Privacy Policy

1. Introduction and Our Roles

F7 Software Inc ("F7 Software," "we," "our," or "us") provides Arc Monitor Pro: the public website at arcmonitorpro.com, the customer portal (web dashboards, reports and account management), the weld monitoring units and optional operator login pendants we supply to customers ("Devices"), the REST API, the Power BI connector, and related documentation and support (collectively, the "Service"). This Privacy Policy explains what information we collect through the Service, how we use and share it, how long we keep it, and the choices you have.

We act in two different roles, and the rest of this policy is easier to read with that in mind:

• Controller for the personal information of website visitors, people who contact us, and the individual users of a customer account (for example a tenant administrator's name and email address). We decide how and why that information is processed.
• Processor (service provider) for the data a customer organization places in its account or generates through its Devices, including information about the customer's employees who log in at welding stations with an operator login pendant ("Customer Data" and "Operator Data"). The customer decides how and why that data is processed; we process it only to provide the Service under our agreement with the customer. If you are an employee of one of our customers and have a question about your data, please contact your employer, who controls it; we will assist them.

By accessing or using the Service you acknowledge that you have read this Privacy Policy. This policy is incorporated into our Terms of Service; capitalized terms not defined here have the meanings given there.

2. Information We Collect

2.1 Information You Provide Directly

• Account information: name, email address, company or organization name, role, and time zone
• Billing and invoicing contact details. If you pay by card, the payment is handled by a third-party payment processor; we do not store full card numbers or security codes on our servers
• Messages you send us through the contact form (name, email, phone, company, approximate number of welders, message) or by email and phone
• Configuration you enter in the portal: device names, device categories, locations and their time zones, dashboard layouts, alert recipients, and the API keys you create

2.2 Operator Data Entered by Your Organization

When a customer uses the optional operator login pendant, the customer's administrators enter an employee roster in the portal and the Service then attributes weld activity to the operator who was logged in. This Operator Data consists of:

• Employee name, Login ID, and, if the customer chooses, an employee category (for example a crew, shift or trade) and a home location
• Login and logout events at each welding station, the station used, and the weld minutes recorded while that operator was logged in
• Reports, exports, API responses and Power BI data derived from the above

The employee roster sent to a customer's Devices contains only names and Login IDs. We process Operator Data solely on the customer's instructions; the customer is responsible for telling its employees about the monitoring and for any notice or consent its local law requires (see the Terms of Service, section 7).

2.3 Information Collected Automatically

• Device telemetry from monitoring units: weld activity records at one-minute resolution (arc-on time), device serial numbers, firmware versions, health reports (uptime, memory, the name and signal strength of the Wi-Fi network the unit is joined to, connection quality), device error logs, and firmware update status
• Pendant telemetry relayed through the monitoring unit: the pendant's identifier (its Bluetooth address), model and firmware version, battery level, and pairing status
• MQTT client identifiers, connection times and broker session metadata used to authenticate Devices and route their data
• Refused broker connection attempts: the source IP address, the client identifier and username presented, protocol details and the reason the connection was refused, kept for a short period (seven days by default) to detect and block abuse. The password presented is never stored
• Server and application logs: IP address, browser and operating system, pages and endpoints requested, referring page, response codes, and timestamps
• API key usage records: which key was used, from which IP address, when, and for which endpoint, so that you can review how your keys are being used and we can detect abuse
• Approximate location (country) derived from your IP address, used for the country allowlist described in section 3. We do not collect precise GPS location

2.4 Information from Third Parties

• Bot-detection signals from Cloudflare, whose Turnstile challenge protects our login, password reset and contact forms
• Country lookups for IP addresses from our IP geolocation provider (see section 6)

2.5 Information We Do Not Collect

We do not use advertising trackers or third-party analytics on the Service, and we do not knowingly collect biometric data, precise geolocation, audio or video recordings, information from children under 16, or sensitive categories of personal information unless you provide them to us yourself.

