with Archer and the drafts and pictures made in them (up to 50 conversations), your settings such as the AI model and which tab was open, unfinished drafts, whether you have seen the welcome, and, until the browser closes, whether you said the computer is shared.

Signing out does not erase the chat copies in your browser. To remove them, use the button that clears your chats, or clear this site's data in your browser. On a shared computer, please do this before you leave.

Pages in the app load their letters from Google Fonts too, so your browser sends your IP address to Google there as well.

Records of use and safety

To keep Archer safe and fix problems, the studio's computer records when something in Archer changes: the time, the kind of action, the page, and the Archer sign-in ID, name and role of the person who did it. Archer also notes requests it turned away, such as a sign-in from an address that is not on the list, with the time, the page, the reason and the sign-in method, never who it was. A third record notes each change made in the app to the invited list: when, who made it (their Archer sign-in ID and name), what changed, and the short code of the person it was about. A fourth record notes each save of the studio's task board: the time, what changed on the board (never the words written), and the Archer sign-in ID, name and role of the person who saved it. These records never contain email addresses or IP addresses. How long they are kept is under "How long we keep things".

When you agree to Archer's Terms of Use, Archer writes down when, which version, your Archer sign-in ID and your short code, so we can show the agreement later.

To stop someone from guessing codes or passwords, or from flooding the sign-in, Archer counts recent attempts per IP address and per email address typed. Those counts live only in the computer's working memory and are forgotten when Archer restarts.

Supabase also keeps records of each sign-in session, which include your IP address and browser type.

What you write and make in Archer

When you use Archer's chat, or ask Archer to read a brand or a document you add, what you write and add is sent to Anthropic, the company that makes the Claude AI, through Archer's business account, to get an answer. When you ask for a finished picture, a short description of it and any photos it should build on are sent to OpenAI. Archer does not add your name or email to these requests, but anything you type is sent as you wrote it.

Under their business terms, Anthropic and OpenAI do not use what Archer sends them to train their AI. The studio's own picture test page, which only the studio team uses, can also send a picture description and example photos to another picture AI, Higgsfield. Higgsfield's terms let it use what it receives to train its AI, and what is already in its AI cannot be taken out again. How long each company keeps things is under "How long we keep things".

Chats typed on the studio's own Mac, and some chats from the studio team's own accounts, may run through the studio's own Claude subscription instead of Archer's business account. That subscription is under Anthropic's terms for individuals, and for those chats Anthropic is a controller in its own right. Chats from anyone else's account through app.elvenheart.com do not take that path today.

Besides the copy in your browser, when Archer's chat sends a message to Anthropic through Archer's business account, the studio's computer keeps a record of it: exactly what was sent to the AI and what came back. Since 6 October 2026 each new record also carries the short code of the person who asked, so we can find a person's records when they ask us to delete them. Chats that run through the studio's own Claude subscription do not make this record: the program that runs them keeps its own record of the conversation on the studio's Mac. One older test page also keeps its own copy of the messages typed into it, without a name.

Archer's chat may also write short notes from a conversation into the brand's working pages. The chat records and these notes sit in a folder on the studio's Mac, and Apple iCloud Drive keeps a copy of that folder. The studio team can read them.

Archer also keeps other things people write or add while they work: answers and notes on drafts, homework answers, call notes, review notes on ads with the reviewer's name, comments on the studio's task board, documents added to the library (earlier versions are kept), and pictures added to the brand's storage. These belong to the brand's workspace rather than to you alone. They are kept in a folder on the studio's Mac, with a copy in Apple iCloud Drive, and they stay when your access ends unless the brand asks us to remove them.

Accounts a brand connects

A brand can let Archer read its own accounts, such as Meta ads, Pipedrive, Shopify, Klaviyo and Google Analytics. Archer only reads them and never changes anything there. These accounts are the brand's own, under the brand's own contracts with those companies. Archer reads them with the brand's own keys, for the brand, and what it reads there is the brand's information (see "People in an organisation's information").

A brand can also connect its social media accounts, such as Instagram, so Archer can publish posts. A person approves every post, and Archer publishes it only at the time that person chose. Archer then keeps a secret key from that network and the account's name and number, in a locked folder on the studio's computer. When a post goes out, its words and pictures go to that network, which then handles the post under its own terms. A brand can disconnect an account at any time, and we then delete the key.

