Who is responsible.
ArpSentry is operated by ARP SENTRY S.R.L., CUI 55602852, J2026054884003. We work remotely from Bucharest, Romania. We are the controller of the personal data described in this policy. Contact us through the contact form at arpsentry.com/en/contact or at +40 749 753 530 about privacy or your information.
This policy covers our website, initial enquiries and the two apps described in the section on Google user data: ArpSentry Social, an internal tool, and ArpSentry Connect, which clients use to share their Search Console, Google Analytics and, optionally, Bing Webmaster Tools data with us and, if they choose, to let us manage them together with Google Tag Manager. If we process personal data on a client’s behalf, during a project or through either app, we do so as processor, and the agreed service terms and the data processing agreement with that client also apply.
Information we handle.
You provide information directly when you send an enquiry or call us. The website also receives technical information needed to deliver and protect the service.
Enquiries: your name, email, selected services, company size and project description, plus, if you choose them, your preferred timeline, how you would like us to contact you and a time to call. Company name is optional; phone number is optional unless you ask us to call you. We also record an enquiry reference, submission time, the page the form was submitted from, the language of that page, the service pre-selected by the link you followed (if any) and email notification status.
Correspondence: the messages and information you choose to share with our team while discussing your request.
Technical data: IP address, request and browser information, timestamps and security events processed by our hosting provider. We use the IP address to limit repeated form submissions; we do not add it to the enquiry record.
Language and cookie choices: your consent setting and, only if you allow it, your preferred language. Cloudflare provides an approximate country derived from the connection so we can initially offer Romanian in Romania and English elsewhere. We do not request precise device location.
Why we use it.
We use enquiry details to understand your request, reply and prepare an offer. For a request about a contract with you, this is necessary to take steps before entering a contract (GDPR Article 6(1)(b)). For general questions or communications with someone representing a business, we rely on our legitimate interest in responding and managing business relationships (Article 6(1)(f)).
Hosting, abuse prevention, delivery diagnostics and country-based language selection support our legitimate interests in maintaining a secure, usable website (Article 6(1)(f)). We retain your cookie choice so we can respect it. Remembering your language and using optional analytics or marketing cookies are based on your separate consent choices (Article 6(1)(a)).
Where a legal duty requires us to retain or disclose information, the basis is compliance with that duty (Article 6(1)(c)). We may also retain relevant correspondence when necessary to establish, exercise or defend legal claims, on the basis of legitimate interests.
Sending an enquiry does not subscribe you to a mailing list. Optional analytics and marketing are controlled through the cookie settings. We do not sell enquiry data or use it for automated decisions with legal or similarly significant effects.
Using the contact form.
Required fields let us understand and respond to your request. Without them, the form cannot be submitted; you can still call us on +40 749 753 530. Optional fields can be left blank.
Form drafts stay in the current page until submitted; we do not save drafts in browser storage. A submitted enquiry is stored in Cloudflare D1 and sent as an email notification to our team. If email delivery fails, a saved record may remain so the submission can be retried.
On the video portfolio page, analytics consent also allows us to measure page visits, scroll depth, and video starts, playback milestones and completions. These events use the page path and fixed video titles and identifiers; they do not include form details or URL query parameters. You can withdraw consent in Cookie settings.
If you accept analytics, we measure the enquiry steps you reach and count a successful submission only after our server confirms it. These events contain the form location (landing or contact), form identifier, step number and name, fixed service categories, the page language, whether a service was pre-selected, the contact method you chose (call, email or none) and whether you used a suggested opening sentence. They do not contain your name, email, phone, company, message or enquiry reference. Rejecting analytics stops these form events; your enquiry still works normally.
Please do not include passwords, API keys, payment card details, sensitive personal information or confidential security findings in this form. Contact us first to arrange a suitable way to share project materials.
Google user data.
Two ArpSentry apps receive data from Google APIs: ArpSentry Social, the internal tool our staff use to manage social media, advertising and analytics, and ArpSentry Connect, which clients use to give us access to their Google Search Console and Google Analytics data and, optionally, their Bing Webmaster Tools data, read-only by default, and, if they choose, to let us manage them together with Google Tag Manager. This section explains, for each app, how it accesses, uses, stores and shares that data. Both adhere to the Google API Services User Data Policy, including the Limited Use requirements.
