Your data stays yours

Privacy Policy

Last updated: October 15, 2026

1. What we collect

Account information: your name and email address when you sign up.
Lead data: names, email addresses, and WhatsApp numbers submitted on your public capture pages (lead magnets, waitlists, referral programs). This data belongs to you — we store it on your behalf so you can manage it in your CRM.
Billing information: your email and payment details processed by our payment provider. We do not store full card numbers — the provider tokenizes and stores them.
Usage data: anonymized, aggregate analytics (page views, feature usage) to improve the product.

To provide the LeadLoop service — your dashboard, CRM, capture pages, outreach, nurturing, and analytics.
To process payments and manage your subscription.
To send you service notifications (e.g., new lead captured, nurture step due).
To improve the product. We never sell your data or your leads' data to anyone. Ever.

Your lead data is yours. Every email, WhatsApp number, note, tag, and activity log lives in your own database, scoped to your account.
You can export your entire CRM to CSV at any time from the dashboard.
You can delete your account and all associated data at any time — just email us and we'll purge everything within 30 days.
No platform can throttle your reach, shut down your account, or hold your audience hostage. You own it end-to-end.

Every table in the database is protected by Row-Level Security policies enforced at the database engine level — not just in the application UI.
This means a user can only read and write their own data. Even if someone bypassed the application, the database itself rejects unauthorized access.
Public capture functions (claim a magnet, join a waitlist, enroll a referrer) are the only exception — they are tightly scoped to their purpose and cannot read or modify other users' data.

All data in transit is encrypted via HTTPS/TLS 1.2+.
All data at rest in the database is encrypted by the hosting provider.
API keys and connection credentials (e.g., your automation platform key) are encrypted at rest and never exposed in the client-side application or browser.
Server-side secrets are injected at request time and never bundled into client code.

Cloud (managed database, auth, and storage) — hosts your data with enterprise-grade encryption and compliance certifications.
Payment provider — processes your subscription payments. We receive a tokenized confirmation; we do not see or store your full card number.
Automation platform (optional) — if you connect Konnectlia or GoHighLevel, we push your captured leads to that platform via its API. That platform then governs its own data handling per its terms.
We do not share your data with advertising networks, data brokers, or third-party analytics that sell data.

Access: you can see all your data in the dashboard or request a full export.
Portability: export your CRM to CSV anytime.
Erasure: request deletion of your account and all data; we comply within 30 days.
Rectification: edit your lead data or profile directly in the app.
Objection: disconnect any automation integration at any time from Settings.
If you're in the EU/UK (GDPR) or California (CCPA), you have these rights by law. Email privacy@arketting.com to exercise any of them.

When a person submits their email or WhatsApp number on one of your public capture pages, they do so voluntarily in exchange for access to your offer.
You are responsible for complying with applicable marketing consent laws (CAN-SPAM, GDPR, etc.) in your jurisdiction when contacting those leads.
LeadLoop provides tools (tags, source tracking, double opt-in via your automation platform) to help you manage consent — but the legal responsibility for outreach compliance rests with you.

Active accounts: your data is retained for as long as your account is active.
Cancelled accounts: your data is retained for 30 days after cancellation, then permanently deleted. You can request immediate deletion anytime.
Free accounts with no activity for 12+ months may be archived; you'll be notified by email first.

Authentication: email/password with secure hashing. No anonymous sign-ups.
Authorization: every API call is scoped to your authenticated identity via RLS.
Secret management: all API keys and server credentials are stored in a managed secrets vault — never in client code, never in version control.
Billing webhook verification: all payment webhooks are signature-verified before any plan change is applied.
We do not offer bug bounties, but we take security reports seriously. Email security@arketting.com.

Questions about your data? Email privacy@arketting.com. Security reports to security@arketting.com.