ArcX builds the Swish autonomous basketball training system. This policy explains what we do with personal information, and it is written to be read rather than to be survived.
To be completed before launch. The registered legal entity, its company number and its registered office address must be named here, together with the identity of our EU/UK representative under Article 27 GDPR if we accept reservations from the EEA or the UK. Until those are filed, the controller of your personal information is the operator of arcxswish.com, reachable at privacy@arc-x.ai.
This policy covers the ArcX website, the reservation and order process, our customer support and marketing email, and the Swish device and its companion application. It does not cover third-party sites we link to, which have their own policies.
These are the two halves of the product and they behave very differently, so we describe them separately throughout. Conflating them is the most common way a privacy policy misleads.
The device is designed so that the sensitive material — video of you, your body position, your shooting mechanics — is processed where it is captured and stays there. The website is a commercial website. It measures its own traffic, it remembers that you filled in a form, and when you arrive from an advertisement it records which advertisement.
| When | What |
|---|---|
| Reserving or ordering | Name, email address, phone number, shipping address, the tier and colour you chose, and any note you add to the order. |
| Paying | Your card details are entered directly with our payment processor and are handled by them. We receive a payment reference and the amount, never the full card number. |
| Creating an account | Email address, name and a password, which we store only as a salted hash. |
| Contacting us | Name, email address, subject and the content of your message. |
| Newsletter and waitlist | Email address, and where you signed up from. |
| Category | What |
|---|---|
| Network | IP address. |
| Device | Browser and version, operating system and version, device type, screen resolution, user-agent string. |
| Usage | Pages viewed, the page you landed on, time on site, session duration, and whether the visit resulted in a reservation. |
| Approximate location | Country, region, city and the approximate coordinates of your city, derived from your IP address. This is city-level inference, not GPS, and we do not request device location. |
| Referral | The page that linked you here, and campaign parameters in the URL such as utm_source, utm_medium, utm_campaign, utm_content and utm_term. |
| Ad click identifiers | Identifiers appended to the URL by advertising platforms, including Meta's fbclid and X's twclid, plus campaign, ad-set and ad identifiers. |
Our site analytics are first-party: they are recorded by our own server into our own database. We do not run Google Analytics, Meta Pixel or any comparable third-party tracking script on this site.
Our payment processor tells us whether a payment succeeded, and returns the payment reference, the amount and the card's country and last four digits. Our IP geolocation provider returns the approximate location associated with an IP address. Advertising platforms may confirm that a click they sent us converted.
Your footage is not our data. On the Swish device:
If we ever introduce an optional feature that uploads something — cloud backup, coach sharing, a leaderboard — it will be off by default, it will be described plainly at the moment you are asked, and this policy will be updated before it ships.
We use a small number of cookies and local storage entries, all of them first-party:
| Purpose | Detail |
|---|---|
| Strictly necessary | A session cookie that keeps you signed in and protects forms against cross-site request forgery. The site cannot function without it. |
| Preferences | Your chosen language, so the site does not reset to English on every visit. |
| Measurement | A first-party session identifier used to count a visit once rather than on every page load. |
We set no third-party advertising or profiling cookies. Most browsers let you block or delete cookies; blocking the strictly necessary one will break sign-in and checkout.
The legal bases below are those required under the UK and EU GDPR. If you are outside those jurisdictions the purposes still describe what we do.
| Purpose | Legal basis |
|---|---|
| Taking and fulfilling your reservation or order, and supporting it afterwards | Performance of a contract with you. |
| Sending transactional email: confirmations, shipping and delivery notices, refunds | Performance of a contract. |
| Processing payments and refunds, and preventing fraud and chargeback abuse | Contract, and our legitimate interest in not being defrauded. |
| Keeping tax, accounting and consumer-law records | Compliance with a legal obligation. |
| Understanding how the site is used, so we can improve it | Legitimate interest in operating and improving our own website. |
| Attributing a reservation to the advertisement that produced it | Legitimate interest in knowing which marketing works, or consent where local law requires it. |
| Marketing email and product announcements | Your consent, withdrawable at any time. |
| Securing the site and investigating abuse | Legitimate interest in the security of our service. |
We share personal information only in the situations below. We do not sell personal information for money.
