Privacy notice

Who we are

Arrow Group Consulting is a marketing agency in Michigan, USA. We run email, forms, reports and social media content for a small group of client organizations.

This platform, at app.arrowgroupconsulting.com, is the tool we built for that work. In this notice, “we” and “us” mean Arrow Group Consulting. “The platform” means this tool and its public pages.

This notice covers the platform’s public pages: forms and applications, unsubscribe pages, shared reports, invoices and files, and the sign-in page. It also covers the emails and text messages sent through the platform. It does not cover our clients’ own websites. Ask the organization that runs a website how it handles information there.

Whose information it is

Most of the personal information on the platform is there because one of our clients collected it. When you fill in a form, join a mailing list, place an order or apply to volunteer, you are dealing with that organization. It decides what to ask for and what to do with the answers. We store and handle the information for it, on its instructions.

A few things we decide ourselves: the accounts of people who sign in to the platform, and the records that keep the platform secure.

So if you want to know why an organization asked you for something, start with that organization. You can also contact us. See How to reach us.

What we collect

What we hold about you depends on how you met the platform. Each part below is one way.

Forms on a client’s website

Many of our clients’ website forms send their answers to the platform: contact forms, sign-ups, requests and orders.

• We store what you typed. That is usually your name, email address, phone number and organization, plus your other answers.
• We store which form it was and when you sent it.
• The organization’s staff get an alert email with your answers, so they can reply to you.
• We use your internet (IP) address for a moment to slow down spam. We do not save it with your answers.

A submission that looks like spam is set aside for a person to check, and an automated one can be thrown away. When our own rules are not sure, an AI service (Anthropic) may be asked for a second opinion. It is sent the organization’s name, the form’s name, your name and your answers. It is not sent your email address or phone number. Volunteer applications, newsletter sign-ups and orders that carry a payment are never sent to it.

Volunteer applications

Some clients use the platform for a longer application, such as a volunteer application. It asks for more than an ordinary form: for example your date of birth, sex, race or ethnicity, address, employer, education and marital status. It also asks about other people: your references, your spouse or partner, and the people who live with you.

The application also asks for a Social Security number, a driver’s license number, other names you have used, answers about criminal history and mental health (yours and your spouse’s or partner’s), your signature, and photos of your ID.

Those sensitive answers are handled differently from the rest. They are not kept in your contact record, in the alerts staff receive, or in the saved draft of an unfinished application. They are written only into the signed PDF of your application.

• The signed PDF and the ID photos are stored in the organization’s files on the platform. Only an agency admin or an admin of the organization’s own account can open them there, and each time one is opened, who opened it and when is recorded.
• They are also emailed, as attachments, to the staff the organization has named to receive applications.
• You are given a private link to your own signed copy, which works for seven days. A copy is also emailed to you when the organization has email sending set up.
• The PDF records the date, the time and the internet (IP) address used to sign it.

While you fill the application in, the platform saves a draft so you can come back later. The draft never holds the sensitive answers above, and it is deleted when you submit. A draft you never finish is not removed automatically. It stays until its removal is asked for. If you upload photos of your ID and never submit, the photos stay in private storage, where no one can open them through the platform. They are not removed automatically either. We also note which step you reached, with your email address, so the organization can see how far each applicant got.

Emails

When a client sends you an email through the platform, we record that it was sent, whether it was delivered, and whether it bounced or was marked as spam.

Where tracking is switched on, we also record whether the email was opened and which links were clicked. Links in the email pass through our email provider (Resend) so a click can be counted. With an open or a click we keep the time, the link, and the short technical description your mail app or browser sends about itself. That tells us roughly what kind of device and mail app was used. Since September 9, 2026 we do not keep the IP address of an open or a click. A few records from before then may still hold it.

Many “clicks” are made by security scanners that check links before you see them. We flag those and leave them out of the counts.

If your reply to an email comes back to the platform, it is stored so the organization’s team can read and answer it. A member of that team can ask an AI helper (Anthropic) to read a reply and suggest an answer or an action. That sends the AI service the message and its subject, your name and email address, any form answers you sent, and a few details from your contact record, such as tags, organization, job title and how long you have been on the list.

Some emails use fonts from Google Fonts. If your mail app loads them, Google receives that request. Pictures in an email may be loaded from the organization’s own website or the service it keeps its images on.

Shared reports, invoices, previews and files

We share some pages by private link: a client’s monthly report, an invoice, a preview of an email, or a file. The link itself is the key. Anyone who has the link can open the page until the link is turned off or runs out.

• Report pages show totals only. They do not list who received, opened or clicked anything.
• We count how many times a report or invoice link has been opened, and when it was last opened.
• While one of these pages is open, it can show who else is looking at it. Your browser tab is given a random id, and other viewers see you as an anonymous animal. A signed-in member of the team may appear by name.
• Those “who is looking” records are short-lived. One that is more than three minutes old is deleted the next time any shared page checks in.

