Privacy policy
This policy explains what ARCA Filing stores, why, how it is protected and for how long. The Customer that files the reports is the controller of the data in them; ARCA Compliance processes those data on its behalf to provide the Service.
1. What we store
Filer identity: the filing institution's legal name, identification numbers, addresses, contacts and the transmitter details needed for the batch.
Part I persons: names, dates of birth, addresses, taxpayer and other identification numbers, occupation and the cash amounts of each transaction, exactly as the reports require.
Uploaded files: the CSV or Excel files imported, the generated XML batches, the signed PDF the Customer chooses to keep and the acknowledgments FinCEN returns.
Account and usage data: the people who sign in through the ARCA Compliance platform, their actions in the Service and technical logs.
2. Why
To prepare, validate and track the CTRs the Customer files, to keep the records FinCEN requires the filer to keep, to operate and secure the Service and to meet legal obligations. We do not use these data for advertising and we do not sell them.
3. Protection
Personal identifiers of Part I persons (names, dates of birth, identification numbers, addresses) are encrypted at rest. Every access to a report, a person or a file is written to an access log the Customer can review. Connections use TLS and people are authenticated by the ARCA Compliance platform.
4. Retention
CTR records, batches and acknowledgments are kept for at least 5 years from the filing date, as FinCEN requires of the filer; the Customer may configure a longer period. Raw import rows that did not become a report are purged 30 days after the import. Technical logs are kept for 12 months.
5. Sub-processors
The Service runs on cloud infrastructure and uses email delivery and error-monitoring providers. The current list of sub-processors is [sub-processors] and is updated before a new one handles Customer data.
6. Your rights and contact
Requests to access, correct, export or delete data, within the limits of the retention FinCEN imposes, go to the Customer that filed the reports or to the Provider at [email]. We answer within 30 days.
7. Cookies
The Service sets only a language cookie and keeps the sign-in session in the browser. It uses no advertising or third-party tracking cookies.
8. Changes
Changes to this policy are announced in the Service or by email before they take effect, with the date of the last update shown at the top.