Subprocessors

Arct Technology LLC ("Arct Cloud", "we", "us", "our") uses other companies to run its website, the Console at console.arct.cloud, and the virtual servers and related infrastructure, add-ons and support it provides (the "Services"). This page lists those companies.

A subprocessor is a company we engage to process personal data on our behalf while we provide the Services. When you store or run data, software or content on the Services ("Customer Content"), we process the personal data in it as your processor under our Data Processing Agreement (the "DPA"). The companies in section 1 may process Customer Content and are subprocessors under the DPA. This page is Annex III of the DPA.

The companies in section 2 process account, billing, support and website data for which we are the controller, as the Privacy Policy describes. We list them here so that our vendors appear in one place.

We email the address on each Account at least 30 days before a new or replacement subprocessor starts processing Customer Content, except for an urgent replacement under section 4. To have these notices sent to another address, or to object to a new subprocessor, email [email protected]. Sections 7.3 to 7.5 of the DPA set out the notice and objection process. This list may change over time as sections 4 and 5 describe.

1. Infrastructure (may process Customer Content)

These companies provide the data center facilities that house the hardware running customer servers. We engage each of them under a written contract with data protection terms that protect Customer Content at least as well as the DPA, to the extent relevant to the service it provides. We remain responsible to you for their processing as the DPA sets out.

2. Account, billing and analytics

These companies process data about you and your Account, including support tickets. They do not have access to the disks of your servers. Support tickets contain whatever you choose to send us. When you sign up, you agree that we process your Account data and share it with the companies in this section as needed to provide the Services.

Sign-in, session and security cookies and storage in the Console are strictly necessary for your Account and its core features, so we set them without asking for consent. Analytics and advertising tags and cookies, including those from Google, PostHog and our own analytics service, load only after you consent. Two items do not wait for a consent choice: fonts that Console pages and the card payment form load from Google Fonts, which store nothing in your browser, and Mintlify's page analytics on the documentation site at docs.arct.cloud. The Cookie Policy lists them. Some of these companies, including Stripe, Cryptomus and Google, also use part of this data as independent controllers under their own terms, for example for fraud prevention or advertising.

3. Where data is processed

• Server disks: each server's primary disk stays in the data center location you select at deployment.
• Backups and snapshots: stored encrypted in our backup storage, which can be in a different country from the server.
• Account, billing and support data: processed in the United States and by the companies in section 2, in the locations shown.
• Access by our personnel: our personnel may access our infrastructure remotely.

Arct Cloud is a US company and is subject to US law, including the CLOUD Act. The Law Enforcement Guidelines page explains how we handle government requests. Where personal data from the European Economic Area, the United Kingdom or Switzerland is processed outside those regions, the DPA sets out the transfer safeguards: the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss amendments to the Standard Contractual Clauses.

4. Notice of new subprocessors

We may add, replace or remove subprocessors as our business and the Services require, and this list changes accordingly. DPA section 7.3 governs notice of a new or replacement subprocessor in section 1: we email the address on the Account at least 30 days in advance and update this page at the same time. You are responsible for keeping that email address current and for reviewing these notices. We may remove a subprocessor without advance notice.

Where a subprocessor in section 1 must be replaced urgently for reasons outside our reasonable control, such as a security risk, a subprocessor ceasing to provide its service or breaching its obligations, or a legal requirement, we may replace it with shorter notice or without advance notice, to the extent data protection law allows. We then notify you as soon as reasonably practicable, and the objection period runs from that notice, as DPA section 7.5 sets out.

When a company in section 2 is added or replaced, we update this page. This list was last changed on October 17, 2026.

5. Objecting to a new subprocessor

DPA section 7.4 governs objections to a new or replacement subprocessor in section 1. In summary:

• Send your objection to [email protected] within the notice period, with the subject line "Subprocessor objection". Include your Account email address, the name of the subprocessor and your reasonable data protection grounds.
• If you do not object within the notice period, you are treated as having authorised the subprocessor.
• We work with you in good faith to resolve a reasonable objection, for example by proposing a different configuration or location for your Services.
• If we cannot resolve it within 15 days after we receive it, either of us may terminate the affected Services by written notice. To the maximum extent permitted by applicable law, this is your sole and exclusive remedy. It does not give a right to a refund or credit of fees already paid, except where mandatory law requires one.

The companies in section 2 support our processing as a controller, so the objection process does not apply to them. The Privacy Policy describes your rights over that data. If this page and the DPA differ, the DPA applies. This page does not give rights beyond those in the DPA.