Legal · effective 14 September 2026
Privacy
Policy.
What we collect when you visit the site, order a Kit, use the app or contact us — and what we do with it.
Document record
Version
1.1
Effective
14 September 2026
Controller
The company that sold to you — by delivery country
Privacy contact
Sections 4 and 5 were corrected on 19 September 2026 to state where this site’s server is and who can reach it; email is delivered by Amazon SES. The wording is otherwise the reviewed document.
The policy
This policy explains what personal data ARK collects when you visit ark-dynamics.com, order a Kit, create an account, use the ARK companion app, or contact us — and what we do with it.
1. Who is responsible for your data
| Role | Company |
|---|---|
| Your data controller, if your order is delivered in the USA or the rest of the world | ARK Dynamics Global, a Wyoming corporation, 762 E Browning Ave, Salt Lake City, Utah 84105, USA |
| Your data controller, if your order is delivered in the EU | ARKINEMATICS LIMITED, trading as ARK Dynamics, Korinthou 33, Agioi Trimithias 2671, Nicosia, Cyprus (company no. HE 436275) |
| Our representative in the EU, appointed under Article 27 of the GDPR, if you are in the EU or EEA | ARKINEMATICS LIMITED, trading as ARK Dynamics, Korinthou 33, Agioi Trimithias 2671, Nicosia, Cyprus (company no. HE 436275). You may contact it about anything to do with your data instead of contacting us, and it is also our EU authorised representative for product safety. |
Privacy contact for both: devsupport@ark-dynamics.com. The company that sold to you decides how your data is used and is the company you have rights against: ARK Dynamics Global for orders delivered in the USA and the rest of the world, ARKINEMATICS LIMITED for orders delivered in the EU. Where ARK Dynamics Global is the controller, ARKINEMATICS is its point of contact in the EU under Article 27, not a second controller. Each company handles the personal data of its own customers only, with one exception: your account’s sign-in record (your email address, password hash, sign-in codes and the cookies in Section 2) is kept by ARKINEMATICS LIMITED, which runs the account system for both companies. Your orders stay with the company that sold them.
2. What we collect
| Category | Details |
|---|---|
| Order and account data | Name, delivery and billing address, email, phone, order number, what you bought, price paid, payment status, delivery details, and — for grid-position and early-reservation holders — your reservation and grid-position code. Card payments are processed by Stripe; we never see or store your full card number. |
| Your account | If you open an account — on its own page, or by ticking “Also create my ARK account” when you order: your email address; your password, if you set one, stored only as a one-way scrypt hash that cannot be turned back into it; when you proved your email address and when you confirmed you are 18 or over and accepted the Terms (for an account opened at the order, that is the confirmation you gave with the order); the orders linked to your account, including orders you placed earlier with the same email address without an account, once you have proved that address; and, if you sign in with Google, the identifier and email address Google gives us for your Google account. Signing in sets cookies that only do that job, are never readable by a script and are never sent to another site: ark_s keeps you signed in until you close the browser, or for 30 days if you tick “Keep me signed in”; ark_pre ties an emailed sign-in code to the browser that asked for it and expires with the code; ark_dev is set only if you tick “Remember this browser”, so this browser is not asked for a code again for the period stated beside that box; ark_oauth lasts at most 15 minutes, only while you sign in with Google. |
| Saved name and address | Only if you tick “Save my name and address to my account” when you order: the name and delivery address from that order, kept in your account so that “Auto fill details” can fill in your next order. They are kept by the company that sells where they are delivered: ARKINEMATICS LIMITED for the EU, ARK Dynamics Global for the USA and the rest of the world (the French overseas departments, Saint-Martin and Åland buy as the rest of the world). You can see, change or remove them in your account settings at any time. |
| Bank-transfer payments | If you pay by bank transfer: the amount, date and reference of your payment, and the name and account number of the account it came from, as our bank reports them to us. If you tell us you have paid, the name you give for that account. We never ask for your bank login. |
| Find my order | If you use Find my order: the order number you type, a one-way hash of the email address you type (never the address itself), the one-time code we email you (stored only as a one-way hash) and how many times it was tried. Each record is deleted 24 hours after its code expires. Your IP address is used only in memory, to limit how often codes can be asked for, and is not stored. |