Messages to the studio

The studio gets short messages on Telegram, so that it hears about important moments on a phone. Since 6 October 2026, Archer's automatic alert, join and welcome messages on Telegram carry no one's name, no email address and no invite code. About a person they say only which workspace, what kind of thing happened and when, and, in the commands that let a person in or take them off, that person's short code. This is everything they can say about a person:

• When someone joins with an invite code: that someone joined, the workspace, whether they joined as its owner or a team member or are waiting to be let in, how many of the code's places are taken, and the commands to let them in or take them off, which name them only by their short code. Someone who joins VKA waits until the studio lets them in, and the studio needs that short code to do it.
• When someone uses a welcome link: that someone did, the workspace and their role.
• When a brand's sales list gets a new enquiry: that an enquiry arrived, when, and which sales pipeline it is in, with a link into Archer, which shows who it is only after signing in.

Other messages name no one either: when too many people try to join with one code in an hour, when a brand's reading cannot run, when Archer's own sign-in emails reach their limit, and notes about a brand's ad spending and email tools, which name the brand's campaign or email flow. Since 6 October 2026, none of Archer's automatic messages to the studio, on Telegram or by email, contains an email address or an invite code.

The notes about new enquiries, ad spending and email tools can also go by email to the studio's own mailbox, Gmail. The email about a new enquiry still names the person and gives the enquiry's title as the brand's sales list has them, and its value. Archer keeps the newest 300 of these notes, with those names, in its alert log, in its working folder on the studio's Mac. Telegram keeps a message until it is deleted, and messages sent before 6 October 2026 can still name people, so we delete these messages and emails by hand within 12 months.

The studio also talks with Archer on Telegram, through a chat line that only one person on the studio team uses. On the other end is Claude, Anthropic's AI, running on the studio's Mac under the studio's own Claude subscription (see "What you write and make in Archer"). Its answers are written as it goes, so they are not limited to the list above. It can read the studio's working folder, including the alert log and the studio's task board, so an answer can include a name it found there. When that person starts a piece of work from the chat line, the reports on that work go to their phone too, with the task's title and a short summary of what was done, which can name a person.

People in an organisation's information

Organisations that use Archer may bring information about the people they serve, such as the people who ask about their courses, the families they call, or details about their students, and sometimes these are young people. For this information the organisation is the controller. It decides why the information is used, and its own privacy notice should tell these people about it. The studio is its processor: we handle the information only for that organisation's work and only on its instructions.

Where it goes: it is kept in a folder on the studio's Mac, partly with a copy in Apple iCloud Drive. Parts of it can reach Anthropic when Archer's chat reads the brand's pages, through Archer's business account or through the studio's own Claude subscription (the studio's own chat can read the brand's pages through Archer's tools). Parts can reach the studio's mailbox when a new enquiry arrives, and Telegram when the studio's chat line on Telegram reads it. Since 6 October 2026, the automatic Telegram note about a new enquiry names no one (see "Messages to the studio"). It is kept apart from Archer's sign-in accounts.

Some organisations also ask people, among them young people, to fill in a questionnaire on the studio's site elvenriver.com. Its pages are served by Vercel, and the answers are stored with Supabase on servers in Frankfurt, Germany, for that organisation. The written portraits the studio prepares about these young people for the organisation, and their downloadable summaries, are stored there too, so the organisation can read them on that site.

If this is about you or your child, please ask the organisation first. We will help it answer, and you can also write to us.

Archer accounts are for people aged 18 and over. We ask organisations not to invite anyone younger. If we learn that an account belongs to someone under 18, we switch it off and delete it.

Companies that receive information

Some of these companies work for us as processors, under data processing terms that are part of their business terms. Others handle what they receive under their own terms, as controllers in their own right.

The accounts a brand connects (Meta, Pipedrive, Shopify, Klaviyo, Google Analytics) are not on this list, because they are the brand's own, under the brand's own contracts. When Archer publishes a post to a brand's Instagram, Meta handles the post under its own terms.

We do not sell your information, we do not show ads, and we do not use analytics services.

Information leaving the European Union

Where each company is, and what protects information that goes to it from the EU. We checked the official list of the EU-US Data Privacy Framework (a set of rules the EU recognises for US companies that sign up to it) on 6 October 2026.

