Privacy Policy
Last updated: October 11, 2026
This policy explains what personal data Arrowsterr collects, why, and what you can do about it. Arrowsterr is run by Arrowsterr ("Arrowsterr", "we", "us"). Questions go to privacy@arrowsterr.com.
Who this covers
- Customers and their team members who use the Arrowsterr app at app.arrowsterr.com.
- Visitors to arrowsterr.com.
- Visitors to our customers' websites, when a customer installs the Arrowsterr tracking script. For that data, the customer is the controller and we are the processor. See our Data Processing Agreement.
What we collect
Account data. Your email address, your password (stored as a secure hash, never in plain text), and your name and profile picture if you sign in with Google.
Workspace content. What you add to Arrowsterr: brand names, website addresses, prompts, topics, competitors, content briefs, content plans, drafts, reports and settings.
Billing data. Your plan, invoices and billing address. Card details go straight to Stripe. We never see or store your full card number.
Connected accounts. If you connect Google Analytics 4, we get read-only access to the analytics properties you pick. We store an encrypted access token and read traffic reports to show them in Arrowsterr. We never change anything in your Google account. You can disconnect at any time.
Usage and device data. Pages you open in the app, actions you take, errors, browser type, and IP address. We use this to run, secure and improve the service.
Website visitor data (tracking script). When a customer installs our script on their site, it records page views, referrers, device type, country, and clicks on buttons and links. It does not use cookies, does not record what people type into forms, and does not store full IP addresses.
Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Run your account and the features you use | Contract |
| Charge for your plan and send invoices | Contract, legal obligation |
| Keep the service safe and fix errors | Legitimate interest |
| Send service emails (sign-in links, receipts, alerts you turn on) | Contract |
| Send product news, if you opt in | Consent |
| Improve Arrowsterr with usage numbers | Legitimate interest |
We do not sell personal data. We do not use your content to train AI models.
AI providers
To check how AI assistants describe a brand, Arrowsterr sends prompts and brand details to AI providers. These requests are about brands and topics. Please do not put personal data in prompts. Our providers process these requests under their API terms, which do not allow them to train on the data.
Who we share data with
We use these service providers (sub-processors) to run Arrowsterr:
| Provider | What they do | Location |
|---|---|---|
| Supabase | Database and sign-in | – |
| Render | App hosting | – |
| Stripe | Payments and invoices | United States |
| Anthropic | AI answers and writing | United States |
| OpenAI | AI answers | United States |
| Google (Gemini, Google Analytics API) | AI answers, GA4 data you connect | United States |
| Perplexity | AI answers | United States |
| DataForSEO | Search and AI answer data | – |
| Umami | Website analytics for the tracking script | – |
| Sentry | Error monitoring | – |
| Resend | Service emails | – |
We may also share data when the law requires it, or as part of a merger or sale of the business, with notice to you.
International transfers
Some providers are outside your country. When personal data leaves the EU, UK or Switzerland, we rely on the EU Standard Contractual Clauses (and the UK addendum) or another approved transfer tool.
How long we keep data
- Account and workspace data: while your account is open. When you delete your account or workspace, we delete its data within 30 days. Backups roll off within a further 30 days.
- Billing records: as long as tax law requires (usually 7 to 10 years).
- Error and security logs: up to 90 days.
- Tracking script data: as long as the customer's plan keeps history, then deleted.
Your rights
Depending on where you live, you can ask to see, correct, delete or export your data, object to some uses, or withdraw consent. Email privacy@arrowsterr.com. We answer within 30 days. You can also complain to your local data protection authority.
California residents: we do not sell or share personal information for cross-context advertising.
Cookies and local storage
The Arrowsterr app uses your browser's local storage to keep you signed in and remember choices like your last workspace. These are needed for the app to work. We do not use advertising cookies. Stripe sets its own cookies on its checkout pages to prevent fraud. The tracking script sets no cookies.
Security
Data is encrypted in transit (HTTPS) and at rest. Access tokens for connected accounts are encrypted again on top of that. Access inside the company is limited to people who need it.
Children
Arrowsterr is for businesses. It is not meant for anyone under 16.
Changes
If we make important changes, we will tell you by email or in the app before they apply.
Contact
Arrowsterr. Email: privacy@arrowsterr.com.