Privacy Policy
ARM Agency ("we", "us", "our") operates arm-agency.com and provides reputation management, Generative Engine Optimization, and signal architecture services. This policy explains what data we collect, why we collect it, and the controls you have.
1. Data We Collect
From website forms
When you submit a Signal Audit request or contact form, we collect:
- Name — to address you in correspondence
- Email — to deliver your audit findings and communicate
- Company — to scope the audit to your entity
- Website URL — to run the signal audit against your domain
- Service interest — to route your request to the right engagement tier
- Notes — any context you provide about what you're seeing in AI search results
From phone calls
When you call our support line (+1 224-275-9027), powered by Vapi, we process:
- Phone number — caller ID provided by the carrier
- Call transcript — a transcript of the conversation for quality and follow-up
- Call summary — an AI-generated summary of the call's purpose and outcome
- Structured data — name, email, company, and service interest extracted during the call
Call recordings, if any, are retained by Vapi according to their data retention policy. We receive transcripts and structured data, not the raw audio.
During an engagement
If you become a client, we also collect:
- Domain analytics, schema markup, and crawler infrastructure data from your web properties
- Share of Model measurements — query results from ChatGPT, Claude, Gemini, and Perplexity related to your entity
- Entity graph data — structured information about your organization's public-facing identity
- Campaign and deliverable records — work product, timelines, and performance tracking
Automatically collected
- Standard server logs (IP address, user agent, timestamp) — used for security and site stability
- No third-party analytics cookies. No advertising pixels. No cross-site tracking.
2. How We Use Your Data
- Deliver services — run signal audits, build entity graphs, track Share of Model
- Communicate — send audit findings, engagement updates, and invoices
- Improve our work — aggregate, anonymized analysis of audit patterns to refine our methodology
- Legal compliance — retain records as required by applicable law
We do not:
- Sell your data to third parties
- Use your data to train AI or machine learning models
- Share your data with marketing partners
- Build behavioral profiles for advertising
3. Data Storage and Processing
Lead and engagement data is stored in our managed backend (Base44) with row-level security isolation. Call data is processed through Vapi's voice infrastructure. Payment data is handled by our payment processor — we never store card numbers or banking credentials.
All data is processed in the United States. We do not transfer personal data to jurisdictions with inadequate data protection standards.
4. Data Retention
| Data type | Retention period |
|---|---|
| Lead inquiries (no engagement) | 90 days after last contact |
| Active client records | Duration of engagement + 3 years |
| Call transcripts | 12 months |
| Server logs | 30 days |
| Audit findings reports | 7 years (legal record) |
5. Your Rights
Depending on your jurisdiction (GDPR, CCPA, or similar), you may have the right to:
- Access — request a copy of the personal data we hold about you
- Correct — request correction of inaccurate or incomplete data
- Delete — request deletion of your personal data (subject to legal retention obligations)
- Portability — receive your data in a structured, machine-readable format
- Object — object to processing of your data for specific purposes
- Withdraw consent — withdraw consent for processing at any time
To exercise any of these rights, email ops924-agent@manus.bot. We respond within 30 days.
6. Third-Party Services
We use the following third-party services that may process limited personal data:
- Vapi — voice AI infrastructure for our support line. Processes call audio, transcripts, and caller metadata.
- Base44 — backend infrastructure for lead and client data storage with row-level security.
- Payment processor — handles billing. We do not see or store your card details.
- Google Fonts — serves web fonts. May log your IP address. See Google's privacy policy.
Each service operates under its own privacy policy and data processing terms. We select vendors that demonstrate adequate data protection controls.
7. Security
We use row-level security on all client data, encrypted connections (TLS 1.2+) for all data in transit, and encrypted at-rest storage. Access to client data is restricted to authorized personnel with a need-to-know basis.
No system is perfectly secure. If we become aware of a data breach affecting your personal data, we will notify you within 72 hours of confirmation, in accordance with applicable law.
8. Children's Privacy
Our services are intended for businesses and professionals. We do not knowingly collect data from anyone under 16. If you believe we have collected data from a minor, contact us and we will delete it.
9. International Users
ARM Agency is based in the United States. If you access our services from outside the US, your data is still processed in the US. By using our services, you consent to this transfer. We comply with GDPR for EU/UK users and CCPA for California residents.
10. Changes to This Policy
We update this policy as our services evolve. Material changes will be posted to this page with an updated effective date. We will not reduce your privacy protections without notice.
Last updated: August 11, 2026
11. Contact
Questions about this policy or your data? Reach us:
- Email: ops924-agent@manus.bot
- Phone: +1 (224) 275-9027
- Part of the Arctura ecosystem