Privacy Policy
Effective date: June 16, 2026 · Last updated: June 16, 2026
In plain English
We collect what we need to build your site, bill you, and support you — your account details, the content you give us, and basic usage data. We don't sell your data. Payments run through Stripe; sign-in runs through Google/Firebase. You can ask us to access or delete your information at any time.
This Privacy Policy explains how Arbor ("Arbor", "we", "us") collects, uses, and shares personal information when you visit arbor.zone, sign in to the dashboard, or use our services (the "Service"). By using the Service, you agree to this Policy.
1. Information we collect
| Category | Examples |
|---|---|
| Account & identity | Name, email address, and a user ID created when you sign in (via email/password, email link, or Google). |
| Content you provide | The text, images, logos, and business details you give us to build and maintain your site, plus messages you send to Sage or our team. |
| Billing | Processed by Stripe. We receive limited details such as your name, email, subscription status, and the card brand and last four digits — we do not store full card numbers. |
| Usage & device | IP address, browser and device type, pages viewed, and timestamps, collected through logs and analytics. |
| Cookies & local storage | Including the authentication session kept in your browser so you stay signed in (see Section 4). |
2. How we use information
- Provide and operate the Service — building, hosting, and changing your site, including via Sage.
- Authenticate you and keep your account secure, and prevent fraud and abuse.
- Process payments and manage your subscription (through Stripe).
- Provide support and respond to your requests.
- Send you service messages and, where permitted, occasional product updates (you can opt out of marketing).
- Improve and develop the Service, and comply with legal obligations.
3. Legal bases
Where laws such as the EU/UK GDPR apply, we process personal information to perform our contract with you, for our legitimate interests in operating and improving the Service, with your consent (which you may withdraw), and to meet legal obligations.
4. Cookies & local storage
We use essential storage to run the Service — most importantly, the Firebase authentication session stored in your browser, which is what keeps you signed in between visits. We also use limited analytics to understand usage. You can clear or block this storage through your browser settings, though doing so may sign you out or limit functionality.
On our marketing pages we also use Google advertising cookies to measure the performance of our ads and to show relevant ads. You can opt out through Google's Ads Settings. If you use our free SEO & AEO score checker, we record the website address you check so we can improve the tool and follow up about your results; you only give us your email or phone number if you choose to request the full report.
When you complete a purchase, we use Google's enhanced conversions to measure which ads lead to real signups. Your email address is converted into an irreversible cryptographic hash in your own browser before it is sent to Google, so Google receives the hash rather than your address, and it is used only to match your signup to an ad click. We never send your email address to Google in readable form for advertising purposes, and this matching is not used to build a profile of you for anyone else.
5. How we share information
We do not sell your personal information. We share it only with:
- Service providers (subprocessors) who help us run the Service — including Amazon Web Services (hosting and infrastructure), Stripe (payments), Google / Firebase (authentication), and our email and analytics providers.
- Professional advisors such as lawyers and accountants, where needed.
- Authorities or others when required by law, to enforce our agreements, or to protect the rights, safety, and security of Arbor, our customers, or the public.
- A successor in connection with a merger, acquisition, or sale of assets, subject to this Policy.
We do not share or sell your personal information, including your phone number or other mobile information, to third parties or affiliates for their own marketing, promotional, or lead-generation purposes. If you opt in to receive text messages (SMS) from Arbor, your consent and your mobile phone number are used only to send you the messages you requested and are never shared with, sold to, or rented to any third party or affiliate for marketing or lead generation.
6. Your site's visitors
If your site collects information from your own visitors (for example, through a contact or booking form), you are responsible for that information and for providing your own privacy notice to your visitors. Arbor processes that data on your behalf as part of operating your site.
7. International transfers
Arbor operates from the United States and works with team members in Colombia, and our providers process data in the United States and elsewhere. Where required, we rely on appropriate safeguards for international transfers.
8. Data retention
We keep personal information while your account is active and as needed to provide the Service. After your account ends, we delete or anonymize site content within a reasonable window (typically 30 days), while retaining billing and tax records for as long as the law requires.
9. Security
We protect information using encryption in transit, access controls, and reputable infrastructure providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of California (under the CCPA/CPRA) and the EEA/UK (under the GDPR) have additional rights, including the right not to receive discriminatory treatment for exercising them. To make a request, email hello@arbor.zone; we may need to verify your identity first.
11. Children
The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
12. Third-party links
Our site and the sites we build may link to third-party services. Their privacy practices are governed by their own policies, not this one.
13. Changes to this Policy
We may update this Policy from time to time. We will post the revised version with a new effective date and, for material changes, take reasonable steps to notify you.
14. Contact
Arbor — hello@arbor.zone — [registered business name and mailing address to be added]. For privacy questions or requests, contact us at that address.