Privacy Policy

ArkPulse, LLC ("ArkPulse," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, disclose, and safeguard your information when you use the ArkPulse platform ("Service").

This Privacy Policy is a notice describing how we process your information — it is not itself the mechanism by which we obtain your consent. Where applicable law requires your separate consent for a particular use (for example, certain communications or biometric processing), we collect that consent through the specific flow where it applies, not merely by virtue of your using the Service.

1. Information We Collect

We collect information in the following categories:

1.1 Information You Provide Directly

When you create an account, we collect:

• Business name and verified Google Business Profile ID
• Primary contact email address
• Business category/industry
• Stripe customer ID and payment method tokens
• Google OAuth access/refresh tokens
• Review approval preferences (auto/manual approval mode)

We NEVER store:

• Full credit card numbers or CVV
• Google passwords

Login and two-factor verification codes are stored only long enough to verify them (they expire automatically within minutes) and are not retained afterward.

1.2 Automatically Collected Information

When you use ArkPulse, we automatically collect:

• IP address and geolocation
• Browser/device information
• Login timestamps
• Dashboard usage patterns
• Feature access logs
• Error reports (sent to Sentry for crash/error monitoring — see Section 4.1)
• hCaptcha verification signals (used to distinguish humans from bots on signup, contact, and chatbot forms)

1.3 Google Business Profile Data

Through Google OAuth integration, we access:

• Business locations you own/manage
• Review data (text, rating, date, reviewer info)
• Reply permissions/status

Review data is retained for the life of your account to power your dashboard and analytics — see Section 11 (Data Retention).

1.4 Payment Information

Stripe handles all payment processing. ArkPulse only receives:

• Last 4 digits of card
• Expiration date
• Payment success/failure status
• Subscription status

1.5 Calls Placed or Received by ArkPulse

ArkPulse operates its own outbound sales-calling system ("Ark") and a general inbound phone line, both AI-assisted (see Section 6.1). When you or someone at your business interacts with these systems as a sales prospect, we collect:

• Caller/callee phone number and business name/address
• A full text transcript of the call, and a recording URL for the audio (hosted by our voice provider, ElevenLabs)
• Information you provide during the call, such as your name, title, preferred form of address, email, and preferred demo time
• An AI-generated category and summary of the call (e.g., "demo request," "support")

1.6 Support, Contact Form & Demo Requests

If you contact us directly, we collect:

• Messages you send through our support threads or contact form, and your name/email/phone if provided
• Information submitted to schedule a demo or in-person visit, including business address (used with Google Places/Maps to locate the business)

2. How We Use Your Information

We use collected information to:

• Connect to your verified Google Business Profile
• Generate AI replies using your custom prompts
• Post approved replies nightly via Google API
• Process Stripe subscriptions
• Send reply summary email notifications
• Send review approval notification emails (when manual approval is enabled)
• Operate ArkPulse's own outbound sales-calling agent and inbound phone line (see Section 6.1)
• Send AI-assisted demo-scheduling and follow-up emails to prospective customers
• Monitor system security and abuse (including hCaptcha and Sentry — see Section 4.1)
• Provide technical support

2.1 AI-Generated Review Replies (the AI Feature You Control)

The one AI communication feature you directly enable and control is review-reply generation: review text (author name, content, rating) is sent to our AI providers to draft a reply, which is posted to your own Google Business Profile after approval (or automatically, if you've enabled auto-posting). No additional PII beyond what Google already publishes is shared for this purpose.

ArkPulse's outbound sales calls, inbound phone line, and demo-scheduling emails (Section 6.1) are ArkPulse's own operations directed at prospective customers — they are not a feature performed on your behalf toward your own customers.

3. How We Store and Protect Information

ArkPulse uses enterprise-grade security:

3.1 Encryption Everywhere

• Google OAuth tokens: Encrypted in our database (Fernet symmetric encryption, key derived from our application secret key, itself stored in AWS Parameter Store)
• Database: PostgreSQL with TLS + at-rest encryption
• Data transmission: HTTPS with TLS 1.2 or 1.3; earlier TLS versions are not permitted
• Static assets: Served over HTTPS via ALB with ACM certificates

3.2 Access Controls

• Zero-knowledge passwords: Hashed with PBKDF2-SHA256
• Role-based access: Staff-only via AWS IAM roles
• Admin logging: Add/change/delete actions taken in the admin interface are logged; subscription/billing changes are additionally tracked in a dedicated audit trail
• Two-factor authentication: Required at login for all users — a one-time code sent by email, in addition to your password (with an optional "remember this device" setting). This is separate from the one-time link used to confirm your email address at signup.

3.3 Data Minimization

• Review data is retained for the life of your account for analytics and support; we do not currently auto-delete it on a fixed schedule
• Call recording URLs and transcripts are automatically purged 90 days after the call — see Section 7 and Section 11 for details
• We only ask sales-call prospects for the information needed to schedule a demo (name, title, contact info, preferred time)
• Payment card data is never stored on ArkPulse servers

4. How We Share Information

ArkPulse NEVER sells your data.

We share only what's required with:

4.1 Required Service Providers

4.2 Legal Disclosures

We only disclose if required by:

• Subpoena/court order
• Law enforcement with valid warrant
• Google Business Profile violations
• Stripe payment disputes

5. Cookies & Tracking

ArkPulse uses essential cookies only:

• Session authentication
• CSRF protection
• Temporary flow state (e.g., Google OAuth connection in progress, demo access, bot-check verification)

No advertising cookies. No cross-site tracking.