These providers process personal information on our behalf, under contract, only for the purpose named:
| Provider | Purpose and what they receive |
|---|---|
| Stripe | Payment processing. Receives your card details directly, plus name, email and amount. Stripe is an independent controller for its own fraud-prevention purposes. |
| Resend | Delivery of transactional and marketing email. Receives your email address and the content of the message sent to you. |
| PledgeBox | Reservation and pledge management. Receives your email address together with the referral and advertising identifiers described in Section 4.2, so a pledge can be attributed to the campaign that produced it. |
| ip-api.com | IP geolocation. Receives the IP address of a visitor in order to return an approximate location. It does not receive your name, email or any order information. |
We advertise on third-party platforms. When you click one of those advertisements, the platform adds an identifier to the link, and we pass that identifier on to our reservation platform so the reservation can be credited to the right campaign.
We consider this measurement rather than profiling: we are not building an advertising profile of you, and we do not run advertising pixels on this site. However, several US state privacy laws define "sharing" broadly enough to cover this, so we treat it as sharing for cross-context behavioural advertising and offer an opt-out to everyone, in every jurisdiction, on request to privacy@arc-x.ai. Opting out does not affect your reservation, your price or your place in the queue.
We operate internationally and our providers are located in several countries, including the United States. Where personal information is transferred out of the EEA, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, together with any additional measures the transfer requires. You may request a copy of the safeguards applying to a specific transfer.
| Data | Retention |
|---|---|
| Order and reservation records | For the life of the order, then for as long as tax and consumer-law record-keeping requires — generally seven years from the transaction. |
| Account details | Until you delete the account, then removed within 30 days except where retention is legally required. |
| Support correspondence | Two years after the matter is closed. |
| Marketing subscriptions | Until you unsubscribe, plus a suppression record so we do not email you again by mistake. |
| Website analytics and session records | 25 months, then deleted or aggregated beyond re-identification. |
No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal information and the law requires us to tell you, we will, without undue delay and within any deadline that applies to us.
Wherever you live, you may ask us to:
Write to privacy@arc-x.ai. We respond within 30 days, and we will tell you if we need longer and why. We do not charge for this and we will not treat you differently for asking. We may need to verify your identity before acting, which for most requests means confirming control of the email address on the account.
The rights in Section 13 are your rights under the GDPR and the UK GDPR. You also have the right to lodge a complaint with your national supervisory authority — in the UK, the Information Commissioner's Office — and we would ask that you raise it with us first so we have the chance to put it right. We do not use your personal information for automated decision-making that produces legal or similarly significant effects.
Under the CCPA as amended by the CPRA, you have the rights to know, delete, correct, and to opt out of the sale or sharing of personal information, as well as the right not to be discriminated against for exercising them. In the preceding twelve months we collected the categories of personal information listed in Section 4 — identifiers, commercial information, internet activity, and coarse geolocation — for the business purposes in Section 7, and disclosed them to the service providers in Section 8.
We have not sold personal information for monetary consideration. We do share advertising identifiers as described in Section 9, and you may opt out at privacy@arc-x.ai. We do not collect or process sensitive personal information for the purpose of inferring characteristics. You may use an authorised agent to submit a request.
Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have comparable rights of access, correction, deletion, portability and opt-out, including a right to appeal a refused request. To appeal, reply to our decision and ask for a review; we will respond in writing within the period your state's law allows.
The Swish device is recommended for players aged 10 and up, but the website, the reservation process and any ArcX account are intended for adults. We do not knowingly collect personal information from children under 13, and we do not permit children under 13 to create an account or place an order.
Where a child uses the device, the training session is processed on the device and does not reach us, which is the same protection every other user gets. If a parent or guardian believes a child has provided us with personal information through the website, write to privacy@arc-x.ai and we will delete it. In the EEA and the UK, the minimum age for consent-based processing is 16, or the lower age set by your member state.
We will update this policy when our practices change. The effective date at the top always reflects the current version. If a change materially reduces your rights or materially expands what we collect, we will give notice — by email where we have your address, and by a notice on the site — before it takes effect, and we will not apply it retroactively to information already collected under the previous version.
Privacy requests and questions: privacy@arc-x.ai
Everything else, including orders and support: sales@arc-x.ai
To be completed before launch. A postal address for privacy correspondence is required in several jurisdictions, and an EU/UK Article 27 representative must be appointed and named if we take EEA or UK reservations.
Last updated: 25 August 2026. See also our Terms of Service.