| Product telemetry | When your Kit is connected to the ARK companion app: usage hours, session counts, actuator load and temperature, fault and error logs, emergency-stop events, firmware version and crash reports; and, from the PC running the app, hardware configuration, the game title in use and your IP address. |
| Support and safety correspondence | Emails, photos, videos and fault descriptions you send us; incident reports; warranty claims. |
| Website data | IP address, browser and device type, pages visited and the time of visit, from server logs. This site sets no advertising or analytics cookies, and there is nothing to consent to or opt out of. It stores these things on your device, each only because you asked for something that needs it: when you open a checkout we set one cookie, ark_order, holding a single random reference and nothing else, so that if you close the payment tab we can offer you the same checkout again rather than a dead end — it cannot be read by any script, is never sent to another site, and expires with the checkout, at most 24 hours; and if you choose where you are ordering from, that choice is remembered in your browser so the right prices and currency are shown on the next page. If you order by bank transfer without signing in, or find an order with Find my order, we set ark_ord, holding a single random reference that lets this browser open that one order’s payment page, for 120 minutes; it cannot be read by any script and is never sent to another site. If you use Find my order we also set ark_fpre, which ties the code we email you to the browser that asked for it and expires with the code, after 10 minutes. If you sign in, the account cookies above are set too. None is used to profile you, follow you between sites, or measure your visit. If you press Order we also record where you arrived from — the campaign tag in the link you followed, or the website that linked to us — against that order alone. We read it from the link you followed and store nothing on your device for it; the tag names a campaign, never a person, and you may object. When a page you open carries such a tag, we also add one to that day’s total for the campaign and the page; the total holds no address, no identifier and no time finer than the day. Stripe’s checkout page, on stripe.com, sets its own cookies; see Stripe’s privacy policy. |
| Marketing preferences | Whether you have opted in to news and updates. |
| Optional questions | Only if you answer them: how you heard of ARK, what you will mostly use it for, the sims you play and the gear you already have. Every question is optional, and if you choose “Not interested” we do not ask again. |
| Personal offers | An offer we send you: the build, the price, its code, when it ends, the reason you received it, and whether you used it. |
We do not knowingly collect data from anyone under 18. Our products and accounts are for adults.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Taking and fulfilling your order, delivering, invoicing, warranty and support | Performance of a contract with you |
| Your account: signing you in, keeping it secure and showing you your orders | Performance of a contract with you. The sign-in cookies are necessary for the sign-in you asked for (the exemption in Article 5(3) of the ePrivacy Directive and paragraph 4 of Schedule A1 to the UK PECR); “Remember this browser” is set only when you tick it. |
| Matching a bank transfer to your order, and refunding it to the account it came from | Performance of a contract with you; keeping the payment record is a legal obligation |
| Letting you pay for and find an order you placed without an account (Find my order, the payment page, the codes we email you) | Performance of a contract with you, or steps you asked for before one. The ark_ord and ark_fpre cookies are necessary for the service you asked for (the exemption in Article 5(3) of the ePrivacy Directive and paragraph 4 of Schedule A1 to the UK PECR). Limiting how often codes can be asked for and tried (your IP address is used in memory for this and not stored): our legitimate interest in keeping orders and payment details safe. |
| Keeping the Product safe: safety-critical telemetry (interlock, fault and emergency-stop events), Safety Notices, recalls, incident handling | Our legitimate interest in the safety of our customers and the Product, and our legal product-safety duties. You may object; we will explain the safety consequences. |
| Other telemetry — improving the Product, firmware and app | Your consent in the EU, EEA and UK (switch it off in the app settings at any time); our legitimate interest elsewhere |
| Tax, accounting and legal records; responding to authorities and courts | Legal obligation |
| Fraud prevention and securing our systems | Legitimate interest |