6. Email, Notifications & AI-Generated Communications

You consent to receive:

• Account verification codes
• Reply summary emails (nightly)
• Review approval request emails (when manual approval is enabled)
• Billing receipts
• Service alerts

Unsubscribe anytime from non-essential emails.

6.1 ArkPulse's Own AI Sales & Support Communications

ArkPulse itself — not you or your business — sends and receives AI-assisted communications as part of how we sell and support the service:

• Demo/visit confirmation emails: Sent by ArkPulse to prospective customers when a demo or in-person sales visit is scheduled
• Outbound sales calls: ArkPulse's "Ark" AI voice agent may call prospective business customers to introduce the service
• Inbound line: Calls to ArkPulse's own phone number are triaged with AI assistance
• Review reply notifications: Posted to your own Google Business Profile in response to your customers' reviews — this is the feature performed at your direction

Except for review replies (which you control and which are posted under your own Google Business Profile), these communications are not sent under your business name and are not directed at your customers.

If you receive an outbound call from Ark and don't want to be called again:

• Tell Ark during the call — it will confirm and end the call, and your number is immediately and permanently added to ArkPulse's internal do-not-call list. Ark will never call that number again, regardless of campaign.
• Alternatively, email support@ark-pulse.com with the number to suppress.
• Outbound calls are only placed between 8:00 AM and 9:00 PM in the target region's local time.
• ArkPulse also maintains a process to load National Do Not Call Registry results into this suppression list once it has obtained registry access; this is a periodic import, not a real-time check performed on every call.

7. Biometric Data & Voice Privacy

ArkPulse's own outbound sales calls and inbound line (Section 6.1) transmit call audio in real time to ElevenLabs to generate spoken responses. This audio processing may constitute collection of biometric identifiers under applicable state law.

• Raw audio is streamed to ElevenLabs during the call and is not separately stored by ArkPulse as audio. However, ArkPulse does retain a recording URL and a full text transcript of the call in its own database once the call ends, for sales/support purposes. These recording URLs and transcripts are automatically purged 90 days after the call. Other call metadata not derived from voice (e.g., business name, phone number, call outcome) may be retained longer as ordinary sales/support records.
• ElevenLabs processes audio under their own Privacy Policy.
• Ark identifies itself as an automated calling system at the start of every outbound call.
• Because these calls are ArkPulse's own outbound/inbound operations, ArkPulse — not any business customer — is responsible for compliance with BIPA (Illinois), CUBI (Texas), and any other applicable biometric privacy law, including any required consent.

If you received a call from Ark or ArkPulse's inbound line and have questions about your voice data, email support@ark-pulse.com.

8. Your Privacy Rights & TDPSA Opt-Out

You have the following rights regarding your personal information:

• Access your data — email support@ark-pulse.com
• Delete your account — email support@ark-pulse.com to request deletion; this is currently processed manually by our team rather than through an automated self-service flow, so timing can vary
• Correct inaccurate information
• Data portability — email support@ark-pulse.com to request an export of your account data; this is currently processed manually by our team rather than through an automated self-service flow, so timing can vary

Response within 45 days (legal maximum).

Texas Residents (TDPSA)

Under the Texas Data Privacy and Security Act (TDPSA, effective July 1, 2024), Texas residents have the right to:

• Know what personal data we process and why
• Correct inaccurate personal data
• Delete personal data you have provided to us
• Data portability — obtain a copy in a portable format
• Opt out of profiling that produces legal or similarly significant effects
• Opt out of targeted advertising (ArkPulse does not engage in targeted advertising)

To exercise TDPSA rights or opt out of automated decision-making/profiling: Email support@ark-pulse.com with the subject line "TDPSA Privacy Request". We will respond within 45 days (extendable by 45 additional days with notice).

If we decline to act on your request, you may appeal by emailing the same address with "TDPSA Appeal" in the subject line. If your appeal is denied, you may contact the Texas Attorney General at texasattorneygeneral.gov.

California Residents (CCPA/CPRA)

If you are a California resident, you additionally have the right to:

• Know what personal information we collect, use, and disclose
• Request deletion of your personal information
• Non-discrimination for exercising your privacy rights

Do Not Sell My Personal Information: ArkPulse does not sell, rent, or share your personal information for monetary or other valuable consideration. We never have and never will.

9. Children's Privacy

COPPA compliant: No users under 13. Accounts discovered will be terminated.

10. International Data Transfers

US-only servers (AWS us-east-1). Non-US users consent to US data processing.

11. Data Retention

12. Data Security Incident Response

In case of a security incident involving your personal information, ArkPulse will:

1. Notify affected users without unreasonable delay after confirming a breach involving your PII, consistent with applicable state breach-notification law
2. Notify the Texas Attorney General if the breach affects 250 or more Texas residents, as and when required by the Texas Business & Commerce Code
3. Fix the root cause before resuming normal service

Specific notification deadlines vary by the residency of affected individuals and applicable state law; this section describes our general process rather than a fixed universal deadline.

13. Changes to This Policy

Non-material updates (e.g., clarifications, formatting) take effect immediately upon posting.
Material changes — including changes that expand how we use or share your data — will be emailed to all users at least 30 days before taking effect, consistent with the notice period in our Terms of Service.

14. Governing Law

Texas law applies. Disputes in Dallas County courts.

15. Contact Information

ArkPulse, LLC
1846 E Rosemeade Pkwy #1037
Carrollton, TX 75007-2637
Email: support@ark-pulse.com

Website: Contact Form