Muscle — Privacy Policy

Last updated: July 7, 2026

This Privacy Policy explains how Arkhipelago LLC d/b/a Muscle ("Muscle," "we," "us") collects, uses, and shares information when you use the Muscle platform, website, and services (the "Service"). It is a disclosure of our practices, not a contract.

1. Information we collect

Information you provide:

• Artisan information: name, business name, email, mobile phone number, location, and payout/identity details you submit (note: sensitive bank and identity verification details are collected and processed by our payment processor, Stripe — see Section 4).
• Client information: name, email, and any address or details entered into a commission agreement.
• Commission content: project descriptions, specifications, reference images, milestone schedules, messages/notes between parties, and signatures.

Information collected automatically:

• Basic usage and device data (e.g., IP address, browser type, pages viewed, timestamps) collected through standard logging and, if used, cookies or similar technologies.

We do not collect or store full payment card numbers or bank account numbers. Those are handled directly by Stripe.

2. How we use information

We use information to:

• provide, operate, and improve the Service;
• create, send, sign, and manage commission agreements and their milestone payments;
• verify Artisan identity via phone (one-time SMS codes);
• facilitate payments through Stripe;
• communicate with you (e.g., notifications about a contract, payment, or your account);
• maintain security, prevent fraud, and enforce our Terms; and
• comply with legal obligations.

We do not sell your personal information.

3. How we share information

We share information only as needed to run the Service:

• With the other party to an agreement: an Artisan and Client necessarily share the commission details, names, and related information with each other.
• With service providers who help us operate, including:
  • Stripe (payment processing and identity verification),
  • Supabase,
  • Twilio for verification codes,
  • Resend for notifications,
  • Vercel.
• For legal reasons: to comply with law, respond to lawful requests, or protect rights, safety, and property.
• In a business transfer: if we are involved in a merger, acquisition, or sale of assets, information may be transferred, subject to this Policy.

4. Payments and Stripe

Payments are processed by Stripe. When you make or receive a payment, your payment and identity information is collected and processed by Stripe under Stripe's Privacy Policy. We receive limited information from Stripe (such as confirmation of payment status and the last four digits of an account) but not full financial credentials. Please review Stripe's Privacy Policy to understand how it handles your information.

5. Data retention

We retain information for as long as needed to provide the Service, maintain records of agreements and transactions, comply with legal and tax obligations, resolve disputes, and enforce our agreements. Commission agreements and related records may be retained after a project ends as a record for the parties and for legal/compliance purposes.

6. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, or to opt out of certain processing.

California residents (CCPA/CPRA): You may have the right to know what personal information we collect, request deletion, request correction, and not be discriminated against for exercising these rights. We do not sell personal information. To exercise these rights, contact privacy@arkhipelago.com.

To exercise any rights, contact us at privacy@arkhipelago.com. We may need to verify your identity before responding.

7. Security

We use reasonable technical and organizational measures to protect information, and we rely on established providers (Stripe, Supabase and Vercel) for sensitive processing. No system is perfectly secure, and we cannot guarantee absolute security. Notify us at support@arkhipelago.com if you believe your information has been compromised.

8. Children

The Service is not directed to children under 18, and we do not knowingly collect personal information from them.

9. International users

The Service is operated in the United States. If you access it from elsewhere, you understand your information will be processed in the United States.

10. Changes to this Policy

We may update this Policy. We will post the updated version with a new "Last updated" date and, where required, provide additional notice.

11. Contact

privacy@arkhipelago.com · Arkhipelago LLC d/b/a Muscle · liam@arkhipelago.com