• Supabase: the company, Supabase Pte. Ltd., is in Singapore. Archer's Supabase servers are in Frankfurt, Germany. Supabase's data processing terms include the EU's standard contractual clauses (contract terms the EU has approved for this) for any information that reaches it outside the EU.
• Cloudflare: Cloudflare, Inc. is in the United States and is certified under the EU-US Data Privacy Framework. Its data processing terms also include the EU's standard contractual clauses as a fallback.
• Anthropic: Anthropic Ireland, Limited serves customers in Europe. For Archer's business account, Anthropic's data processing terms use the EU's standard contractual clauses when information leaves the EU. Anthropic is not on the Data Privacy Framework list. For chats through the studio's own Claude subscription, Anthropic follows its own privacy policy, which relies on EU decisions that a country protects data well enough, the EU's standard contractual clauses, or the other exceptions the law allows.
• OpenAI: OpenAI Ireland Ltd. serves customers in Europe. Its data processing terms use the EU's standard contractual clauses, or an EU decision that a country protects data well enough, when information leaves the EU. OpenAI is not on the Data Privacy Framework list.
• Google: Google Ireland Limited provides Gmail and Google's other services to people in Europe. Google LLC in the United States is certified under the EU-US Data Privacy Framework.
• Apple: Apple Distribution International Ltd. in Cork, Ireland, provides iCloud in Europe. Apple uses the EU's standard contractual clauses when information leaves the EU.
• Higgsfield: Higgsfield Inc. is in San Francisco, United States. Its privacy policy names the EU-US Data Privacy Framework and the EU's standard contractual clauses, but it is not on the Data Privacy Framework list, and it offers its customers no data processing terms. Only the studio team's own test pictures go there.
• TypeSafe AI: TypeSafe AI, Inc. is in San Francisco, United States. Its privacy policy says its service is hosted in the United States, and that information sent from Europe is stored and processed there. It names no EU safeguard, neither the Data Privacy Framework nor the EU's standard contractual clauses, it publishes no data processing terms, and it is not on the Data Privacy Framework list. Its privacy policy says it does not train its AI on what it receives. Only the words of the studio's own task board cards go there, from the test the studio runs by hand. As of 6 October 2026, cards had gone there on one day only, 5 October 2026.
• Vercel: Vercel Inc. is in the United States and is certified under the EU-US Data Privacy Framework.
• Telegram: Telegram Messenger Inc. is outside the EU, and its privacy policy does not say in which country. It stores the data of people who signed up in Europe in the Netherlands, and shares data with its group companies in the British Virgin Islands and Dubai under its own contracts. It offers people who run a Telegram bot, as we do, no data processing terms and no EU safeguard. So Archer's automatic messages send there only what is listed under "Messages to the studio": since 6 October 2026 no one's name, no email address and no invite code, only the workspace, the kind of event and when, and, in the commands that let a person in or take them off, that person's short code. What the studio's chat line reads can still go there, as described in the same section.

Ask us if you want more detail about any of these.

Why we may use your information

The law lets us use information only for a reason it accepts. Here is each thing we do, and the reason we rely on.

• Putting you on the invited list with the details the person who invited you gave, and running Archer for the people an organisation invites until they have an agreement with us themselves: a legitimate interest, meaning a fair reason we weighed against your privacy. It is the interest of the organisation that invited you in having its people work together in Archer, and the studio's interest in providing Archer to it.
• Running your account once you yourself have an agreement with the studio: that agreement (a contract). You make it when you agree to Archer's Terms of Use, which Archer asks for when you create your account, or on a one-time screen if you joined before the Terms existed.
• Keeping Archer safe and working: the records of use, the record of requests turned away, counting sign-in attempts, the chat records, and telling the studio that someone joined. The reason is the studio's legitimate interest in keeping Archer safe, fixing problems and knowing who comes in, which we weighed against your privacy.
• Keeping the record that you agreed to the Terms of Use: our legitimate interest in being able to show that agreement if it is ever questioned.
• Your profile picture and "about" line: your consent. You chose to add them, and you can take your consent back at any time by removing them, which deletes them.
• Answering your requests about your information, and keeping records the law asks for: because the law requires it (a legal obligation).
• Information an organisation brings about the people it serves: the organisation's own reason, which its notice explains. We act on its instructions.

You need to give us your email address to use Archer, because that is how we check you were invited and how you sign in. Everything else is up to you. Archer makes no decision about you by computer alone: people decide who gets in.