3. How We Use Information

• To provide, operate, maintain and improve the Service, including receiving and storing Device telemetry and generating dashboards, reports, exports and API responses
• To attribute weld activity to logged-in operators and produce the employee reports your organization has configured
• To authenticate users, API keys and Devices, enforce role-based and tenant-scoped access, and apply the country allowlist your organization has configured for logins and API access
• To configure and update your Devices, including delivering names, rosters and settings to them and installing firmware updates over the air
• To send transactional email: account verification, password resets, two-factor authentication codes, invoices, and alerts such as a device that has stopped reporting
• To respond to your enquiries and support requests
• To invoice and collect fees, and to keep the records tax and accounting law require
• To detect, investigate and prevent fraud, abuse, unauthorized access and security incidents, including bot protection, rate limiting and honeypot form fields
• To comply with legal obligations and enforce our Terms of Service
• To produce anonymized, aggregated statistics that do not identify any person, customer or device

We do not sell, rent or trade personal information, and we do not use Customer Data or Operator Data to train machine-learning models for third parties or to build profiles of individual operators for our own purposes.

4. Legal Basis for Processing

Where applicable law requires a legal basis for processing personal information, we rely on:

• Contract performance — to provide the Service you or your organization signed up for
• Legitimate interests — to operate, secure and improve the Service, provided those interests are not overridden by your rights
• Legal obligation — to keep tax, accounting and regulatory records
• Consent — where the law requires it; you may withdraw consent at any time
• For Operator Data and other Customer Data, the customer organization determines the legal basis as controller

5. Sharing and Disclosure of Information

We do not sell personal information. We share information only:

• With sub-processors that help us deliver the Service (section 6), under contracts that limit them to processing on our instructions with appropriate safeguards
• Within your organization — administrators of a customer account can see the users, Devices, Operator Data and API keys of that account
• Through integrations you use — when you export data, use an API key, or connect the Power BI connector, the data goes where you send it
• In a business transfer such as a merger, acquisition or sale of assets, in which case we will notify you before your information becomes subject to a different privacy policy
• To comply with law or a valid legal process, or where we believe in good faith that disclosure is necessary to protect the rights, property or safety of F7 Software, our customers or others
• With your consent

6. Sub-Processors and Third Parties

The Service relies on a small number of providers:

• Cloudflare, Inc. — content delivery, DNS, web application firewall and the Turnstile bot challenge in front of the website and portal. Cloudflare sees the IP address and request metadata of every visitor
• IP geolocation provider (fraudcheckapi.com) — receives the IP address of a login or API request to return its country for the allowlist check
• Transactional email delivery provider — delivers the emails described in section 3
• Hosting — the portal, database, MQTT broker and backups run on servers in the United States operated by us or by our hosting provider
• Payment processor — only if you pay by card

We may change providers from time to time. A current list is available on written request to support [at] arcmonitorpro.com .

7. Data Retention

• Account data: for the life of the subscription and up to 90 days after it ends
• Customer Data and Operator Data (telemetry, weld records, roster, reports): for the life of the subscription. Nothing expires automatically while the account is active; an administrator may ask us to delete specific data earlier. After termination we delete or anonymize it within 90 days, unless the law requires us to keep it or we need it to resolve a dispute
• Contact form messages and support correspondence: up to 24 months
• Billing records: at least seven years, as tax and audit rules require
• Security, access and API usage logs: up to 24 months
• Backups: residual copies may remain in encrypted backups for up to 90 days after deletion from production systems

8. Data Security

We use commercially reasonable technical and organizational measures, including:

• TLS encryption for all web and API traffic, and MQTT over TLS with a unique secret for every Device
• Passwords and API keys stored only as salted hashes; secrets never sent in URLs
• Tenant-scoped access controls so each organization sees only its own data, and role-based permissions within an organization
• Optional two-factor authentication for user accounts
• Bot protection, rate limiting, a country allowlist for logins and API access, and security headers on every page
• Firmware updates delivered over authenticated, integrity-checked channels
• Encrypted backups, dependency monitoring, and least-privilege access for our staff

NO METHOD OF TRANSMISSION OR STORAGE IS COMPLETELY SECURE. WHILE WE WORK TO PROTECT YOUR INFORMATION, WE CANNOT GUARANTEE ABSOLUTE SECURITY. YOU ARE RESPONSIBLE FOR KEEPING YOUR ACCOUNT CREDENTIALS AND API KEYS CONFIDENTIAL AND FOR THE PHYSICAL SECURITY OF DEVICES INSTALLED AT YOUR SITE.

