Privacy Policy

1. Who We Are

Archimedes Market LLC ("Archimedes Market," "we," "us," or "our") operates the platform at archimedes.market. This Privacy Policy describes how we collect, use, store, and share your personal information when you use our platform.

2. Information We Collect

2.1 Information You Provide

• Account information: email address, display name, avatar, role preference, country of residence
• Profile information: technical focus areas, portfolio links
• Content: assets, submissions, reviews, messages, and other materials you upload
• Payment information: processed directly by Stripe (we do not store card numbers)
• Communications: support requests and correspondence with us

2.2 Information Collected Automatically

• Device and browser information (user agent, screen resolution)
• IP address and approximate geolocation (country level)
• Usage data: pages visited, features used, timestamps
• Cookies and similar technologies (see our Cookie Policy)

3. How We Use Your Information

• Provide, operate, and maintain the platform
• Process transactions and send related notifications
• Verify identity and prevent fraud
• Enforce our Terms of Service and other policies
• Comply with legal obligations (tax reporting, sanctions screening)
• Generate anonymized analytics to improve the platform
• Generate vector embeddings of public content for search and discovery
• Perform automated security scanning and quality analysis (Trust Engine)

4. How We Share Your Information

We do not sell your personal data. We share information with:

• Stripe: payment processing, identity verification, payouts
• Supabase: database hosting and authentication
• Vercel: application hosting and edge delivery
• OpenAI & Google: AI-assisted analysis (Trust Engine, description generation) — content is processed but not used for model training
• Sentry: error tracking and performance monitoring
• Resend: transactional email delivery
• Law enforcement: when required by law, subpoena, or court order

5. Data Retention

• Account data: retained while your account is active
• Financial records: minimum 7 years (legal requirement)
• Deleted accounts: personal data removed, financial archives retained per legal requirements
• Submission fingerprints: retained indefinitely for audit purposes

6. Your Rights

Depending on your location, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and personal data (subject to legal retention requirements)
• Export your data in a portable format
• Object to or restrict processing of your data
• Withdraw consent (where processing is based on consent)

To exercise these rights, contact us at privacy@archimedes.market. Account holders can also export or delete their data directly from their profile page at any time, without contacting us.

7. If You Are in the EEA, the UK, or Switzerland

Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to you, Archimedes Market LLC is the data controller of your personal data, and the rights in Section 6 are legal rights you can enforce.

7.1 Our Lawful Bases for Processing

• Performance of a contract (Art. 6(1)(b)) — creating and operating your account, delivering assets you obtain, and processing transactions you initiate.
• Legitimate interests (Art. 6(1)(f)) — keeping the platform secure, preventing fraud and abuse, understanding aggregate usage, and publishing trust reports on public code repositories (see Section 9).
• Legal obligation (Art. 6(1)(c)) — tax, accounting, and sanctions-compliance requirements.
• Consent (Art. 6(1)(a)) — optional communications, which you may withdraw at any time.

7.2 Right to Complain

You have the right to lodge a complaint with your national data protection supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first, at privacy@archimedes.market.

7.3 EU Representative

We do not currently maintain an Article 27 representative in the European Union. Payments and seller onboarding are restricted to the United States; the remainder of the platform is available worldwide as freely accessible content. If you are in the EEA and wish to exercise any right under the GDPR, write to privacy@archimedes.market and we will respond within the statutory one-month period.

8. International Transfers

Archimedes Market LLC is established in the United States, and your data is stored and processed there. Our infrastructure providers (Supabase, Vercel, Stripe) act as processors under data processing agreements incorporating the European Commission's Standard Contractual Clauses, which is the transfer mechanism we rely on for data originating in the EEA, the UK, or Switzerland.

9. Public Repository Trust Reports

We analyse publicly available source code repositories and publish Trust Reports about them at archimedes.market/r. These reports necessarily include information that may identify individuals — most commonly a repository owner's or maintainer's public username and the public metadata attached to their repository. We obtain this information from public sources; we do not access private repositories.

Our lawful basis is legitimate interests (Art. 6(1)(f)): helping engineers assess the security, quality, and licensing of code they are considering depending on. We publish only aggregate scores and summary findings, and we do not publish detailed vulnerability findings that could be used to attack a project.

If you maintain a repository we have scored, you may contest the report, request a re-scan, or ask us to remove it entirely — no account required, and we do not require you to justify the request. Write to privacy@archimedes.market with the repository URL. We honour removal requests from verified maintainers.

10. Cookies and Analytics

We use no advertising cookies, no third-party trackers, and no cross-site profiling. We use:

• Strictly necessary cookies — to keep you signed in and to record the country your request arrives from, so we can show which features are available in your region.
• Cookieless analytics — Vercel Web Analytics and Speed Insights, which measure aggregate page views and performance. They set no cookies, store nothing on your device, and build no profile of you.

Because the analytics are cookieless we rely on legitimate interest (Art. 6(1)(f)) rather than consent — but you have an absolute right to object, so the choice is real: select "Turn off analytics" in the cookie banner on your first visit and the analytics scripts are not loaded at all. Your decision is stored on your device. Full detail is in our Cookie Policy.

11. Children's Privacy

The platform is not intended for individuals under 18. We do not knowingly collect personal information from children. If we discover that a user is under 18, we will terminate the account and delete associated personal data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-platform notification at least 30 days before they take effect.

13. Contact Us

For privacy-related inquiries:

Archimedes Market LLC

Email: privacy@archimedes.market

Website: archimedes.market