ArpSentry Connect
ArpSentry Connect lets clients of ArpSentry give ArpSentry access to their Google Search Console and Google Analytics data, optionally to their Bing Webmaster Tools data and, if they choose, to their Google Tag Manager. The client chooses one of two levels: Read, the default, which is read-only, or Manage, which also covers Google Tag Manager and lets ArpSentry staff make configuration changes, each one confirmed and logged as described below. A client opens a link it receives from ArpSentry, signs in with Google and approves the permissions on Google’s consent screen; at either level, it can also connect Bing Webmaster Tools through a separate, optional sign-in with Microsoft. ArpSentry staff then use the data in ArpSentry’s internal tools to audit the client’s website, report on it and, with Manage, maintain its configuration. It is not offered to the public.
Data we access. With the permissions the client approves at Read:
https:/, read-only access to Google Search Console: the list of sites the account can access and its permission level on each, search analytics (clicks, impressions, click-through rate and average position by query, page, country, device and date) and URL inspection results (index status, last crawl and canonical URL for specific pages)/ www. googleapis. com/ auth/ webmasters. readonly https:/, read-only access to Google Analytics: GA4 reports, such as users, sessions, traffic sources, landing pages and key events, and account and property details, such as names, IDs, time zone and currency/ www. googleapis. com/ auth/ analytics. readonly - openid and email: the email address of the Google account used to connect, so we know which account granted access
- and, if the client connects Bing Webmaster Tools, the Microsoft permission webmaster.read, read-only access to the sites in the account, their search performance by query and page, crawl issues and link counts.
With Manage, also:
https:/, which also gives access to the sitemaps submitted for each site and their status/ www. googleapis. com/ auth/ webmasters https:/, which also gives access to the property configuration: key events, custom dimensions and metrics, data retention, the enhanced measurement settings of web data streams and Google Ads links/ www. googleapis. com/ auth/ analytics. edit https:/, with access to the client’s Tag Manager accounts and containers and their workspaces, tags, triggers and variables/ www. googleapis. com/ auth/ tagmanager. edit. containers https:/, with access to the container’s versions, to list and compare them/ www. googleapis. com/ auth/ tagmanager. edit. containerversions https:/, which gives no access to further data/ www. googleapis. com/ auth/ tagmanager. publish - and, for Bing Webmaster Tools, if the client connects it, webmaster.manage instead of webmaster.read, with access to the same Bing data plus the site’s sitemaps and blocked URLs. Access covers the sites, properties and containers the connected account can see
- we use only those that belong to the client’s engagement.
Changes. With Read, the default level, ArpSentry Connect cannot change anything in Search Console, Google Analytics or Bing Webmaster Tools: it cannot change settings, add or remove users, or submit or remove URLs and sitemaps.
With Manage, ArpSentry staff can make only these changes: in Search Console, submitting and deleting sitemaps; in Google Analytics, creating and deleting key events and marking an event as a key event, creating and archiving custom dimensions and metrics, setting event data retention, turning enhanced measurement settings on or off for a web data stream, and creating Google Ads links; in Google Tag Manager, creating, editing and removing tags, triggers and variables, only in a workspace named “ArpSentry” that ArpSentry creates in the container, creating a container version from that workspace, and publishing a version, which makes it live on the client’s website, or rolling back by publishing the previous version; in Bing Webmaster Tools, submitting URLs within Bing’s daily quota, submitting and removing sitemaps, and blocking or unblocking URLs. ArpSentry does not add or remove Search Console properties, users or owners, and does not change Google Analytics or Tag Manager users or their permissions. ArpSentry Connect does not ask for permissions to manage users, and none to delete Tag Manager accounts or containers.
Every change is made by ArpSentry staff in ArpSentry’s internal tools, only after an explicit confirmation step, and is recorded in a change log with who made it, when and what changed. Nothing is changed automatically or on a schedule.
