Privacy notice
Last updated 3 November 2026. See also our Terms of Use.
Who we are
Arrival ID is operated by Arrival ID Ltd, company number 17458900. Correspondence address: Bartle House, 9 Oxford Court, Manchester, M2 3WQ. Arrival ID Ltd is the data controller for the information described here. For any privacy question, or to exercise your rights, email support@arrivalid.app.
What we collect and why
Account details (your email address and name) so you can sign in and own the Arrival IDs you create. Location and access information you enter, and the photographs you publish, so recipients can find the entrance. Recipient activity — that a link was opened, navigation was started, and whether an arrival worked — so publishers can see whether their instructions are correct. The link-open count shown to owners is a simple total: it records no visitor details, IP addresses, device identifiers or tracking cookies. Optional contact details you add to a journey. Basic technical records such as the count of failed code attempts, kept to prevent abuse.
Our lawful bases
We rely on contract to provide the service to account holders; legitimate interests to keep the service secure, prevent code guessing and improve the reliability of arrival information; and consent where you choose to attach your phone's location to a photograph. Where you publish someone else's contact details you are responsible for having a lawful basis to do so.
Delivery proof
Delivery proof photographs are not currently offered to drivers. Any proof records saved during earlier testing stay private to the guide owner and are deleted on request.
Who else is involved
We use a small number of service providers acting on our instructions: cloud hosting and database/storage infrastructure, transactional email delivery for sign-in and account messages, and HERE for map display. HERE receives map-view requests, including the viewed area and ordinary connection information. Navigate links open your chosen Google Maps, Apple Maps or Waze app with the stored coordinates. We do not sell your information and we do not use it for advertising.
Read-only partner site sharing
Site owners can separately approve an export and switch on “Share with partners”, off by default per site. Production access is also off by default. Authorised, site-scoped key holders may receive site names, approved entrance coordinates, instructions, opening hours, public guide links and current approved measurements with role-only measurement attribution. No photos, contacts, personal names, notes or private access codes are included. Figures older than 12 months are withheld and labelled “Needs re-check”. Owners must review exports after site changes; edits to the live guide do not update an export automatically. Switching sharing off blocks future requests but cannot recall copies already received. Sandbox sites and figures are fictional. API keys are stored as hashes, not raw credentials. Application usage stores request counts per key per UTC day only; a temporary per-key minute counter enforces limits. No requester IP, device, location, URL or request body is saved by this feature. Key creation/revocation audit records contain key IDs, actions, administrator IDs and times. These records are retained until removed on request; no automatic cleanup is claimed. Ordinary hosting technical logs remain governed by the hosting provider's policy. API terms prohibit private scraping and resale without agreement. Advisory only. Follow the site's own rules.
Sandbox approval signatures
Optional administrator-only signature testing uses DocuSign as a processor in its demo environment, not production. It is off by default. If enabled, a fictional Approval record PDF and the signed-in approver's account email are sent to DocuSign to deliver a sandbox envelope. No real customer documents are sent. Sandbox: not legally binding. Arrival ID stores envelope status and signed time against the measurement; a separate private record holds the envelope reference, account reference, administrator ID and send time for status checking, duplicate prevention and the daily limit. The audit log contains actions, administrator IDs, record IDs and times, not documents or email addresses. PDFs and signed documents are not stored by Arrival ID. DocuSign may retain demo documents and recipient details under its own terms; its processing locations, contractual terms and retention must be confirmed before any production use. Sandbox records can be removed on request; no automatic deletion is claimed. Technical logs do not include signing credentials or document contents.
How long we keep it
Published Arrival IDs, photographs and access information are kept while your account is active. When you delete an Arrival ID or your account, it stops being shown immediately and we delete it on request within 30 days. Automatic scheduled deletion for guides and accounts is not yet switched on, so today that deletion is carried out by us when you ask or delete something. Arrival outcomes and reports are kept for up to 24 months to show whether a location's instructions work. Failed-code security records are kept for up to 30 days.
Anonymous arrival outcomes
The optional right-door question stores only guide ID, a fixed outcome, one optional problem tag, minutes lost (0–30), optional vehicle type, an optional SEE/TURN/STOP choice, and UTC date and hour. No names, phone numbers, accounts, device identifiers, exact locations or free text are collected by this question. Anonymous. We don't record who you are or where you are. Reports are self-reported by visitors, not verified. Managers see their own estate and units, tenants only their unit, site owners their guides and administrators all. Statistics and CSV exports require at least five reports for the guide and period. Per-guide hourly counts and short-lived, single-use random tickets limit spam without identifying visitors; tickets are not stored with outcome rows and are removed after use or expiry. New guide-open counts are aggregated by guide, date and hour, not by visitor. Stale or wrong guide reports create private owner notifications without free text. Outcome rows expire after 24 months and are excluded immediately from reads; permanent cleanup is implemented but not yet scheduled. This does not change existing guide/account deletion rules. Weekly email summaries are not currently offered. Ordinary hosting and map requests remain subject to those providers' technical logging; this question adds no visitor tracking.
Your rights
You can ask for a copy of your information, correct it, delete it, restrict or object to how we use it, and ask for it in a portable form. Email support and we will respond within one month. You can also ask us to delete your account entirely. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
What a recipient sees
Anyone holding the link sees the entrance name, instructions, warnings, the entrance pin and the pictures you published. They never see your account, your customer names, your job references or any internal journey name.
Photographs
Pictures are re-encoded on your phone before upload: hidden camera data is stripped and any blurring you apply is permanently baked into the picture. Only that published version is stored. The untouched original never leaves your phone, so a blur can never be undone by us or anyone else.
Who owns the pictures
You keep ownership of every photograph you publish. By publishing one you give us permission to store it and show it to the people holding your link, and to keep it as evidence of what that entrance looked like. We do not use your pictures for anything else, and we do not sell or license them.
