How We Protect Your Privacy and Privilege

Your data never leaves your infrastructure

Arachne uses a hub-and-spoke architecture. The dashboard interface runs on Macrify's servers, but all firm data — findings, chat history, files, memory, and training documents — lives exclusively on your firm's designated server. Macrify's hub stores only the minimum needed to route your requests: your email address and which server belongs to your firm.

Per-firm isolation

Each Arachne deployment runs on its own isolated infrastructure. Your firm's data is never commingled with data from other firms, other Macrify products, or Macrify's own operations. If you choose the self-hosted option, the entire system — including the AI brain, database, and file storage — runs on hardware you control.

Approval-gated execution

Arachne surfaces findings and recommendations but never acts without your explicit approval. Every draft email, calendar event, and document action goes through an approval queue visible to authorized team members. Actions can be reversed via the rollback system. The AI does not have autonomous access to your email, calendar, or external accounts — it can only propose actions for human review.

What Arachne stores on your server

• Brain contents — training documents, firm memory entries, workflow templates, and configuration files you create. These are plain-text Markdown, JSON, and spreadsheet files. You can read, edit, and export them at any time.
• Audit findings and history — results from compliance scans, email triage, deadline checks, and other automated audits. Includes approval/rejection decisions and execution records with rollback metadata.
• Chat history — conversations between your team members and the AI assistant, including tool use logs.
• Domain data — contacts, matters, vendors, expert witnesses, and other structured data you manage through the Data section.
• Team configuration — user roles, permission overrides, scheduled tasks, email classification rules, and connection settings.

AI processing

Arachne uses Anthropic's Claude API for chat and task execution, and Google's Gemini API for data import column mapping. Both providers' API terms prohibit using submitted data for model training. Your firm's context (Brain contents, memories, relevant files) is sent to the AI provider only when needed to process a specific request, and is not retained by the provider after processing.

Full data portability — no lock-in

Everything Arachne learns about your firm belongs to you. All training documents, firm memory entries, workflow templates, domain data, and configuration files are stored in standard, human-readable formats (Markdown, JSON, CSV, XLSX). Upon termination of service — whether initiated by you or by Macrify — we will deliver a complete export of all Brain contents and firm data within 30 days. Your institutional knowledge does not disappear when a contract ends.

What Arachne does not do

• Does not access your files without going through the approval queue.
• Does not send emails, create calendar events, or modify documents without explicit approval.
• Does not share your firm's data, training documents, or memory with other clients.
• Does not use your data to train, fine-tune, or improve AI models.
• Does not store your firm's data on Macrify's servers (hub stores only routing information).
• Does not retain data after service termination — your export is delivered and our copies are deleted.

Built to minimize our access

Many software services promise they won't look at your data. We went further — we designed ScheduleHound so that in most cases we cannot see your data, even if we wanted to. Here is how:

Document scanner: your PDFs never touch our servers

When you upload a PDF to the document scanner, it is sent directly from your browser to Google's Generative AI API for processing. The document content is never assembled, stored, or logged on our servers. We receive only the structured deadline data that the AI extracts — event titles, dates, and descriptions — not the underlying document. This extracted metadata is stored in our database so that calendar synchronization can be retried if the initial push fails.

Email submissions: temporary processing, then deleted

When you forward documents by email, attachments are temporarily stored so our system can send them to the AI for extraction. The moment extraction succeeds, the attachments are deleted. If extraction fails, attachments are automatically and permanently deleted within 48 hours. We do not keep archives of submitted documents.

Filename anonymization

Legal document filenames often contain sensitive information — party names, case numbers, or case captions. ScheduleHound automatically replaces every filename with a one-way cryptographic hash the moment it reaches our server. The original filename is never written to our database, server logs, error tracking, or sent to the AI provider.

Why we request the permissions we do

Google permissions

• Google Calendar (Calendars.ReadWrite) — Create deadline events, search existing events for Mass Move, and update event dates when rescheduling.
• Gmail (gmail.send) — Send booking emails to court reporting agencies on your behalf. Send-only — we cannot read your inbox.

Microsoft permissions

• Calendars.ReadWrite — Same as above: create, search, and update calendar events.
• Mail.Send — Send booking emails only. We cannot read your inbox.
• User.Read — Read your basic profile (name and email) for identity display.
• offline_access — Refresh your access token without requiring re-authentication.

Automated approval queue — no human review of your content

Macriphone includes an approval queue where generated posts wait for your review before publishing. This queue is entirely automated and self-service. No Macrify employee reviews, reads, moderates, or approves your content at any stage.

What we store

• Uploaded images — stored in cloud storage (Supabase, United States) for as long as your account is active.
• Generated content — AI-generated captions, post text, and rendered images.
• Brand voice configuration — tone preferences, sample posts, and industry information.
• Brand colors and logo — custom brand colors, logo URL, and font preferences.
• Custom templates — HTML templates created via AI generation, image upload, or manual entry.
• Social media connection tokens — API keys for Late.dev (publishing partner). We do not store social media passwords.

What we do not do

• We do not use your content to train AI models.
• We do not share your content with other tenants or users.
• We do not sell your content to third parties.
• We do not review, read, or moderate your content.
• We do not publish content without your explicit approval.