How we use it. Only to provide the services agreed with the client: SEO audits, ranking and traffic reports, alerts about changes such as a drop in clicks or indexing problems, and the reports we deliver to the client; with Manage, also the configuration changes agreed with the client, made as described above. Staff may use an AI assistant (Claude, by Anthropic) to analyse the data for these tasks.
Who sees it. The client connects its account so that the ArpSentry staff working on its account can see this data and prepare its audits and reports. Apart from that, no one at ArpSentry reads the data unless the client asks us to or agrees, it is needed for security, such as investigating abuse, it is needed to comply with the law, or it has been aggregated and anonymised for internal operations.
How we store it. OAuth refresh tokens are encrypted at rest in ArpSentry’s own Cloudflare account. Data retrieved from Search Console, Google Analytics, Bing Webmaster Tools if the client connects it and, with Manage, Tag Manager, for audits, reports and the agreed configuration work, is stored in our database in that same account, and so is the change log. Tokens are never shown to users.
How we share it. We do not sell Google user data. It is not used for advertising, and it is not used to develop, improve or train generalised AI or machine learning models. It is shared only with the providers needed to run ArpSentry Connect: Cloudflare, which hosts it and stores the data, and Anthropic, when a staff member uses Claude to analyse it, solely to return the analysis they asked for. It is not otherwise shared with third parties. Reports based on a client’s data are shared only with that client and the ArpSentry staff working on its account. These rules apply at both levels, and data received from Bing Webmaster Tools is handled in the same way.
Retention and deletion. We keep the data only as long as the client’s engagement needs it, and delete it at the end of the engagement or earlier at the client’s request. The change log is kept as a record of the engagement for as long as the engagement lasts, and is deleted with the client’s other data when it ends. The client can revoke access at any time at myaccount.google.com/permissions, for Bing Webmaster Tools in its settings, or by asking us through the contact form or on WhatsApp. After that, ArpSentry Connect can no longer fetch any data or make any change; we delete the stored tokens and, on request, the data already retrieved.
For client data, ArpSentry acts as a data processor on the client’s behalf, under the written data processing agreement with that client (GDPR article 28). We keep each client’s data separate and never use one client’s data for another client.
ArpSentry Connect's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How long information is needed.
Enquiry and correspondence retention depends on the purpose: answering the request, ongoing discussions, a resulting project, applicable record-keeping duties and time limits for legal claims. Information should no longer be retained once these purposes no longer require it. A request that does not lead to work does not create a permanent marketing record.
The cookie lifetimes are stated above. Technical and security records are subject to the relevant provider’s retention settings and security requirements. These do not have the same lifetime as enquiry records.
Contact us to request deletion or ask about the retention of a specific enquiry. This covers relevant database and mailbox copies, subject to lawful retention needs; removing a browser cookie does not delete an enquiry you have already sent.
Your privacy rights.
Depending on the circumstances, you can ask for access to your personal data, correction, deletion, restriction of processing, or a portable copy of information you provided. You can object to processing based on legitimate interests and withdraw consent where processing relies on it.
Send your request through the contact form at arpsentry.com/en/contact or call +40 749 753 530. We may ask for proportionate information to confirm your identity. We normally respond within one month. Where the GDPR permits an extension because of complexity or the number of requests, we will explain it within that first month. If a request cannot be fulfilled, we will explain why and the options available to you.
You can complain directly to Romania’s National Supervisory Authority for Personal Data Processing (ANSPDCP), or the supervisory authority in the EU/EEA country where you live, work or believe an infringement occurred. You do not need to contact us first.
Security and policy updates.
The site uses HTTPS, server-side form validation and submission limits. These reduce risk, but no internet service can promise absolute security. The website is aimed at people enquiring about professional services and does not intentionally request information from children.
We will update this page when our website practices change and revise the date above. Where new optional processing requires consent, a policy update alone will not count as your permission.
Contact.
ARP SENTRY S.R.L. · CUI 55602852 · J2026054884003
Working remotely from Bucharest, Romania.