Websites that use our tracking tag

Some clients add a small tracking tag from the platform to their website, so they can see how many people visit and which pages are read. The platform’s own application pages use it too.

• The tag sets no cookies. It keeps a random visitor id in your browser’s local storage and a visit id in session storage, on that website only.
• For each page view we store: the page’s address without anything after a “?”, the name of the website that sent you, your country and city, the network your connection came from, your device type, browser and operating system, and any campaign tags in the link.
• Your IP address is used at that moment to work out the country and city and to limit floods of traffic. It is not stored.
• Page views are not linked to your name, your email address or your contact record.
• If your browser sends a “Do Not Track” signal, the tag sends nothing at all. Not every browser can send it.

Text messages

Texting is built into the platform, but it was not switched on when this notice was last updated. When a client uses it, these rules apply.

• Ticking a box on a website form is only a request. It becomes consent when you confirm from your own phone, by texting START to the organization’s number.
• You can stop at any time by replying STOP. The words STOPALL, UNSUBSCRIBE, CANCEL, END and QUIT work too.
• We store your phone number, the messages sent to it and received from it, and the record of your consent and of any opt-out.
• Message frequency depends on the organization. Message and data rates may apply.

We do not sell or share mobile phone numbers, or text-message opt-in data and consent, with third parties or affiliates for marketing or promotional purposes.

Orders and payments

The platform does not take card payments and never sees your card number.

• Where a client sells through Square, Square tells the platform when an order has been paid. We receive the buyer’s email address, the amount and a link to the receipt, so the order can be recorded and confirmed.
• Where a client sends invoices through Wix, the platform sends Wix the customer’s name and email address, what the invoice is for and the amount. Payment happens on Wix.
• Where a client’s online shop uses the platform to send its order emails, the shop sends us the buyer’s email address and the order details.

For some clients the platform also shows their team records kept in the client’s own systems, such as store orders, event submissions, RSVPs, bookings or training records.

Facebook and Instagram (Meta)

The agency can connect its own Facebook login to the platform. This lets the platform read results for the Facebook Pages and Instagram accounts that our clients have asked us to look after.

We ask Meta for permission to do five things only: list those Pages, read their engagement, read their insights, read basic details of the linked Instagram accounts, and read Instagram insights. These permissions do not let us post, send messages or change anything.

From Meta we store:

• the name and Meta user id of the staff member who made the connection;
• each Page’s and Instagram account’s id, name and username;
• an access token for each, stored encrypted;
• each post’s text, link, date and result counts, such as views, reach, reactions, shares and the number of comments;
• daily follower totals.

We do not read messages. We do not read or store what comments say, or who wrote them. We do not collect the names or profiles of followers, or of people who react to a post.

An agency admin can disconnect Meta at any time. That deletes every stored Meta access token at once. The numbers already collected stay until their removal is asked for. See Data deletion.

People who sign in

Agency staff and members of our clients’ teams sign in to the platform. For each of them we store a name, an email address, a password and a role. The password is stored only as a salted hash, never as readable text. We also keep records of actions they take, such as who approved or sent something.

• A failed sign-in attempt is logged with the email address that was tried and the IP address, to slow down password guessing. These records are deleted after about seven days.
• If a team member turns on notifications, we store that device’s push subscription and a label for the device. Notifications are delivered through the push service of the phone or browser maker (Apple, Google, Mozilla or Microsoft).

What we use it for

• To do the job the organization asked for: deliver its emails and texts, show its team the forms and applications people send, and keep its contact list.
• To report results to the organization: how many emails were delivered, opened and clicked, how many people visited its website, and how its social media posts did.
• To honor your choices, such as unsubscribing.
• To keep the platform secure and to stop spam and abuse.
• To find and fix problems.

We do not sell personal information. Each organization’s contacts are kept separate. One client’s list is not used for another client.

Cookies and browser storage

The platform’s public pages do not set cookies. That includes application pages, unsubscribe pages and shared links. That is why you see no cookie banner.

Two cookies exist. Both are only for people who sign in.

arrow_session

Keeps you signed in. It is set when you sign in, lasts up to 14 days and is removed when you sign out. Scripts cannot read it, and it is only sent over a secure connection.

arrow_meta_state

Set for ten minutes while an agency admin connects Meta. It makes sure the person who comes back from Meta is the person who started.

Some pages use your browser’s storage in place of cookies.

• Shared pages keep a random viewer id in the tab’s session storage (sp-viewer). It is gone when you close the tab.
• The tracking tag keeps a random visitor id in local storage (_arrow_v) and a visit id in session storage (_arrow_s, _arrow_t). It does this on a client’s website that uses the tag, and on the platform’s application pages.
• For people who are signed in, the app keeps some settings and unsent drafts in the browser’s storage. The phone app also keeps a copy of its own files so it opens quickly.

Who we share it with

We share personal information with the organization it belongs to, and with the companies that help us run the platform. We do not sell it.