How long we keep things

• Your account and your line on the invited list: while you have access. After your access ends, we remove them by hand, in a monthly review, within 12 months at most, and sooner if you ask.
• Chat records on the studio's computer: removed in the first monthly clean-up after they turn 12 months old. The clean-up removes them together with the parts of them no younger record uses. Its monthly schedule is not switched on yet (6 October 2026); until it is, the studio runs it by hand. Archer's oldest chat records are from September 2026, so none has reached 12 months.
• Chats through the studio's own Claude subscription, and the older test page's copy of its messages: the clean-up does not reach these yet.
• Records of use: the record of changes in Archer, the record of task board saves, the record of requests turned away and the record of changes to the invited list are each removed in the first monthly clean-up after a line turns 12 months old, and never kept beyond their newest 20,000, 20,000, 5,000 and 5,000 entries.
• The alert log (the notes about new enquiries, ad spending and email tools, under "Messages to the studio"): removed in the first monthly clean-up after a note turns 12 months old, and never more than its newest 300 are kept. It sits in Archer's working folder on the studio's Mac, and Apple iCloud Drive keeps a copy of that folder.
• The record that you agreed to the Terms of Use: kept while your account exists and for 3 years after it ends, as proof of the agreement.
• Messages to the studio on Telegram, and the emails in the studio's mailbox (the sign-in codes we sent, the alert emails, the weekly report letters and the emails sent to privacy@elvenheart.com): we delete them by hand within 12 months. A sign-in code is useless 10 minutes after we send it.
• Work saved in a brand's space: as long as the brand uses Archer, or until the brand asks us to remove it.
• Copies in your own browser: until you clear them.

At the other companies

Each company keeps things on its own schedule. These are the schedules they publish for what Archer uses:

• Anthropic, through Archer's business account: deletes what it receives within 30 days. If its safety checks flag something as breaking its rules, it may keep that for up to 2 years, and the safety scores for up to 7 years.
• Anthropic, through the studio's own Claude subscription: deleted chats leave Anthropic's systems within 30 days. If the subscription's setting that lets Anthropic use chats to improve its AI is on, Anthropic may keep them, in a form that no longer names anyone, for up to 5 years. Flagged content is kept as above.
• OpenAI, for pictures: keeps a record for misuse checks for up to 30 days, and stores nothing else from these requests. Pictures flagged as possible child sexual abuse material are kept for a person at OpenAI to review.
• Apple iCloud Drive: a deleted file can be brought back from Recently Deleted for 30 days. Apple publishes no fixed time for removing it from its systems after that.
• Gmail: after we delete an email, Google says it takes about 2 months to clear it from its active systems, and its backups may hold it for up to 6 months.
• Higgsfield: keeps removed content on its active systems for 30 days, then in backups, and what is already in its AI cannot be taken out.
• TypeSafe AI: keeps what it receives for as long as it reasonably needs to provide its service or for its other business purposes, and publishes no fixed time.
• Telegram: keeps a message until it is deleted.

Deleting your information

To have your information removed, write to privacy@elvenheart.com. Within 30 days we delete:

• your line on the invited list, and your Supabase account (including the details Google shared). The same Supabase project also serves the studio's other tools, so if Archer did not create your account itself, we delete it by hand in Supabase;
• the note of when you set a password, and your profile picture and "about" line;
• the chat records that carry your short code, with the parts of them no one else's record uses. If a chat record also belongs to someone else, we take only your short code off it.

Chat records from before 6 October 2026, and chats sent while nobody was signed in, carry no short code, so we cannot promise to find them. We look for them by the times you used the chat and by anything you tell us you wrote, and we delete what we find; the clean-up removes the rest once they are 12 months old. We search the same way, on the studio's Mac, for chats that ran through the studio's own Claude subscription. The copies kept in your own browser are yours to delete.

What stays, by design:

• The records of use keep your name, Archer sign-in ID and short code until they reach their time or size limit, described above.
• The record that you agreed to the Terms of Use stays for 3 years after your account ends, as proof of the agreement.
• The Telegram message about your joining, and emails we sent you such as sign-in codes, stay until we delete them by hand, within 12 months (see above).
• Work you saved in a brand's space, such as a comment or a draft, belongs to that organisation and keeps your name. We can replace it with "a former member" if you ask.
• Copies at the other companies go on their own schedules, listed above.

Your rights

You can ask us to show you what we hold about you, correct it, delete it, limit how we use it, or give you a copy to take elsewhere. You can object to any use we base on our fair reason, and we will stop unless our reason clearly outweighs yours. Where you gave your consent, you can take it back at any time. Write to privacy@elvenheart.com, and we answer within one month.

You can also complain at any time to Lithuania's State Data Protection Inspectorate (vdai.lrv.lt), or to the data protection authority where you live or work.

Changes to this page

When the way we handle information changes, we update this page and the date at the top.