Arch Capital Group
Financials
32
out of 100. Number 374 of 512, counting from the worst.
Where Arch Capital Group does well
- Arbitration 2 of 20. Few problems found.
- Renewals 2 of 20. Few problems found.
- Arch Mortgage Insurance's federal FACTS privacy notice answers 'No' to sharing for marketing, joint marketing, affiliate marketing, and nonaffiliate marketing — all 'No / N/A', better than many peers.
- The Cookie Policy requires specific opt-in consent before targeted/advertising cookies are used.
- The main privacy policy prominently lists a Data Protection Officer with phone (1-877-800-6249), email, and regional DPO contacts for US, EU/UK, and Bermuda.
- The Arch MI notice contractually limits third parties with access to nonpublic personal information to the specified purpose only.
Arch can change its website terms at any time without telling you, and simply visiting the site again counts as agreeing to the new terms — even if you never saw them.
The fine print
6 clauses and findings from the draft archive, dated 1 October 2026. The plain English comes first; the small print is the company's own words. None of these has been checked yet.
-
Arch can change its website terms at any time without telling you, and simply visiting the site again counts as agreeing to the new terms — even if you never saw them.
These Terms and Conditions may be updated periodically without notice and will become effective immediately upon posting. It is your responsibility to review these Terms and Conditions before each use of this website. Each time you access this website, you are deemed to have accepted the then-current Terms and Conditions.
-
You are contractually banned from copying or reusing any part of the site for commercial purposes, a broad restriction that goes beyond standard copyright law.
As a condition of using the Website, you warrant not to use it for any illegal or prohibited purpose or to reproduce or distribute any part of the Website for any commercial use unless permitted by these Terms and Conditions.
-
Arch may hold your personal data even if you never interacted with them — you can be in their systems because your insurer reinsures with them, and you are told to go read the other company's privacy policy for details.
In the reinsurance context, we may have Personal Data about you that we did not directly collect. For example, if you purchased an insurance policy from a company that reinsures us, we may receive your Personal Data.
-
The no-sale promise has an escape hatch: with merely 'advance notice' they can start transferring your data. And anonymized data — which can be broad — is freely available for marketing and advertising use.
We do not sell, trade, or otherwise transfer to outside parties your Personal Data unless we provide users with advance notice. However, non-Personal Data may be provided to other parties for marketing, advertising, or other uses.
-
Your data can be repurposed for new uses not listed in the policy as long as Arch decides they are 'compatible' with the original reason — a vague standard you have no say over.
We might process your Personal Data for additional purposes that are not mentioned here, but are compatible with the original purpose for which the data was gathered... We will inform you of any further Processing and purposes.
-
Even if you turn on Do Not Track or Global Privacy Control in your browser, Arch explicitly ignores those signals and puts the burden on you to manage consent in their own cookie tool.
We do not track information about an individual consumer's online activities over time and across third-party websites or online services (i.e. cross-contextual behavioral advertising) except with your specific, opt-in consent. Accordingly, we do not monitor or take any action with respect to these browsers' Do Not Track signals (including the Global Privacy Control signal).
How these were found
Terms & Conditions last revised Dec 3, 2025; Privacy and Data Protection Policy effective Dec 2, 2025; Cookie Policy dated Jan 14, 2026; Arch MI consumer notice is a 2025 document. The main Privacy and Data Protection Policy page is accordion-gated: only its introduction, scope, controller, and contact sections rendered via text fetch, so its deeper sections (disclosure categories, retention periods, California/EEA rights) were not directly read. myarch.com/privacy-policy is MyArch Inc.'s own subsidiary portal policy (verified by direct read), and the Arch MI FACTS notice (mortgage.archgroup.com) is a subsidiary GLBA notice — both are Arch group companies, not the parent company's policy. Arch Insurance (UK) retention language (6–7 years post-termination) was seen only in search snippets, not opened, so it is not quoted as a finding. No forced-arbitration or auto-renewal language was found in any document reviewed; scores in those categories reflect absence, not confirmed absence. Arch Capital is a B2B insurer/reinsurer with a thin direct-consumer surface, so the score is kept modest accordingly.
These notes come from the original draft and are not independent verification.