Privacy Policy

This describes what ARC Creative Co. collects when you use this website, and why. It reflects what this site actually does — not a template.

What you give us

When you complete the Book a Strategy Call form we collect what you enter: your name, business email address, phone number if you provide one, your company and website, your industry, the service you are interested in, your current monthly marketing spend range, your primary growth goal, your biggest current constraint, your current marketing partners or team, your preferred timeline, and how you heard about us. We store your answers exactly as you submitted them.

What we record automatically

When you submit the form we record the page you were on and any campaign tags in the link you followed — for example utm_source, utm_medium, utm_campaign, or a Google or Meta click identifier. This tells us which marketing actually reaches the businesses we can help. We also record the IP address the submission came from, which is used to rate-limit abuse and nothing else. We do not build a profile of you across other websites.

Consent

We record that you agreed to be contacted, and when. Consent is asked for fresh each time — a restored tick box is not consent, so the form never remembers it for you.

How we use it

To respond to your enquiry, to determine whether ARC is the right partner for what you are trying to do, and to prepare for the conversation if we speak. We do not sell your information.

Booking a call

Our booking pages embed Calendly, a third-party scheduling service. When you view or use those pages, Calendly receives your interaction with their booking widget and applies their own privacy policy and cookies — this happens between you and Calendly, and we do not control it. If you book, the details you give Calendly (your name, email, and anything you add) are held by Calendly and shared with us so we can attend the call.

Payments

None. This website does not take payment and does not ask for card details anywhere. If you become a client, invoicing is arranged separately and never through this site.

Spam protection

The form includes a hidden field that real people never see and automated scripts tend to fill in, and we limit how many times the same connection can submit in a short window. That is how we keep junk out without making you solve a puzzle.

Client platforms we connect to

This section is about our client work, not about visiting this website. If you are a visitor, nothing here applies to you.

With a client’s explicit authorisation, we connect to platforms where that client already holds an account — including Google Business Profile, Google Analytics, Google Search Console, Google Ads and Meta — so that we can report on and manage that client’s own presence there.

What we access. Only data belonging to the accounts a client has connected: business listing information, performance metrics such as impressions, phone calls and direction requests, reviews and review replies, posts, and advertising and analytics reporting data.

What we do with it. We use it solely to produce reporting for that client and to carry out work the client has engaged us to do, such as updating listing details or publishing posts on their behalf. We do not use it to train models, we do not combine one client’s data with another’s, and we never sell it.

How it is stored. Metrics and listing data are held in our own reporting systems on infrastructure we control, located in the United States. Access tokens are encrypted at rest and are used only to make requests to the platform that issued them.

How long we keep it. While we are working with a client we keep reporting data on a rolling 24-month basis, so that year-on-year comparisons remain possible — Google’s own APIs serve only 18 months of Business Profile performance data and 14 months of Analytics event data, so any longer record has to be one we keep ourselves. When an engagement ends we delete that client’s reporting data within 90 days. Access tokens are deleted immediately when a client disconnects an account or the engagement ends.

Revoking access. A client can disconnect us at any time, either by asking us or directly in their own platform’s security settings — for Google, at myaccount.google.com/permissions. Revoking access stops all future data collection immediately.

Google user data. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Your information, on request

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Contact us and we will action it.