── legal
Privacy Policy
Last updated July 2026
ArbFlow ("we", "us") provides marketing-analytics dashboards for agencies. This policy explains what we collect, why, and the choices you have. We aim to collect as little as possible and never sell your data.
On this page
1.Information we collect
- Account data — your name/company, email, and a securely hashed password (bcrypt). We never store your password in plain text.
- Connected-source credentials — when you link Google Analytics (or, in future, Meta/LinkedIn), we store the OAuth access/refresh tokens encrypted at rest (Fernet/AES). We never see or store your Google password.
- Analytics data — we fetch reporting metrics from your connected sources to render your dashboards. We request read-only scopes.
- Basic technical data — IP address and request metadata, used for security (rate limiting) and reliability.
2.How we use it
To operate the product: authenticate you, render your dashboards, generate reports, and keep the service secure and reliable. We do not use your analytics data for advertising and we do not sell it.
3.Third-party services
We rely on infrastructure providers to run ArbFlow — hosting (Vercel, Render), a managed Postgres database (Neon), and the analytics APIs you connect (e.g. Google Analytics). Your data is processed by these providers only to deliver the service.
5.Data retention & deletion
We keep your data while your account is active. You can delete your account at any time from Settings → Profile → Danger zone; this permanently removes your account and all connected-source credentials. You may also email us to request export or deletion.
6.Your rights (GDPR/CCPA)
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to withdraw consent. Contact us to exercise these rights; disconnecting a data source or deleting your account takes effect immediately.
7.Security
Credentials are encrypted at rest, passwords are hashed, sign-in is rate-limited, and access to your workspace requires authentication. No system is perfectly secure, but we take reasonable measures to protect your data and continue to harden the platform.
8.Changes to this policy
We may update this policy as the product evolves. Material changes will be reflected by the "Last updated" date above.