| Keeping your checkout open so you can finish it, and remembering the region you chose | Necessary to provide the service you asked for. No consent is required for storage of this kind, and none is asked for — it is the exemption in Article 5(3) of the ePrivacy Directive and paragraph 4 of Schedule A1 to the UK PECR. |
| Recording which campaign or website an order came from | Legitimate interest in knowing which of our own channels produces sales. It is read from the link you followed and nothing is stored on your device for it; it is never combined with anything from another site, and you may object. |
| News and updates by email | Your consent — only if you ticked the box; unsubscribe in any email |
| Personal offers by email | Your consent; or, after you have bought from us, our legitimate interest in offering you our own similar products, where the law allows it without consent. You can refuse when you order and in every offer email. Each offer says why you received it. You may object at any time; once you do, we send you no more offers. |
| Asking the optional questions | Legitimate interest in knowing which sims and set-ups to support first. Answering is your choice. |
| Using your answers to shape the offers we send you | Legitimate interest in sending offers that fit you, and only if we may send you offers at all. You may object to this at any time; objecting to offers also stops your answers being used for them. |
| Counting visits that arrive from our own campaigns | Legitimate interest in knowing which of our campaigns bring visitors. A daily total only: nothing is stored on your device and no person can be identified from it. |
4. Who we share it with
| Recipient | Why |
|---|---|
| Stripe | Payment processing and fraud prevention |
| Square (Block, Inc.) | Payment processing and fraud prevention for orders it takes. For those orders we pass Square the email and delivery address you enter on our order sheet, so its payment page can take the payment. Square is in the USA. |
| Our banks | If you pay by bank transfer, the money goes to the seller’s account at its bank, which reports to us the name and account it came from, the amount and the reference. A refund is paid through the same bank. |
| Google, only if you sign in with Google | Google confirms your Google account’s email address to us and learns that you signed in to ARK Dynamics, under Google’s own privacy policy. Nothing is sent to Google if you sign in with a password. |
| Amazon Web Services (Amazon SES) | Delivers our order, reservation, newsletter, offer and support email. AWS receives the address and content of each email in order to deliver it, and is certified under the EU–US Data Privacy Framework. |
| YouTube (Google) | Plays a video on our See it move page, only when you press play on it. From then on Google receives your IP address and what its player records, under Google's own privacy policy. Nothing is sent to Google before you press play. |
| Our hosting provider | Hosts this website and our order system on a server in Canada. |
| Freight carriers and forwarders | Delivering your Kit and returns |
| Our manufacturing and repair partners in China | Only what a build, repair or replacement needs: name, delivery address, order and serial numbers, fault data |
| Accountants, lawyers, insurers | Running the business and defending claims |
| Product-safety, customs and tax authorities, courts | Where the law requires |
We do not sell personal data and do not share it with advertisers.
5. International transfers
If your order is delivered in the EU, your controller is ARKINEMATICS LIMITED, established in Cyprus. Your data is still processed in the United States in part, because our email delivery and payment providers are there. Stripe or Square processes your payment and Amazon Web Services delivers our email, all in the USA; a repair reaches our partners in China. Where ARK Dynamics Global is the controller there is no EU establishment behind the sale, so we have appointed an EU representative under Article 27 (Section 1); for every transfer out of the EU/EEA we rely on the safeguards below. Where a recipient is certified under the EU–US Data Privacy Framework we rely on that; otherwise we rely on another route the GDPR allows for that transfer — appropriate safeguards such as the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant), or, where the transfer is needed to perform your contract or to act on your request, Article 49(1). You can ask us which one applies to your data. The server that runs ark-dynamics.com and the order system behind it is in Canada, so visiting the site, writing to us or placing an order sends that data to Canada. For that transfer we do not rely on the routes above: the European Commission has decided that Canada provides an adequate level of protection for personal data transferred to an organisation subject to Canada’s Personal Information Protection and Electronic Documents Act (Decision 2002/2/EC), and that is the decision we rely on for the hosting of this site. The United Kingdom keeps the same decision in its own law.