Private and shared Arrival IDs
Nothing you create is listed publicly or indexed by search engines. An Arrival ID is reachable only by its code or the secure, unlisted link you share, and anyone holding that link can see it. You can expire or revoke a link at any time, after which it shows nothing but a "not available" message.
Taking something down
If an Arrival ID shows a face, a number plate, a gate code or anything that should not be shared, email support and we will take it down while it is reviewed. Recipients can also report a problem from the bottom of any Arrival ID page.
Keeping instructions safe and current
The publisher is responsible for making sure their instructions are accurate, lawful and safe to follow, and for updating them when a site changes. We do not independently write or verify instructions, and reports from recipients are only shown to the publisher for review.
Owner spoken instructions
Guide owners, estate managers and administrators can shorten their existing See, Turn and Stop words into an editable spoken instruction using fixed rules on their device, not a language model. Read aloud uses the device's built-in voice, not ElevenLabs. Spoken text and edits are not saved or logged; only the total number of copies per guide is stored. No visitor data is collected by this feature. English only; translation is not included. Checks for names, contact details and codes are best-effort, so owners must check safety and accuracy before copying. Arrival ID does not connect to doorbells, intercoms or voice assistants.
What you must not publish
Do not photograph people unnecessarily. Blur faces and number plates before publishing. Never publish gate codes, alarm codes or key-safe details. Only share access information you are authorised to share.
Location
Standard latitude and longitude are stored, so the pin works with any map or navigation app. New entrance positions start from your phone’s GPS and can be adjusted by you; addresses and site details are entered by you, not copied from a map provider’s search or geocoding results. Existing stored records are preserved; this does not audit their historical origin. Your phone's location is only recorded when you request or permit it.
Translations
Optional machine translation currently uses Verilingo. Only written steps, the landmark and public site notes are sent server-to-server when the owner requests a new language; no photos, private notes or contact fields are sent. Code, phone, email and name filters run before and after translation, but are not guarantees. Numbers and units are protected. Owners must preview and approve each language; changed source text hides its cached translations until re-approved. The owner’s original remains visible. A recipient’s language choice stays on their device. Bad-translation reports store only the guide, language and a short filtered note, shown to the owner. Do not include personal information. Daily usage counters contain only the day, owner account and count. Provider retention and processing locations remain to be confirmed before launch; any provider change requires this notice and our sub-processor list to be reviewed. Translation is not professional verification.
Quick create and guide read-aloud
Optional ElevenLabs read-aloud sends the current written prompt or guide step to ElevenLabs through our server. Only the dedicated Arrival ID credentials are used. We do not keep the resulting audio; the phone’s voice is a fallback. Spoken entry uses your browser’s speech recognition, which may send audio to its speech provider. You can always type instead. We do not record or store your microphone audio. Provider processing locations and retention still need confirmation before launch.
Field survey voice (planned)
When voice entry is switched on for private site surveys, spoken measurements will be sent to a third-party speech service, ElevenLabs, to turn them into text and read them back. We don't store audio. The speech provider processes it under its own terms. Name, phone number, number plate and access-code filters are best-effort checks, not guarantees. Approved site measurements expire after 12 months and show "Needs re-check" until re-approved. A site can ask for its survey data to be deleted.
Offline copies
Saving a guide for offline use is optional and only happens when the recipient chooses it. The saved copy stays on that device and may contain the guide's photographs and instructions. It is removed automatically when it expires, where the browser supports this, and can be removed at any time from Offline arrivals. If a link is revoked, the change reaches an offline device only after it reconnects.
Parking and van fit
Owners can save optional parking/unloading information, measurements, site rules and route text with role-only attribution, dates and methods. Only owner-approved, current values are shown; approvals and measurement dates expire after 12 months. Unconfirmed or expired values are not used to assume a vehicle fits. No names, contact details or access codes belong in these fields. Vehicle name, length, width, height and chosen safety margin are kept on the driver's device only, never uploaded; comparisons run on that device. Clearing site data or deleting the vehicle removes it. Saved Driver guide copies retain parking data locally; expiry is checked on the device, but changes reach a saved copy only when it is refreshed. Wrong-information reports use the existing anonymous owner notification, without sending vehicle details. Advisory only. Follow the site's own signs and rules.
Driver companion
The Driver companion (My drops) keeps everything on the driver's own phone: saved guides, private drops (name, address, postcode, other location reference, pin, up to three photos with captions, landmark line and notes) and "I'm lost" timings. None of this is sent to Arrival ID. Private photos are re-saved without hidden location data. A driver can share a minutes-lost summary using their phone's own share sheet. Deleting a drop, or clearing the browser's site data, removes it. Drivers can choose to export all their drops to a backup file without photos, including saved pins, guide links, notes and lost timings, and import that file on a phone. Backup files are not uploaded to Arrival ID. Anyone you share a file with can read its contents; keep it private. Deleting drops here does not delete backup files saved or shared elsewhere.
Fictional demonstrations
Public demonstrations use fictional places and purpose-made images. They do not expose a real location or personal information. Demonstration responses stay only in the open page, are not stored, and do not affect operational Arrival ID evidence. Unlisted partner walkthroughs do not collect additional information.
Internal business records
Arrival ID Ltd keeps a private learnings log, idea screen and weekly idea tests for its own planning: business ideas, site visits, competitor checks and notes. These are internal business records, not visitor data. Only Arrival ID administrators can see them, every change is logged, and they are not meant to hold personal details.
Your control
You can edit instructions at any time without changing the link, and you can archive an Arrival ID so the link stops working. Reports from recipients never change your instructions automatically.
Not for emergencies
Arrival ID is not an emergency service and must not be relied on by emergency responders.