9. Your Rights and Choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information (account holders can edit most details in the portal)
• Delete your personal information, subject to legal retention obligations
• Port your data in a machine-readable form (the portal's CSV exports and the API cover Customer Data)
• Restrict or object to certain processing
• Withdraw consent where processing is based on consent
• Complain to your local data protection authority

To exercise a right, contact support [at] arcmonitorpro.com or write to the address in section 18. We respond within 30 days, or sooner where the law requires, and may ask you to verify your identity. If your request concerns Operator Data or other Customer Data held in a customer's account, we will refer it to that customer, who controls the data, and help them respond. We only send marketing email with your permission, and every such email includes an unsubscribe link.

10. Cookies and Similar Technologies

The Service sets only strictly necessary cookies: the signed-in session, the anti-forgery token that protects forms, and the data-protection keys those rely on. Your acknowledgement of the cookie notice is remembered in your browser's local storage. Cloudflare may set its own security cookies that are required to deliver the site and to run the Turnstile challenge. We do not use analytics, advertising or cross-site tracking cookies, and we do not participate in behavioral advertising networks. Blocking the strictly necessary cookies in your browser will prevent you from logging in.

11. Children's Privacy

The Service is for business and industrial use and is not directed to anyone under 16. We do not knowingly collect personal information from children. If you believe we have done so, contact us and we will delete it promptly.

12. International Data Transfers

The Service is operated from and hosted in the United States. If you use it from elsewhere, your information is transferred to, stored and processed in the United States, where data protection laws may differ from those in your country. Where we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and applicable supplementary measures.

13. U.S. State Privacy Rights

We do not "sell" or "share" personal information, and we do not process it for targeted advertising or for profiling that produces legal or similarly significant effects, as those terms are defined under U.S. state privacy laws. The rights in section 9 are available to everyone; this section adds the state-specific mechanics.

13.1 California (CCPA / CPRA)

California residents may request to know the categories and specific pieces of personal information we collect, the sources, purposes and recipients; to delete or correct personal information; to opt out of sale or sharing (we do neither); to limit the use of sensitive personal information (we do not use it for purposes requiring that option); and not to be discriminated against for exercising these rights. Send requests to support [at] arcmonitorpro.com with "California Privacy Request" in the subject line. You may use an authorized agent, subject to verification.

13.2 Other States

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Indiana, Tennessee, Florida, New Jersey, New Hampshire, Nebraska, Kentucky, Maryland, Minnesota and Rhode Island, as each law applies) may confirm whether we process their personal data, access it, correct it, delete it, obtain a portable copy, opt out of targeted advertising, sale or significant profiling (none of which we do), and appeal a decision on a request. Send requests to support [at] arcmonitorpro.com with your state and "State Privacy Request" in the subject line. We respond within the period your state's law sets, generally 45 days. If we decline a request you may appeal by replying to our response, and if the appeal is denied you may contact your state Attorney General. Where we process personal data on behalf of a customer organization we act as a processor or service provider and will refer your request to that organization.

14. European Privacy Rights (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the rights of access, rectification, erasure, restriction, portability and objection described in section 9, and the right to lodge a complaint with your supervisory authority. F7 Software Inc is the controller of the personal information of individual account holders and website visitors, and a processor of Customer Data and Operator Data on behalf of the customer organization. Processing on behalf of a customer is governed by our agreement with that customer; a data processing agreement is available on request.

15. Do Not Track Signals

Because there is no industry standard for interpreting "Do Not Track" browser signals, the Service does not respond to them. Since we use no tracking or advertising cookies, there is nothing on the Service for such a signal to switch off.

16. Security Breach Notification

If a security incident affects your personal information, we will notify you and any applicable authorities as required by law, without undue delay after we become aware of it, describing the nature of the incident, the information affected, the likely consequences, and the measures we have taken. Where the incident affects Customer Data or Operator Data, we notify the customer organization so it can meet its own obligations.

17. Changes to This Policy

We may update this policy as our practices, technology or the law change. For material changes we will notify account holders by email or by a prominent notice on the Service before the change takes effect. The "Last Updated" date at the top of this page shows when the policy was most recently revised. Continued use of the Service after the effective date of an update constitutes acceptance of the updated policy.

18. Contact Us

Questions, concerns or requests about this policy or our privacy practices:

F7 Software Inc — provider of Arc Monitor Pro
6934 Oak Ridge Commerce Way, Austell, GA 30168, United States
Phone: 888-389-2491
Privacy and support: support [at] arcmonitorpro.com
Contact form: arcmonitorpro.com/contact
Corporate website: www.f7software.com