StandardArc Systems Privacy Policy

Last updated: September 12, 2026

StandardArc Systems (“StandardArc,” “we,” “us,” or “our”) provides digital business software and services, including EarnedShield and VendorGate (collectively, the “Services”). This Privacy Policy explains how we collect, use, disclose, protect, and retain information when you visit our website, purchase a product, access a StandardArc workspace, communicate with us, or otherwise use our Services.

1. Information We Collect

Depending on the Service you use, we may collect or process:

• Contact and account information, such as name, business name, email address, telephone number, organization membership, role, and workspace information.
• Purchase and transaction information, including products purchased, order details, payment status, transaction identifiers, refunds, and Shopify order information. Payment-card information is processed by Shopify and its payment providers; StandardArc does not need to store complete payment-card numbers in our application databases.
• EarnedShield operational information, which may include bids, opportunities, projects, contract values, estimated costs, budgets, change orders, invoices, accounts-receivable information, retainage, action items, contacts, workflow status, and related business records.
• VendorGate information, which may include vendor and subcontractor profiles, contacts, requirements, compliance documents, insurance or certification information, professional license information, provider or business identifiers, expiration dates, review decisions, correction requests, temporary approvals or waivers, project or location assignments, authorization decisions, readiness status, notifications, and audit history.
• Authentication and access information, including user identifiers, organization or vendor memberships, roles, temporary authentication tokens or links, sign-in events, and related security information.
• Technical and usage information, which may include browser type, device information, IP address, timestamps, security events, application activity, error information, and information about how a Service is accessed and used.
• Communications, including information you provide when contacting us for support, billing questions, refunds, security concerns, or other inquiries.

2. How We Use Information

We may use information to:

• Provide, operate, maintain, secure, and improve the Services.
• Process purchases and payment status.
• Provision and administer workspaces.
• Authenticate users and control access.
• Calculate dashboards and workflow indicators.
• Evaluate configured vendor-readiness conditions.
• Provide expiration alerts and notifications.
• Support document review and authorization workflows.
• Respond to support requests.
• Detect fraud or unauthorized access.
• Maintain accounting, legal, security, and operational records.
• Communicate about account access, onboarding, service operation, security, billing, and support.

3. Customer and Vendor Data

Business information entered or uploaded into a StandardArc workspace remains associated with the customer organization that provided or controls it.

Customers are responsible for ensuring that they have the right and appropriate authority to enter, upload, use, and process information concerning employees, customers, vendors, subcontractors, project contacts, clinicians, professionals, and other people or businesses.

VendorGate may allow a vendor or professional invited by a customer to submit information directly. Vendor access is limited to the vendor profile or records assigned to that user under the applicable workspace controls.

4. VendorGate and Sensitive Records

VendorGate is currently designed to manage professional and business compliance evidence such as insurance, tax forms, licenses, certifications, training records, and business or provider identifiers.

The current VendorGate offering is not intended for patient charts, clinical treatment records, or other protected health information (PHI).

Do not upload patient medical or clinical records unless StandardArc expressly agrees in writing and any required compliance arrangements have been established.

5. Organization Isolation and Access Controls

StandardArc is designed to logically separate customer workspaces.

Depending on the Service and feature, safeguards may include:

• Authenticated access
• Organization-level database controls
• Row Level Security
• Role-based permissions
• Vendor-scoped access
• Private document storage
• Short-lived signed document links
• Server-side validation for sensitive operations
• Audit records for important decisions

No internet-based system can provide absolute or perfect security.

Customers are responsible for securing their own devices, networks, email accounts, and authorized users.

6. Shopify and Payment Processing

Our storefront and ecommerce transactions are powered by Shopify.

Shopify and its payment providers may independently collect and process information needed for checkout, fraud prevention, payments, customer accounts, privacy controls, and ecommerce services.

StandardArc receives information needed to determine whether a qualifying order has been paid and to provision the applicable product or workspace.

7. Service Providers

We use third-party providers to operate portions of the Services, which may include ecommerce, cloud database, authentication, application hosting, transactional email, domain, security, and infrastructure providers.

Current infrastructure may include Shopify, Supabase, Vercel, and transactional email providers.

These providers process information subject to their own applicable contractual, security, and privacy obligations.

8. Automated Processing and Decision Support

StandardArc may automatically analyze customer-entered information to generate calculations, alerts, readiness states, expiration notices, action items, project-clearance indicators, or other workflow outputs.

These outputs are business decision-support tools.

They do not constitute legal, accounting, tax, financial, insurance, engineering, medical, clinical, or other licensed professional advice, and they do not independently certify legal compliance.

9. Disclosure of Information

We may disclose information:

• To service providers that help operate the Services.
• To Shopify and payment providers in connection with ecommerce transactions.
• At your direction or with your consent.
• When reasonably necessary to comply with law or valid governmental process.
• To investigate fraud, abuse, security incidents, or violations of our terms.
• To protect StandardArc, our customers, users, or others.
• In connection with a business transaction such as a merger, acquisition, financing, reorganization, or sale of assets, subject to applicable requirements.

We do not sell customer operational data or VendorGate compliance data as a standalone data product.

10. Data Retention

We retain information for as long as reasonably necessary to provide the Services, administer accounts and workspaces, maintain transaction and security records, comply with legal obligations, resolve disputes, enforce agreements, and support legitimate business operations.

Retention periods may vary by information type and purpose.

11. Privacy Rights

Depending on where you reside, applicable law may provide rights regarding personal information, including rights to request access, correction, deletion, portability, or information regarding certain uses or disclosures.

Rights are subject to applicable limitations and verification requirements.

12. Children

StandardArc provides business services and does not knowingly offer the Services to children for consumer use.

13. Third-Party Links and International Processing

Our website or Services may contain links to third-party services governed by their own policies.

Service providers may process or store information in the United States or other jurisdictions, subject to applicable legal requirements.

14. Changes to This Policy

We may update this Privacy Policy as our Services, technology, or applicable requirements change.

The current version will be posted through our website or storefront with an updated date.

15. Contact

StandardArc Systems
7901 4th St N, STE 300
St. Petersburg, FL 33702

Email: support@standardarcsystems.com
Phone: 321-220-7272
Website: standardarcsystems.com

Please do not send passwords, authentication codes, API keys, payment-card information, patient records, or other highly sensitive credentials or records through ordinary email.