6. How long we keep it
| Data | Retention |
|---|---|
| Orders, invoices, payment records | As long as tax and accounting law requires — up to 7 years after the order |
| Account data | While your account is open, then 2 years |
| Saved name and address | Until you remove them in your account settings or close your account; either deletes them at once. The name and address on each order you placed stay with that order (“Orders, invoices, payment records” above). |
| Product telemetry | 24 months — longer where needed for a warranty claim, a safety investigation, a legal claim or a regulatory duty |
| Safety incident and recall records | 10 years, matching product-liability limitation periods |
| Support correspondence | 3 years after the last message |
| An unfinished checkout | Deleted as soon as the checkout is paid, cancelled or expires — at most 24 hours. Where Square takes the order, the email and delivery address you entered on our order sheet are kept for 30 days after an unpaid checkout expires, then deleted. The ark_order cookie expires with it. |
| An unpaid bank-transfer order | If it is cancelled before it is paid — by you, or because the money did not arrive by its date — the order and the details you gave with it are kept with our order records for 6 years after the cancellation, to establish or defend any claim about it, then deleted. |
| Find my order | A code works for 10 minutes; its record (stored as hashes) is deleted 24 hours after it expires. The ark_ord cookie ends after 120 minutes and its server record is deleted within 24 hours after that. |
| Marketing preferences | Until you unsubscribe, then a record of the unsubscribe |
| Answers to the optional questions | Until you close your account or ask us to delete them. An answer not linked to you keeps only the choice and the day, never your own words. |
| Personal offers | A record of each offer and whether it was used is kept with our sales records, up to 7 years. Closing your account cancels any offer you have not used. |
7. Your rights
If you are in the EU, EEA or UK you may ask us for access to your data, correction, deletion, restriction, portability, and to object to processing based on legitimate interest; you may object to offers, and to the use of your answers to shape them, at any time, and we then stop for good; you may withdraw consent at any time without affecting earlier processing. You may complain to the supervisory authority of the EU or EEA country where you live or work — that is your normal route, and our Article 27 representative in Cyprus does not change it. You may also complain to the Commissioner for Personal Data Protection of the Republic of Cyprus (dataprotection.gov.cy), where our EU representative is established, or to the UK Information Commissioner's Office (ico.org.uk) if you are in the UK. If you are in the UK you may also complain to us under section 164A of the Data Protection Act 2018, by email to devsupport@ark-dynamics.com; we acknowledge a UK data-protection complaint within 30 days of receiving it. We honour the same access and deletion requests from anyone, anywhere. To exercise a right, email devsupport@ark-dynamics.com; we may ask you to verify your identity and we respond within one month.
California residents: we do not currently meet the thresholds of the California Consumer Privacy Act, and we do not sell or share personal information as that law defines it; the rights above are available to you regardless.
8. Your Product data
Separately from your privacy rights, you may access the data your Kit generates from your use of it and share it with a third party of your choice, free of charge, in a machine-readable format — through the app's export function or by request. See the Terms of Sale & Use, Section 10.3.
9. Security
Data is transmitted over encrypted connections, stored with access controls, and payment data never touches our systems. If a breach affects your data we will tell you and the relevant authority as the law requires.
10. Changes
We will email account holders about material changes at least 30 days before they take effect.
11. Contact
devsupport@ark-dynamics.com · Controller for the USA and the rest of the world: ARK Dynamics Global, 762 E Browning Ave, Salt Lake City, Utah 84105, USA · Controller for the EU, and EU representative (GDPR Article 27): ARKINEMATICS LIMITED, Korinthou 33, Agioi Trimithias 2671, Nicosia, Cyprus.
- Set from ARK_Dynamics_Privacy_Policy_v1.1.docx, effective 14 September 2026. The page differs from that document where listed below; elsewhere the headings, tables and lists carry the document's own wording.
- Sections 4 and 5 were corrected on 19 September 2026: this site runs on a server in Canada that ARK neither owns nor administers, and the recipients are stated accordingly. Email is delivered by Amazon SES. The hosting provider named in the reviewed draft is still not used. Sections 2, 3 and 6 were updated on 24 September 2026 for the order-continuity cookie. On 26 September 2026 orders delivered in Norway, Iceland and Liechtenstein moved to ARK Dynamics Global as seller and controller — they are outside the EU; ARKINEMATICS remains the Article 27 representative for the EEA.
- The server’s country is stated in Section 5: Canada. The transfer rests on the European Commission’s adequacy decision for Canada (Decision 2002/2/EC), not on Standard Contractual Clauses.
- Audit of this document against the site: ARK legal audit, 9 September 2026
- Section 7 gained a UK complaint route on 30 September 2026 (Data Protection Act 2018 section 164A, in force 19 June 2026). The v1.1 document the page was set from does not contain it.