The organization you dealt with. Its team sees its own contacts, forms, applications, replies and results in the platform. It does not see another client’s. One exception: an emailed reply the platform cannot match to any organization is filed under one client account so our team can sort it, and that client’s team may see it there.

Companies that handle information for us.

Cloudflare

Runs the platform and stores its databases and files. Every request to the platform passes through Cloudflare, which also keeps technical logs of those requests.

Resend

Sends and receives email for the platform, and reports deliveries, bounces, opens and clicks.

Anthropic

Provides the AI used for the spam check, to write the short preview line of marketing emails, and for helpers that staff choose to use, such as suggesting a reply.

OpenAI

Makes pictures for a client: event posters from an event’s title, date and place, and illustrations for newsletters the team asks the platform to draft. No one’s contact details are sent.

Meta

Sends us the Page and Instagram results described above. We do not send your details to Meta.

Square

Tells us when an order placed with certain clients has been paid.

Wix

Issues invoices and takes payment for a client that bills through Wix.

Telnyx or Twilio

Will carry text messages once texting is switched on.

Apple, Google, Mozilla, Microsoft

Deliver push notifications to the phones and browsers of team members who turn them on.

Google Fonts

Serves the fonts used on the sign-in page, on shared report and invoice pages, and in some emails. Your browser or mail app fetches them from Google directly, so Google sees that request, including your IP address. This page and the other two legal pages do not use them.

We may also have to disclose information when the law requires it, for example under a valid court order.

Where it is stored

The platform runs on Cloudflare’s network. Cloudflare has data centers around the world, so a request may be handled in one near you. The platform’s databases and files are stored by Cloudflare. The file store was set up with eastern North America as its preferred location.

Most of the companies listed above are based in the United States. If you are in another country, expect your information to be handled outside it, including in the United States.

How long we keep it

We keep most records until the organization they belong to, or the person they are about, asks for them to be removed. The platform has a fixed time limit for the things below.

Failed sign-in records

Deleted after about seven days.

“Who is looking” records on shared pages

Deleted once they are more than three minutes old, the next time any shared page checks in.

The draft of an unfinished application

Deleted when the application is submitted.

The sign-in cookie

Lasts up to 14 days.

The log of each Meta sync

Kept for 30 days.

Notifications for team members

Delivery records are kept for 3 days. The list of notifications is kept for 60 days.

Database restore points

Cloudflare can restore the platform’s databases to any moment in the last 30 days. Something deleted today can stay in those restore points for up to 30 days.

Everything else has no automatic end date. That includes contacts, form answers, applications and their PDFs, email and click records, website visit records, each organization’s do-not-email list and the social media numbers we collect. They stay until their removal is asked for. See Your choices.

Your choices

Stop emails

Every marketing email sent through the platform has an unsubscribe link. One click takes you off that organization’s list. You do not need to sign in or give a reason. Many mail apps also show their own Unsubscribe button, which works the same way.

• After you unsubscribe, the page asks why you left. Answering is optional. If you answer, the organization’s team can read it.
• Your address goes on that organization’s do-not-email list, so it is not emailed marketing again, even if your contact record is later deleted or you fill in one of its forms again.
• Unsubscribing from one organization does not unsubscribe you from another.
• You can also reply to an email and ask to be taken off the list.

Stop texts

Reply STOP to any text message sent through the platform.

See, correct or delete your information

You can ask what an organization holds about you on the platform. You can ask for it to be corrected, and you can ask for it to be deleted.

The quickest way is to ask the organization you gave your details to. You can also reply to an email that organization sent you through the platform. Say which organization it is about, and give the email address or phone number you used, so the right record can be found.

We may need to check that a request really comes from you before we act on it. The steps, and what deleting does and does not remove, are on the Data deletion page.

Website visits

Turn on “Do Not Track” in your browser, if it offers it, and the tracking tag sends nothing. You can also clear your browser’s stored data for a website to remove the visitor id.

Children

Accounts on the platform are by invitation, for agency staff and members of our clients’ teams. They are not offered to children.

The platform does not check the age of a person who fills in a form. A volunteer application can ask an applicant to list the people in their household, and that list can include children’s names and ages.

If you believe a child has sent personal information through one of our clients’ forms, tell the organization or us, and ask for it to be removed.

Keeping it safe

• Team members must sign in to see contacts, forms or files, and each account is limited to the clients and tools it has been given.
• Passwords are stored only as salted hashes. The sign-in cookie is only sent over a secure (HTTPS) connection.
• Stored Meta access tokens are encrypted.
• Unsubscribe links are signed so they cannot be guessed or forged. Shared links use long random keys and can be turned off.
• The sensitive answers in an application are kept out of everyday records, as described above.

No system can be made perfectly secure. If you think something is wrong, please tell us.

Changes to this notice

When the way the platform handles information changes, we update this notice and change the date at the top. The current version is always at this address.

How to reach us

If your question is about what one organization holds about you, that organization is the quickest place to ask. You can also reply to an email that organization sent you through the platform: your reply goes to that organization.